Preuves techniques signées
pour 6 frameworks réglementaires.
NIS2, ENS, ISO 27001, PCI-DSS, HIPAA et DORA. Aitamit génère automatiquement les preuves techniques de conformité depuis les données de l'agent, signées avec SHA-256 et vérifiables publiquement.
Le problème de la conformité manuelle
Un audit NIS2 ou ENS demande des preuves techniques concrètes : que chaque équipement a un chiffrement disque actif, antivirus à jour, patches actuels, comptes admin contrôlés, journaux immuables… pour chaque actif de votre flotte.
Le faire manuellement signifie : tableurs, captures d'écran, embaucher consultance à 10 000-30 000 €, répéter à chaque renouvellement. Et même alors, les preuves sont statiques et obsolètes dès l'impression.
Aitamit le fait automatiquement et en temps réel. Quand l'auditeur arrive, vous générez le rapport signé en 30 secondes.
Les 6 normes les plus demandées en Europe
Chaque framework a ses contrôles mappés aux données collectées par l'agent.
NIS2 (EU Directive 2022/2555)
Mandatory since October 2024 for essential and important entities: energy, transport, healthcare, banking, digital public sector, water, food, chemicals, critical manufacturing, ICT managers.
Aitamit covers:- Art. 21.2.a — Risk analysis (full inventory)
- Art. 21.2.b — Incident management (immutable audit)
- Art. 21.2.d — Supply chain security (SBOM)
- Art. 21.2.e — Maintenance (patches, EOL)
- Art. 21.2.f — Effectiveness of measures (measurable posture)
- Art. 21.2.g — Basic hygiene (AV, firewall, screen lock)
- Art. 21.2.h — Encryption (disk_encrypted, TPM, Secure Boot)
- Art. 21.2.i — Access control (admin accounts, MFA)
ENS (Spanish RD 311/2022)
National Security Scheme. Mandatory for Spanish public sector and critical providers. Three categories: Basic, Medium, High.
Covered families:- mp.eq — Equipment protection
- op.exp — Operations
- mp.com — Communications protection
- op.acc — Access control
- mp.s — Service protection
Reports usable as technical evidence in ENS audits.
ISO/IEC 27001:2022
International information security management standard. Voluntary certification by accredited body.
Annex A — Controls covered:- A.5.10, A.5.16, A.5.18 — Access and authentication
- A.8.1 — Asset inventory
- A.8.7 — Malware protection
- A.8.8 — Technical vulnerability management
- A.8.9 — Configuration management
- A.8.11 — Data encryption
- A.8.16 — Monitoring activities
PCI-DSS v4.0
Mandatory for any company that processes, stores or transmits payment card data.
Requirements covered:- Req. 5 — Antimalware protection (AV, EDR)
- Req. 6 — Secure systems and apps (patches)
- Req. 7 — Function-based access restriction
- Req. 8 — Identification and authentication
- Req. 10 — Access logging and monitoring
- Req. 11.5 — Unauthorized change detection
HIPAA Security Rule
For US entities managing health information (PHI): hospitals, clinics, medical insurers and their business associates.
Technical safeguards covered:- §164.312(a) — Access control
- §164.312(b) — Audit controls
- §164.312(c) — Integrity
- §164.312(d) — Person/entity authentication
- §164.312(e) — Transmission security
DORA (EU Regulation 2022/2554)
Digital operational resilience. In force since January 2025 for EU financial entities.
Aitamit covers:- Art. 5-15 — ICT risk management framework
- Art. 9 — Protection and prevention
- Art. 10 — Detection
- Art. 11 — Response and recovery
- Art. 17-23 — ICT incident management
- Art. 28-30 — Third-party ICT risk
Des données de l'agent au PDF signé
4 étapes automatiques. Zéro tableur.
Agent reports 25+ technical controls
On every heartbeat (15 min by default), the Aitamit agent sends the real status of 25+ security controls: disk encryption, AV installed and updated, pending patches, firewall, admin accounts, screen lock, TPM, Secure Boot, SMB config, RDP NLA, USB storage, Office macros, BitLocker.
Aitamit maps each control to the active framework
When you activate a framework (e.g. NIS2 + ENS + ISO 27001), Aitamit automatically maps each agent data point to the corresponding article/control. One technical data point, multiple compliance.
Real-time status with percentage and gaps
The console shows current status: for each regulatory control, how many assets comply and which fail, with the exact technical value. Continuous preventive audit.
Generate the signed PDF in 30 seconds
Button "Generate report" → select framework + period → downloadable PDF with: global compliance percentage, status of each control with technical evidence per asset, documented exceptions, and SHA-256 signature publicly verifiable at aitamit.com/verify.
SHA-256 vérifiable par l'auditeur
Chaque PDF généré par Aitamit porte au pied un hash SHA-256 calculé sur le contenu du rapport + le hash du rapport précédent du tenant.
Pour vérifier l'intégrité d'un rapport :
- Your auditor goes to https://aitamit.com/verify (public access without login).
- Drags the PDF to the verification area or enters the hash manually.
- Aitamit confirms if the hash matches the immutable audit record and shows: tenant that generated it, user who requested it, UTC timestamp.
Si quelqu'un altère ne serait-ce qu'un caractère du PDF, le hash ne correspond plus et la vérification échoue.
Conçu pour servir de preuve technique lors des audits ISO 27001 / NIS2 / ENS.
Ce qu'Aitamit NE couvre PAS
Nous ne vendons pas du vent. Voici ce que vous devez apporter.
- Written policies: NIS2/ENS/ISO require organizational documentation (security policy, acceptable use policy, incident policy). Aitamit handles the technical part; written policies are provided by you or your DPO.
- Personnel training and awareness: frameworks require demonstrable employee training. Aitamit is not a training platform.
- Risk analysis: formal risk analysis (MAGERIT, ISO 27005) is done by your team or consultant.
- Business continuity (BCM): continuity and recovery plans are out of Aitamit's scope.
- External audit: Aitamit generates technical evidence. The audit itself (ISO 27001, ENS) is performed by an independent accredited body.
En résumé : Aitamit est la pièce technique de la conformité. Nous couvrons ~70% d'un projet NIS2/ENS typique — les 30% restants (politiques écrites, formation, audit) restent du travail organisationnel que vous devez faire.
Audit NIS2 ou ENS cette année ?
Démo 45 min avec cas réel de votre secteur. Nous vous montrons le rapport signé en direct.