How RestFlow Reduced Manual Compliance Work in Warsaw by Automating Access Review Under NIS2

In the evolving landscape of cybersecurity regulation, compliance is often a complex, time-consuming challenge for organizations. 🌐 For a security firm based in Warsaw, adhering to the NIS2 Directive meant managing tedious and repetitive manual tasks around access reviews. These activities consumed countless hours and risked human errors, which posed threats to their compliance and governance standards.

This case study explores how RestFlow stepped in as the compliance-first automation partner to automate access review processes under NIS2. Readers will learn how the automation was architected using popular orchestration tools like n8n, integrated with essential services like Slack and Google Sheets to drive a scalable, audit-ready compliance workflow that dramatically cut manual labor while strengthening cyber risk management and governance.

Case Context & The Problem

The client is a mid-sized security company located in Warsaw, Poland, specializing in cyber risk management and incident response. Their operations and compliance teams were responsible for executing periodic access reviews across all IT systems to meet NIS2 Directive requirements.

Before automation, these teams handled access reviews manually using spreadsheets, emails, and numerous disconnected tools. The process involved numerous manual reminders, chasing approvals, and consolidating audit trails into reports. This led to:

• Approximately 40 hours per month spent on compliance coordination alone.
• Human errors causing incomplete or missed reviews up to 12% of the time.
• Delayed approvals affecting incident reporting and governance timeliness.
• Lack of real-time visibility and audit readiness, complicating supply chain security assurances.

The manual process strained internal resources and exposed the company to compliance risks that could lead to regulatory penalties or weakened cybersecurity postures.

Our Approach: RestFlow’s Automation Proposal

RestFlow was engaged to analyze and automate this critical compliance process with a focus on reducing manual workload while strengthening control and traceability.

The key steps in our approach were:

• Discovery: We mapped out the entire access review lifecycle, identifying all touchpoints, stakeholders, and data systems involved.
• Process Analysis: We pinpointed pain points—such as manual email reminders, error-prone data entry, and fragmented audit logs—that lent themselves well to automation.
• Tool Selection: After evaluation, we chose n8n as the orchestration tool due to its open-source flexibility, strong integration ecosystem, and ability to handle complex conditional logic.
• Integration Identification: Key systems such as Gmail for emails, Google Sheets for tracking, Slack for notifications, and the company’s identity management API were included to automate the end-to-end workflow.
• High-Level Architecture: We designed a scalable, modular workflow that automated triggers, data validation, approval routing, audit logging, and reporting aligned with NIS2 compliance themes like governance and supply chain security.

Through this approach, RestFlow not only proposed technology but framed the automation as a sustainable ongoing compliance solution, branded under our Automation-as-a-Service offering.

The Solution: Architecture & Workflow

The global architecture centers around an n8n workflow that orchestrates the entire access review automation:

• Trigger: A scheduled trigger fires periodically (monthly or quarterly) initiating access reviews for specific user groups or systems.
• Data Collection: API calls to the identity management system fetch current access rights and user information.
• Notifications & Approvals: Emails generated via Gmail nodes are sent automatically to system owners and approvers. Slack notifications keep operations teams informed.
• Reminders: Conditional logic routes automated reminder emails/alerts for pending approvals.
• Audit Trail & Logging: All review activities, statuses, timestamps, and approvals are logged into Google Sheets and a centralized database to maintain an immutable audit trail.
• Reporting: Periodic reports and dashboards are generated and distributed to compliance officers, ensuring visibility and governance compliance.

End-to-End Workflow Walkthrough

1. Scheduler Node in n8n kicks off the process based on defined intervals.
2. API Request Node queries current access state from the client’s identity access platform.
3. Data Transformation Node formats and filters data to extract users due for access review.
4. Email Node (Gmail) sends personalized review requests including links to approval forms.
5. Webhook Node collects approval responses, triggering next steps.
6. Slack Node posts updates and alerts to operations channels.
7. Google Sheets Node updates the audit log with each review status.
8. Conditional Nodes evaluate if reminders or escalations are needed.
9. Report Generation Node

This fully automated lifecycle removes manual chasing and consolidates visibility into a single orchestrated workflow.

Step-By-Step Node Breakdown 🚀

1. Scheduler Trigger Node

This node activates the workflow at defined intervals (e.g., first of every month). It ensures that access reviews run on schedule without manual input.

2. API Request: User Access Fetch

Using secured credentials stored in n8n’s environment variables, this node calls the client’s identity management API to retrieve up-to-date access rights. Key fields returned include user ID, roles, resource permissions, and last review date.

3. Data Transformation & Filtering

Utilizing n8n’s Function Node, the JSON response is filtered to select only those users whose access is overdue for review or newly granted, optimizing scope to avoid unnecessary reviews.

4. Gmail Email Node: Review Requests

Personalized emails are generated leveraging templates with dynamic placeholders (e.g., user name, system, deadline). Emails contain approval links pointing to webhook endpoints for collecting responses.

5. Webhook Node: Approval Collection

This node acts as an API endpoint where approvers submit their approvals or rejections via secure links or forms. The webhook securely receives the payload, validates the response, and triggers onward workflow steps.

6. Slack Notification Node 🛎

Operations and security teams receive real-time notifications about review statuses, approval delays, or exceptions, enabling quicker interventions.

7. Google Sheets Node: Audit Log Updates

Each approval or rejection is logged with timestamps and metadata in Google Sheets, serving as a persistent, audit-ready record accessible to compliance officers.

8. Conditional Logic: Reminders & Escalations 🔔

Conditional nodes check if approvals are pending past thresholds and trigger reminder emails or escalate issues to managers to ensure timely completion.

9. Report Generation & Distribution

Using data aggregation nodes, compliance reports summarizing the outcomes, outstanding risks, and compliance metrics are generated and emailed monthly to relevant stakeholders.

Error Handling, Robustness & Security

RestFlow implemented robust error handling mechanisms to address common failure points:

• Retries and Backoff: For failed API calls or email sends, exponential backoff retries help maintain resilience with alerts on persistent failures.
• Logging: Detailed logs with error codes are pushed to Slack alert channels and fallback Google Sheets for offline diagnostics.
• Idempotency: Unique identifiers on webhook payloads and processed requests prevent duplicate approvals or conflicting data.
• Access Control and Secrets Management: All API keys and tokens are stored securely with least-privilege access scopes. Sensitive PII data is encrypted or anonymized in logs to ensure GDPR compliance.

These controls contribute to both security and compliance posture strengthening.

Performance, Scaling & Extensibility

The architecture supports scaling with:

• Webhook Event-Driven Triggers: Minimizes inefficient polling. Allows near real-time processing when the approval forms are submitted.
• Batch Processing: Large user groups are processed in batches to avoid overloading APIs or email systems.
• Modular Workflows: Easily extended to include new regions, teams, or integrate with new identity providers.
• Managed Hosting: RestFlow’s Automation-as-a-Service includes monitoring and autoscaling capabilities to maintain stable large-scale operations.

This flexibility makes future regulatory updates or additional compliance themes achievable without reengineering.

Key Comparisons for This Use Case

Platform	Cost	Pros	Cons
n8n	Free to self-host; Paid managed plans	Open-source; Flexible workflow design; Strong API integrations	Requires hosting/maintenance if self-hosted
Make (Integromat)	Subscription-based, tiered by operations	Visual editor; Good prebuilt app connectors	Less flexible with complex logic vs n8n
Zapier	Subscription-based, priced per tasks	Ease of use; Extensive app ecosystem	Limited custom code flexibility; Higher costs at scale

Integration Method	Pros	Cons
Webhook-based Trigger	Near real-time; Efficient resource usage	Requires external systems to support webhooks
Polling Trigger	Works with systems lacking webhook support	Higher latency; Increased API calls & cost

Data Storage Option	Cost	Pros	Cons
Google Sheets	Free up to quota limits	Easy to use and visualize; Low setup effort	Limited scalability; Not suitable for large datasets or complex queries
Relational Database	Variable (depends on hosting)	High scalability and querying capability; Better audit control	Higher setup complexity; Requires maintenance

Results & Business Impact

Following deployment, the client experienced significant improvements:

• Time savings: Over 35 hours saved monthly by automating notifications, tracking, and audit reporting (~87% reduction in manual compliance work).
• Error rate: Incomplete or missed access reviews dropped from 12% to under 1% due to automated reminders and conditional approvals.
• Compliance readiness: Audit trails became instantly available in Google Sheets with timestamps and approver metadata, accelerating compliance reporting cycles.
• Process visibility: Slack notifications and dashboards enhanced real-time transparency for the compliance and operations teams.

Operationally, the teams moved from firefighting overdue reviews to proactively managing risks with calm and scalable processes aligned with NIS2 themes like governance and cyber risk management.[Source: to be added]

Interested in replicating these results? Explore the Automation Template Marketplace for similar workflows designed to jumpstart your compliance automation.

Pilot Phase & Maintenance Disclaimer

As with any automation project, a pilot phase was conducted. During this time, the workflow was tested in controlled environments with real but limited data sets to identify edge cases, fix minor bugs, and fine-tune timing and data mapping.

Post pilot, RestFlow delivers comprehensive Automation-as-a-Service, covering hosting, continuous monitoring, automatic alerts, version upgrades, and compliance audits to ensure that the workflow remains robust and aligned with evolving requirements.

This ongoing partnership guarantees sustainable compliance automation that adapts over time while minimizing internal resource burdens.

Frequently Asked Questions on Access Review Automation Under NIS2

Conclusion

RestFlow’s automation of access review under the NIS2 Directive for the Warsaw-based security company demonstrates the powerful impact of turning manual compliance into a seamless, auditable, and scalable workflow.

By leveraging tools like n8n, Gmail, Google Sheets, and Slack, paired with secure APIs and vigilant monitoring, RestFlow transformed a labor-intensive challenge into a calm, controllable process that supports cyber risk management, incident reporting, supply chain security, and governance.

As a compliance-first automation partner, RestFlow provides complete Automation-as-a-Service: from initial design and implementation to hosting, monitoring, and ongoing maintenance. This ensures clients remain audit-ready and compliant amid evolving regulations.

If you’re ready to revolutionize compliance, we invite you to Explore the Automation Template Marketplace or Create Your Free RestFlow Account and start your efficient automation journey today.