Every finding gets an owner.

Findings don’t fix themselves. Hand them to the people who can, accept the ones you consciously live with – and keep a record of every decision.

Gapsio finding detail with assignment and an exception being created: justification, owner, ticket and expiry date
Every finding and every exclusion has the same small workflow: assign it, or document an exception.

Assign

Hand a finding or an exclusion to an Entra user, a security group or a distribution list, picked from the directory. The assignee shows up in the findings list, with its own filter.

Accept with a reason

Justification, owner, optional ticket and an expiry date – or no expiry. Accepted items stop counting as open and come back on their own when the exception expires.

Audit log

Every accept, revoke, assign and unassign is recorded with who and when – the trail your auditor asks for.

Notifications

New findings above the severity you choose go to Teams or Power Automate – including the assignee, so a flow can e-mail them directly.

The page your auditor asks for.

Open findings and accepted risks, sorted by ISO/IEC 27001:2022 Annex A and NIS2 Article 21(2) controls. Print it, save it as PDF or export the list for the audit file – with the date and the Gapsio version that produced it. A mapping aid, not a certificate.

Gapsio audit evidence view: controls of ISO 27001 and NIS2 with open findings and accepted risks
Audit evidence: per control what is open, what was consciously accepted and what Gapsio checks.

Every run, on record.

Dated snapshots in your own storage account, optionally immutable. See the drift between two runs and export any table as CSV – evidence your auditor can work with.

Gapsio changes between runs with a chart of changes per day
Changes: what was added, changed or removed between two runs, day by day.

See it in your own tenant.

Read-only, self-hosted in your Azure subscription, running in minutes. Every check is free.

Get started All modules