---
title: "Auditor"
manual: "nr-vault"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-vault:auditor@main"
source: "Auditor/Index.rst"
rendered: "2026-10-01T07:44:37+00:00"
---

# Auditor {#auditor}

Material for a security assessment, a certification audit, or an internal
review of an nr-vault deployment: what is in scope, which controls exist and
where they are implemented, which artefacts to collect, and how to demonstrate
that a control works rather than merely that it is configured.

-   [Target of evaluation](https://docs.typo3.org/permalink/netresearch/nr-vault:target-of-evaluation@main)
-   [Control mapping](https://docs.typo3.org/permalink/netresearch/nr-vault:control-mapping@main)
-   [Evidence collection](https://docs.typo3.org/permalink/netresearch/nr-vault:evidence-collection@main)
-   [Verification procedures](https://docs.typo3.org/permalink/netresearch/nr-vault:verification-procedures@main)

## How to use this section {#auditor-how-to-use}

| Page | Purpose |
| --- | --- |
| [Target of evaluation](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-target-of-evaluation@main) | Scope the engagement. **Read this first** — it states what nr-vault is not, and which controls an assessor would expect to find that are correctly somebody else's. |
| [Control mapping](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-control-mapping@main) | Implemented controls mapped to BSI IT-Grundschutz modules and OWASP ASVS chapters, with an implementation pointer and an evidence source per row. Includes a list of **declared gaps**. |
| [Evidence collection](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-evidence-collection@main) | The read-only commands to run and the artefacts to keep. Safe on production. |
| [Verification procedures](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-verification-procedures@main) | Reproducible procedures with expected results. Several are marked **STAGING-ONLY** because they deliberately misconfigure the vault or manipulate the audit table. |

## The three things worth checking first {#auditor-reading-order}

If time is short, these three findings are the ones that most often change the
conclusion:

1.  **Is the hardened profile actually enforced, or just configured?**
    `vault:break-glass --status` reports
    `adminOverrideDisabledEffective`. A raw `disableAdminOverride = 1` with
    an effective `no` means the profile is `standard` and the flag is
    inert — a common and consequential mismatch.
    ([Procedure 3 — The administrator override is effectively withdrawn](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-verify-admin-override@main))
1.  **Does independent evidence exist?** `vault:audit-verify` reporting
    `NO_EXTERNAL_SINK`, or an anchor file stored only on the host whose
    database it protects, means a full audit-table reset would be
    undetectable — regardless of how sound the hash chain is.
    ([Audit chain integrity](https://docs.typo3.org/permalink/netresearch/nr-vault:auditor-evidence-chain@main))
1.  **Which master-key provider is in use?** With `typo3`, anyone who can
    read `config/system/settings.php` can derive the master key, and most
    backup jobs already include that file alongside the database dump.
    ([The typo3 provider does not separate the vault from TYPO3](https://docs.typo3.org/permalink/netresearch/nr-vault:security-known-limitations-typo3-provider@main))

## On claims {#auditor-honesty}

The documentation for this extension deliberately avoids "tamper-proof",
"military-grade" and "secure deletion". The corresponding accurate terms are
**tamper-evident** (detection, not prevention), **authenticated encryption with
256-bit keys**, and **minimised exposure** (a shortened window, not cleared
memory).

If an assessment encounters a stronger claim about nr-vault — in a proposal, a
datasheet, or a conversation — [Known limitations](https://docs.typo3.org/permalink/netresearch/nr-vault:security-known-limitations@main) is the page
that contradicts it, and it is maintained as part of the codebase rather than
as marketing copy.