A gap you haven’t checked is not a pass.
Avah Evidence gathers read-only evidence from your IT and OT systems, has a second person confirm it, and reports every requirement as met, not met, unknown or not assessed. There is no overall score to round the gaps away.
One plant, one standard, 36 requirements
An example, not a customer
- Met: 13
- Not met: 5
- Unknown: 6
- Not assessed: 12
Avah Evidence in 53 seconds
Two estates, IT and OT, assessed together, every finding recorded against its standard with the evidence behind it.
Three jobs, for the people who do them
Each piece works on its own and builds on the one before. Customers buy the parts they need.
- Know
- See what is actually on your networks, office and plant floor alike, from systems that already know: Active Directory, network switches, device management. Evidence is quarantined until a colleague reviews it, so nobody can approve their own upload.
- Assess
- Work through NIS2, the NIST Cybersecurity Framework and SP 800-82, EU GMP Annex 11 or FDA 21 CFR Part 11, one requirement at a time, each answer backed by evidence. ISO/IEC 27001, IEC 62443-3-3 and GAMP 5 come as reference packs: every clause by number, read alongside your own copy of the standard. Whoever records the findings cannot sign them.
- Govern
- Give the board one view across every site and subsidiary: what is known, what is not, and what the management body is personally accountable for under NIS2. The board sees everything and changes nothing.
How information gets in
A small program, the collector, runs inside your network. It reads; it never acts.
Install it inside
It only ever connects out to Avah Evidence. You open no inbound port.
Admit it by name
Your administrator approves it for specific read-only sources, and can revoke it at any time.
It reads what is known
The computer list from Active Directory, which devices a switch has seen, your device manager’s inventory.
The rest, by hand
Policies, test records, certificates: upload them, and they wait in quarantine until someone else reviews them.
It never touches production equipment. It learns about controllers and operator screens from the switches they talk through, so nothing pings a PLC, scans a range or changes a setting. There is no command it can be sent, by us or anyone.
Made for regulated manufacturing
Who uses it
- Directors who answer for cybersecurity under NIS2
- Quality assurance and the qualified person
- IT and OT administrators, each seeing only their own assets
- Group functions overseeing sites in several countries, each keeping its data in its own region
What it will not claim
Avah Evidence does not certify you, and does not call you compliant. It gives you, and your auditor, the evidence for each requirement and an honest account of what is still unknown. Where an AI suggests anything, it is marked as a suggestion and a person decides.
See it with your own sites on the map
A walkthrough takes 30 minutes. Bring your list of sites and the standards you answer to.