# ScopeNeat findings by requirement Made on 2026-11-09 with ScopeNeat. Frameworks shown: DORA, RTS 2024/1774, GDPR, ISO/IEC 27001. > A finding supports evidence for these requirements. On its own it does not make an organization compliant. ## DORA Art. 9(4)(c), 8 findings > "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof" Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554) **Supports evidence** - A read scope is enough to change data (critical). Concerns: deleteUser - The tool relies on a scope that grants everything (critical). Concerns: export\_monthly\_report - The tool relies on a scope that grants everything (critical). Concerns: cleanup\_stale\_records - A scope that grants everything (warning). Concerns: admin - A scope that grants everything (warning). Concerns: files:\* - The tool holds a scope none of its calls needs (warning). Concerns: lookup\_customer - Anyone may change data through this operation (warning). Concerns: purgeCache **Related** - No scope required (note). Concerns: health ## DORA Art. 9(4)(d), 1 finding > "implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes" Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554) **Supports evidence** - The API accepts tokens from the password flow (critical). Concerns: getMonthlyReport ## RTS 2024/1774 Art. 21(a), 13 findings > "the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access" Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1774) **Supports evidence** - A read scope is enough to change data (critical). Concerns: deleteUser - A read-only tool holds a scope that can change data (critical). Concerns: lookup\_customer - A read-only tool holds a scope that can change data (critical). Concerns: export\_monthly\_report - The tool relies on a scope that grants everything (critical). Concerns: export\_monthly\_report - The tool relies on a scope that grants everything (critical). Concerns: cleanup\_stale\_records - A scope that grants everything (warning). Concerns: admin - A scope that grants everything (warning). Concerns: files:\* - The tool holds a scope none of its calls needs (warning). Concerns: lookup\_customer - The server advertises a powerful scope by default (warning). Concerns: crm:write - The server advertises a powerful scope by default (warning). Concerns: payments:transfer **Related** - An action without a resource (warning). Concerns: refund:under\_500 - An action without a resource (warning). Concerns: api:write - Too many scopes for one tool (warning). Concerns: refund\_angry\_customer ## RTS 2024/1774 Art. 21(b), 1 finding > "the segregation of duties designed to prevent unjustified access to critical data or to prevent the allocation of combinations of access rights that may be used to circumvent controls" Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1774) **Supports evidence** - The tool can both start an action and approve it (warning). Concerns: process\_refund ## RTS 2024/1774 Art. 21(d), 3 findings > "a provision on restrictions of access to ICT assets, setting out controls and tools to prevent unauthorised access" Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1774) **Supports evidence** - Anyone may change data through this operation (warning). Concerns: purgeCache **Related** - No scope mapped to this tool (warning). Concerns: summarize\_ticket - No scope required (note). Concerns: health ## RTS 2024/1774 Art. 21(e)(iii), 6 findings > "withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary" Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1774) **Related** - Declared but used by nothing here (note). Concerns: read\_users - Declared but used by nothing here (note). Concerns: getUsers - Declared but used by nothing here (note). Concerns: User.Read - Declared but used by nothing here (note). Concerns: user.read - Declared but used by nothing here (note). Concerns: api:write - Declared but used by nothing here (note). Concerns: factures:créer ## RTS 2024/1774 Art. 21(f)(ii), 1 finding > "the use of strong authentication methods in accordance with leading practices and techniques for remote access to the financial entity’s network, for privileged access, for access to ICT assets supporting critical or important functions or ICT assets that are publicly accessible" Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1774) **Supports evidence** - The API accepts tokens from the password flow (critical). Concerns: getMonthlyReport ## GDPR Art. 25(2), 1 finding > "The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed." Applies as: legal requirement. Applies whenever personal data is processed, so only to scopes that reach personal data. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) **Supports evidence** - Reading sensitive data is not low risk (warning). Concerns: export\_monthly\_report ## ISO/IEC 27001 A.5.3, 1 finding Segregation of duties Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Supports evidence** - The tool can both start an action and approve it (warning). Concerns: process\_refund ## ISO/IEC 27001 A.5.9, 4 findings Inventory of information and other associated assets Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Related** - Several names for the same permission (warning). Concerns: read\_users, user:read, getUsers, User.Read, user.read - The tool uses a scope missing from the inventory (warning). Concerns: cleanup\_stale\_records - The tool calls an operation the API description doesn't list (warning). Concerns: summarize\_ticket - The scope has no real description (warning). Concerns: reports ## ISO/IEC 27001 A.5.15, 9 findings Access control Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Supports evidence** - The tool relies on a scope that grants everything (critical). Concerns: export\_monthly\_report - The tool relies on a scope that grants everything (critical). Concerns: cleanup\_stale\_records - A scope that grants everything (warning). Concerns: admin - A scope that grants everything (warning). Concerns: files:\* **Related** - An action without a resource (warning). Concerns: refund:under\_500 - An action without a resource (warning). Concerns: api:write - Requires a scope the API does not declare (warning). Concerns: createRefund - Requires a scope the API does not declare (warning). Concerns: approveRefund - No scope mapped to this tool (warning). Concerns: summarize\_ticket ## ISO/IEC 27001 A.5.18, 10 findings Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Related** - Several names for the same permission (warning). Concerns: read\_users, user:read, getUsers, User.Read, user.read - The tool uses a scope missing from the inventory (warning). Concerns: cleanup\_stale\_records - The scope has no real description (warning). Concerns: reports - No action in the name (note). Concerns: reports - Declared but used by nothing here (note). Concerns: read\_users - Declared but used by nothing here (note). Concerns: getUsers - Declared but used by nothing here (note). Concerns: User.Read - Declared but used by nothing here (note). Concerns: user.read - Declared but used by nothing here (note). Concerns: api:write - Declared but used by nothing here (note). Concerns: factures:créer ## ISO/IEC 27001 A.8.2, 6 findings Privileged access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Supports evidence** - A read-only tool holds a scope that can change data (critical). Concerns: lookup\_customer - A read-only tool holds a scope that can change data (critical). Concerns: export\_monthly\_report - The tool relies on a scope that grants everything (critical). Concerns: export\_monthly\_report - The tool relies on a scope that grants everything (critical). Concerns: cleanup\_stale\_records - A scope that grants everything (warning). Concerns: admin - A scope that grants everything (warning). Concerns: files:\* ## ISO/IEC 27001 A.8.3, 4 findings Information access restriction Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Supports evidence** - A read scope is enough to change data (critical). Concerns: deleteUser - Reading sensitive data is not low risk (warning). Concerns: export\_monthly\_report - Anyone may change data through this operation (warning). Concerns: purgeCache **Related** - No scope required (note). Concerns: health ## ISO/IEC 27001 A.8.5, 2 findings Secure authentication Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. (https://www.iso.org/standard/27001) **Supports evidence** - The API accepts tokens from the password flow (critical). Concerns: getMonthlyReport **Related** - The API accepts tokens from the implicit flow (warning). Concerns: getMonthlyReport