Audit Readiness Scanner
The Audit tab runs an on-demand scan of 30 automated checks against the connected database and scores the result out of 100 — a structured way to find access-hygiene gaps before an auditor does.
What it checks
The 30 checks span five categories:
| Category | Checks |
|---|---|
| Authentication & Access Control | 8 |
| Least Privilege | 6 |
| Logging & Audit Trail | 6 |
| Connection Security | 5 |
| Data Protection | 5 |
Every check maps to at least one of five frameworks — SOC 2, HIPAA, PCI-DSS, GDPR, and CIS Benchmark — and each finding lists the controls it relates to, the current vs expected value, and a remediation hint.
Running a scan
- Pick an Environment: Production (severities apply as documented), Staging (Critical counts as High), or Development (Critical/High count as Medium, Low as Info). This adjusts effective severity so a dev database isn’t graded like production.
- Click Run Scan.
Scans are on-demand only — there’s no scheduling. Scans run read-only queries and are themselves recorded in the audit log.
Interpreting the score
Scoring starts at 100 and subtracts a penalty per failing check by effective severity (High −10, Medium −5, Low −2, Info 0). Any failing Critical check caps the score at 40 — a deliberately loud signal. Per-framework scores are computed the same way over each framework’s checks, shown with assessed/failing counts.
Filter findings with All findings / Failing only / Accepted. Statuses are Pass, Fail, Not applicable, Error, and Accepted.
Accepting a risk
Some failures are deliberate (“this is a dev box”, “compensating control exists”). Click Accept risk on a finding and write a justification (minimum 10 characters — reference the review, ticket, or date). Accepted findings stop counting against the score, but they don’t disappear: they’re listed under the Accepted filter and in a dedicated appendix of the PDF export, justification included. Revoke acceptance puts a finding back in play. Acceptances persist per connection.
Exporting
- PDF — a report with the score, per-framework summary, findings grouped by category, the accepted-risks appendix, and the compliance disclaimer on every page footer.
- CSV — one row per finding (category, check, severity, effective severity, status, current and expected values, frameworks, remediation, and any accepted-risk justification).
This is the export to hand to an auditor or attach to a review ticket. (It exports the scan report only — the audit log is a separate thing; see The Audit Log.)
The disclaimer — read it
The report carries this text on every page, and it’s the honest frame for the whole feature:
AccessVault checks database-level technical controls only. These checks support but do not replace a formal compliance audit. Frameworks such as SOC 2, HIPAA, PCI-DSS, and GDPR require organisational, administrative, and physical controls beyond database configuration. Consult a qualified auditor for compliance certification.
A score of 100 means your database-level technical controls look good — not that you’ll pass an audit, and not that you’re compliant with any framework.