How a Munich Company Automated Security Control Evidence Collection for NIS2 Audits

Preparing for audits under the NIS2 Directive can be an arduous process for organizations subject to stringent compliance requirements. 🌐 A compliance-focused company in Munich recently faced challenges with continuously collecting security control evidence — such as access logs, change approvals, and system events — to meet NIS2 mandates. This case study explores how automating security control evidence collection transformed their audit preparedness and compliance operations.

In this article, you will learn how RestFlow stepped in as a compliance-first automation partner to design, implement, and maintain an automation workflow integrating key tools like Google Sheets, Slack, and cloud storage. We will break down the architecture and step-by-step workflow designed using n8n, outlining key benefits such as audit readiness, scalability, and reduced manual effort. By the end, readers—especially startup CTOs, automation engineers, and operations specialists—will gain actionable insights on automating compliance workflows for NIS2 and similar directives.

The Problem: Inefficiencies and Risks in Manual Security Control Evidence Collection

The client is a specialized compliance advisory company based in Munich, Germany. Operating within the compliance vertical, their core responsibility was to support internal teams and their clients in adhering to the NIS2 Directive. NIS2 addresses wide-ranging themes including cyber risk management, incident reporting, supply chain security, and governance, all of which require rigorous documentation and evidence collection.

Prior to automation, the client’s security control evidence collection was done manually. Their security and compliance teams spent an estimated 20–30 hours per month compiling evidence such as access logs, configuration changes, approvals, and incident reports from multiple disconnected sources.

This manual process was fraught with challenges:

• Time-consuming data gathering: Compliance staff had to pull data from email requests, spreadsheets, and logs stored in various silos.
• High error rates: Manual transcription and human errors led to incomplete or inconsistent evidence records, risking non-compliance.
• Lack of real-time visibility: Auditors and managers lacked up-to-date dashboards, making audits stressful and last-minute.
• Operational friction: Delays and disjointed communications between teams impeded incident reporting and supply chain security tracking.

The accumulation of these factors incurred risks including penalties for NIS2 non-compliance, longer audit turnaround times, and increased operational costs. The compliance and IT security teams were eager for an automated, scalable solution that enabled continuous collection and validation of evidence.

Our Approach: RestFlow’s Compliance-First Automation Strategy

RestFlow was engaged to assess and redesign the security control evidence collection process leveraging automation-as-a-service. Our approach was grounded in deep discovery and process mapping workshops with the client’s security, compliance, and IT teams.

Key steps included:

• Understanding data sources: Identifying all systems and tools producing evidence (e.g., access management tools, ticketing systems, email approvals).
• Defining compliance themes: Mapping evidence needs against NIS2 requirements—focusing on cyber risk management, incident reporting, supply chain security, and governance.
• Choosing automation tools: After evaluation, we selected n8n as the orchestration platform for its flexibility, open-source nature, and strong API integration capabilities.
• Designing a modular architecture: Ensuring workflows could easily adapt to evolving compliance needs, new data sources, and team expansions.

This foundation allowed us to craft a solution tailored for continuous, automated evidence collection and validated data aggregation to accelerate audit readiness.

Architecture & Workflow: Automating Security Control Evidence Collection for NIS2

Global Architecture Overview

The architecture leverages n8n as the central orchestration platform, orchestrating data inputs and outputs between multiple services:

• Triggers: Scheduled execution every 4 hours, webhook triggers from access management and ticket tools.
• Data sources: Integrations with cloud access management APIs, email inbox filters (via Gmail node), Google Sheets for interim data staging, and Slack for team notifications.
• Processing & validation: In n8n, conditional nodes validate evidence completeness, branch for different control types, and enrich data with metadata.
• Outputs: Consolidated evidence reports uploaded to secure cloud storage, dashboards updated in Google Sheets, and audit status notifications sent to Slack channels.

This design ensures continuous monitoring, low-latency evidence updates, and centralized reporting.

End-to-End Workflow Walkthrough

1. Trigger Node – Scheduler or Webhook: Initiates workflow every 4 hours or on event-based webhook triggers (e.g., a new approval email received).
2. Data Collection Nodes: API calls fetch access logs; Gmail nodes parse approval emails; Google Sheets nodes read prior validation statuses.
3. Data Validation Node: Checks for completeness (e.g., all required evidence files present). Conditional logic routes incomplete evidence for follow-up.
4. Enrichment Nodes: Adds metadata such as timestamps, control owner, and NIS2 theme tags.
5. Output Nodes: Upload compiled evidence to cloud storage (e.g., AWS S3 or Google Drive), update summary dashboard in Google Sheets, and send Slack notifications summarizing status.

The workflow handles multiple evidence types, dynamically branching according to compliance theme.

Step-By-Step Node Breakdown 🚀

1. Scheduler Trigger Node

This node triggers the workflow every 4 hours using n8n’s built-in scheduler.
Key parameters:

• Interval: Every 4 hours
• Time zone: Europe/Berlin

Ensures frequent, consistent evidence updates.

2. Gmail Email Parsing Node ✉️

Uses Gmail integration to monitor a dedicated inbox for incoming control approval emails.
Key configurations:

• Filter: Subject contains ‘Security Control Approval’
• Parsing: Extract JSON or predefined key-value pairs from email body
• Authentication: OAuth2 with scope to read emails

Extracts approvals as evidence with timestamp and approver name.

3. API HTTP Request Node

Fetches access logs from cloud access management APIs.
Parameters:

• Endpoint: https://api.accessmanagement.company.com/logs
• Authentication: Bearer token stored securely as n8n credential
• Query filters: Logs from last 4 hours

Pulls granular logs needed as audit evidence.

4. Google Sheets Read & Write Nodes

Intermediate staging and reporting:

• Read node: Retrieves previous evidence statuses to avoid duplicates
• Write node: Updates dashboard sheets with aggregated data and audit statuses

Enables simple, accessible reporting for stakeholders.

5. Conditional & Switch Nodes

Implements decision logic:

• Validate whether all evidence elements are present
• Route incomplete cases to follow-up notification nodes
• Branch actions for different NIS2 themes

Ensures workflow adapts dynamically to data state.

6. Slack Notification Node 🔔

Sends audit status alerts:

• Channel: #security-compliance
• Message formatting: emoji-coded compliance status
• Attachments: Summary tables in message body

Keeps teams informed in near-real-time.

7. Cloud Storage Upload Node

Uploads compiled evidence packages in .zip format:

• Destination: AWS S3 bucket configured with private access
• File naming: consistent timestamps + control category

Enables secure archival for audit review.

Error Handling, Robustness & Security

Error Handling & Retries

Nodes configured with automatic retries (up to 3 attempts with exponential backoff) to handle transient API or network issues. Failures trigger Slack alerts for immediate human intervention.

Logging & Observability

All run data logged in n8n execution history. Critical errors and anomalies propagated to a dedicated error-reporting Google Sheet accessible by compliance managers.

Idempotency & Deduplication

Unique identifiers and timestamp checks in Google Sheets prevent duplicate records. Email node filters ensure reprocessing is avoided.

Security & Data Protection

• API credentials and OAuth tokens securely stored in n8n credentials manager with restricted access.
• Data in transit encrypted via HTTPS.
• Access to cloud storage limited to key compliance staff.
• Compliance with GDPR by masking any personal information in logs.

Performance, Scaling & Extensibility

The workflow is designed modularly for easy scaling:

• Trigger scaling: Optionally switch to event-driven webhooks for higher frequency.
• Batch processing: Parallel HTTP requests and batch Google Sheets updates reduce run time.
• Multi-team support: Dynamic branching enables adding new business units or control types.
• Queue mechanism: Implemented via database table to queue new evidence for orderly processing if volume spikes.

RestFlow’s managed hosting ensures stable performance as compliance demands grow.

Tool Comparison Tables

Automation Platform	Cost	Pros	Cons
n8n	Free tier + Paid cloud hosting	Open source, highly customizable, supports complex workflows	Requires technical know-how for setup and maintenance
Make (formerly Integromat)	Subscription-based plans	Visual interface, strong app connectors, scenario versioning	Costly at scale, less flexible than n8n for custom API logic
Zapier	Tiered pricing with task limits	Easy setup, broad app ecosystem, ideal for simple workflows	Limited customization and conditional logic for complex compliance needs

Integration Method	Cost	Pros	Cons
Webhook Triggers	Usually free within platform limits	Real-time, efficient, low latency	Requires source systems to support webhooks
Polling / Scheduler	Free to moderate, depending on frequency	Easy to implement, compatible with most APIs	Potential latency, higher API usage costs

Data Storage Option	Cost	Pros	Cons
Google Sheets	Free up to storage limits	Easy access & visibility, simple sharing	Limited rows & concurrency, not ideal for large data
SQL Database (PostgreSQL, MySQL)	Hosting costs apply	Highly scalable, transactional integrity, complex queries	Requires DB administration and security controls

Results & Business Impact

Post-implementation, the client observed significant improvements:

• Time savings: Reduced manual evidence gathering time by 75%, saving approximately 22 hours monthly.
• Error reduction: Nearly 90% drop in missing or inconsistent evidence entries.
• Audit readiness: Compliance managers could generate audit reports in under 30 minutes versus days previously.
• Scalability: Workflow handled 3x more evidence volume during supply chain audits without added staff.
• Calm operations: Reduced incident escalations due to timely and reliable evidence collection.

The automation created transparency and empowered the security and compliance teams to focus on risk mitigation rather than administrative tasks.

Pilot Phase & Maintenance Disclaimer

The solution was initially deployed in a two-month pilot phase running in parallel with manual processes. This phase surfaced edge cases and allowed fine-tuning.

After successful pilot validation, RestFlow assumed responsibility for managed Automation-as-a-Service, including ongoing hosting, performance monitoring, security updates, and workflow maintenance to keep audit readiness continuously assured.

Potential clients should note that automation deployments involve iterative improvements and that RestFlow’s sustained partnership model ensures resilience and evolution alongside regulatory changes.

Frequently Asked Questions about Automating Security Control Evidence Collection for NIS2

Conclusion: Transforming NIS2 Audit Preparedness through Automated Evidence Collection

Through the partnership with RestFlow, the Munich-based compliance company revolutionized their approach to security control evidence collection for NIS2 audits. Automation replaced tedious manual efforts with streamlined workflows that continuously gather, validate, and report on critical compliance data across cyber risk management, incident reporting, supply chain security, and governance domains.

By leveraging n8n automation orchestrating tools like Gmail, Google Sheets, Slack, and secure cloud storage, they achieved significant time savings, improved data quality, and gained real-time visibility—dramatically reducing audit friction.

RestFlow’s Automation-as-a-Service offering ensured the solution remained robust, secure, and scalable, supporting evolving regulatory demands without burdening internal teams.

If your organization is facing daunting compliance challenges or tired of manual audit evidence management, don’t hesitate to act. Explore the Automation Template Marketplace for proven workflows or create your free RestFlow account to start automating today.