Extension module
Compliance and audit evidence
NIS2, DORA, ISO 27001, SOC 2 and EU AI Act controls measured every week, with evidence your auditor accepts.
8checks
In short
Compliance and audit evidence is an extension module of The Governor, Ustrema's governance app for Microsoft Power Platform, Copilot Studio and agents. It is added to the platform licence. It runs 8 checks every week to answer one question: Can we show the auditor what we did, and when? Every failing check becomes a finding with an owner, closed with Microsoft Purview Compliance Manager, Managed Environments.
The question it answers
Can we show the auditor what we did, and when?
What it measures
Each of the 8 checks looks for patterns like these, in every environment, every week:
- Agents that talk to people without an AI disclosure
- Agents without EU AI Act fields: purpose, owner and risk class
- Data residency position not documented
- Power Platform missing from the NIS2 or DORA scope
What you get
Once the findings are closed and the controls are in place, your tenant has:
- Frameworks, control owners and sign-offs in one Compliance area
- An evidence pack for any period, with weekly results and fix dates
- An export for Microsoft Purview Compliance Manager and your GRC tool
- Audit readiness with our experts before an ISO 27001, NIS2 or DORA audit
Microsoft services it works with
The Governor checks that these Microsoft controls are on, and our experts configure them:
- Microsoft Purview Compliance Manager
- Managed Environments
Questions about this module
Is Compliance and audit evidence included in the platform licence?
No. Compliance and audit evidence is an extension module: it needs the platform licence and is added to it per tenant, switched on by the same signed licence code. There are no per-user fees.
How often does The Governor check compliance and audit evidence?
Every week. The scan runs inside your own tenant, measures all 8 checks again and shows what closed, what is still open and what came back since the last scan.
Which Microsoft services does it work with?
Microsoft Purview Compliance Manager, Managed Environments. The Governor checks that they are switched on and configured, and Ustrema consultants set them up when they are not.
Sources
The primary documentation and law this page relies on. Each link opens the original source.