Access management
MFA, roles, ownership checks at query level, emergency access.
AFTER THE AUDIT / NIS2 · PEN TEST · REMEDIATION PLAN
The audit told you what to fix. I fix it, even if I didn’t write the system.
After an audit report, the policies get written quickly. What stays open are the items that reach into your own software: logging, access management, MFA, passwords in config files, unsupported components. Someone has to solve these in the code — and before the next audit.
Let’s talk01 / What I fix
The items that touch code — documented so that they count as evidence at the next audit.
Logging and traceability
Who, what, when, from where — structured, ready to forward to your SIEM.
Secrets
Passwords and keys out of config files and repositories into a vault; leaked ones rotated.
Unsupported components
Framework and library upgrades, or a compensating control when replacement is out of proportion.
Pen test findings
Fixing the reported items — and the similar places the report did not list.
Continuity
Reproducible releases, tested restores, transferable documentation — an orphaned system is a continuity risk in itself.
What I don’t do
- Audits or legal assessment — that is the auditor’s and the lawyer’s work.
- The verification retest after the fix — leave that to the auditor or the pen tester, not to whoever fixed it.
- Your general IT estate (office network, endpoints, email). The affected system itself, however, down to the servers and operations.
02 / How it works
From the remediation plan to the next audit.
- 01
Findings
You send the items of the audit report or pen test that touch code — anonymised is enough for a first conversation.
- 02
Assessment
1–3 weeks, fixed fee: root cause, fix, risk, order and a fixed price per item. You decide on every item.
- 03
Fix
In waves, with versioned releases and a rollback plan; evidence for the audit for every item.
- 04
Retest
The auditor or pen tester verifies it — at the next audit, the item shows as closed.
03 / Regulator data
You are not alone with this.
After the first NIS2 audits in Hungary, 38.6% of organisations received a high or critical risk rating (≈ 820 organisations). According to the authority, the largest gap is the practical implementation of access management and business continuity — exactly what a policy alone cannot close.
Source: SZTFH, SZTFH-JOG/569-2/2026 (16 October 2026). The organisation count is an estimate: 2,132 audits completed on time × the published share.
04 / As a supplier
NIS2 also requires you to assess your suppliers. You can assess me too.
Supplier compliance pack
Secure development policy, SBOM, succession plan, escrow statement, incident SLA, audit-rights clause, documentation template. Available on request.
Request ✉Sample assessment
What an assessment delivers: five typical findings in detail, with fictional data (Hungarian).
PDF ↓Not a certificate and not the result of an independent audit: documented practice and commitments that can be written into a contract.
Are you a security officer, auditor or pen tester?
When your client asks who to trust with the findings that touch code: I work as a subcontractor or by referral, and the client relationship stays yours.
Write to me05 / →
Is an item still open?
Send me the finding — anonymised is fine. In thirty minutes I will tell you whether it is worth fixing in code, and if it isn’t, I will tell you that too.
Let’s talkhello@tokodisoftware.com