---
title: "Auditor"
manual: "nr-vault"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-vault:auditor@1.0"
source: "Auditor/Index.rst"
rendered: "2026-09-18T07:37:50+00:00"
---

# Auditor {#auditor-1}

Material for a security assessment, a certification audit, or an internal
review of an nr-vault deployment: what is in scope, which controls exist and
where they are implemented, which artefacts to collect, and how to demonstrate
that a control works rather than merely that it is configured.

-   [Target of evaluation](https://docs.typo3.org/permalink/netresearch/nr-vault:target-of-evaluation@1.0)
-   [Control mapping](https://docs.typo3.org/permalink/netresearch/nr-vault:control-mapping@1.0)
-   [Evidence collection](https://docs.typo3.org/permalink/netresearch/nr-vault:evidence-collection@1.0)
-   [Verification procedures](https://docs.typo3.org/permalink/netresearch/nr-vault:verification-procedures@1.0)

## How to use this section {#how-to-use-this-section}

| Page | Purpose |
| --- | --- |
| [Target of evaluation](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-target-of-evaluation@1.0) | Scope the engagement. **Read this first** — it states what nr-vault is not, and which controls an assessor would expect to find that are correctly somebody else's. |
| [Control mapping](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-control-mapping@1.0) | Implemented controls mapped to BSI IT-Grundschutz modules and OWASP ASVS chapters, with an implementation pointer and an evidence source per row. Includes a list of **declared gaps**. |
| [Evidence collection](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-evidence-collection@1.0) | The read-only commands to run and the artefacts to keep. Safe on production. |
| [Verification procedures](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-verification-procedures@1.0) | Reproducible procedures with expected results. Several are marked **STAGING-ONLY** because they deliberately misconfigure the vault or manipulate the audit table. |

## The three things worth checking first {#the-three-things-worth-checking-first}

If time is short, these three findings are the ones that most often change the
conclusion:

1.  **Is the hardened profile actually enforced, or just configured?**
    `vault:break-glass --status` reports
    `adminOverrideDisabledEffective`. A raw `disableAdminOverride = 1` with
    an effective `no` means the profile is `standard` and the flag is
    inert — a common and consequential mismatch.
    ([Procedure 3 — The administrator override is effectively withdrawn](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-verify-admin-override@1.0))
1.  **Does independent evidence exist?** `vault:audit-verify` reporting
    `NO_EXTERNAL_SINK`, or an anchor file stored only on the host whose
    database it protects, means a full audit-table reset would be
    undetectable — regardless of how sound the hash chain is.
    ([Audit chain integrity](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-evidence-chain@1.0))
1.  **Which master-key provider is in use?** With `typo3`, anyone who can
    read `config/system/settings.php` can derive the master key, and most
    backup jobs already include that file alongside the database dump.
    ([The typo3 provider does not separate the vault from TYPO3](https://docs.typo3.org/permalink/netresearch/nr-vault:security-known-limitations-typo3-provider@1.0))

## On claims {#on-claims}

The documentation for this extension deliberately avoids "tamper-proof",
"military-grade" and "secure deletion". The corresponding accurate terms are
**tamper-evident** (detection, not prevention), **authenticated encryption with
256-bit keys**, and **minimised exposure** (a shortened window, not cleared
memory).

If an assessment encounters a stronger claim about nr-vault — in a proposal, a
datasheet, or a conversation — [Known limitations](https://docs.typo3.org/permalink/netresearch/nr-vault:security-known-limitations@1.0) is the page
that contradicts it, and it is maintained as part of the codebase rather than
as marketing copy.