Skip to main content
qorionix
ZQ-250specialist
  • Compliance and audit

Qorionix Certified Evidence and Audit Analyst

A specialist credential, parallel to the Administrator rather than above it. For compliance officers, DPOs, virtual CISOs and the auditors on the other side of the table.

What this certifies

Written so it could be disproved by watching the holder work. If you cannot imagine the task you would set to test a line of this, it does not belong here.

Can produce a NIS2 Article 21 evidence bundle from a tenant and draft the 24-hour early warning from an incident record. Can run an audit-trail verification and correctly distinguish a linkage result from a content result, stating what each one implies about what happened and what to do next. Can map a set of posture findings onto DORA and ISO 27001 control references and defend the mapping. Can answer a GDPR data-subject access request from the platform. Can explain to an auditor why a skipped check is not a passed check, and show which of their checks are skipped and why.

What it does not certify

A credential that appears to certify more than it tested is worse than no credential, because a buyer relies on it. This list is never empty on any credential in the programme.

  • Does not certify legal or regulatory competence. It certifies competence with one platform's evidence surface. Whether a given measure satisfies a given member state's NIS2 transposition is a lawyer's question and this credential does not answer it.
  • Does not assert that the organisation is compliant, or that the software makes it compliant. Software produces artefacts; an organisation demonstrates compliance.
  • Does not certify configuration. An analyst who has this and not the Administrator credential should not be changing sign-on policies.
  • Does not cover financial-sector DORA obligations beyond the ICT risk-management and incident-reporting mapping the platform produces.

The job tasks it maps to

Phrased as the person holding the job would phrase it, with where in the product it happens — so the mapping is checkable rather than aspirational.

“Produce, for an auditor, evidence of the Article 21 measures we have in place”
The evidence bundle, hash-stamped, and the framework mapping behind it
“Draft the 24-hour early warning after an incident, from the incident record rather than from memory”
The incident record and the NIS2 reporting workflow
“Demonstrate that the audit trail has not been edited — not assert it, demonstrate it”
Chain verification, and the linkage-versus-content distinction
“Answer a subject access request inside the statutory window”
The GDPR data-subject request and export path
“Tell the board what we can and cannot detect, so the risk register is honest”
ATT&CK coverage, shadow rules, skipped checks, and the published hard limits
“Produce access certification records for a review cycle”
Access certification and role mining proposals

Getting here

Prerequisites

Full sequence: ZQ-100 → ZQ-250

Recommended experience

Experience responding to an audit, a customer security questionnaire or a regulator — from either side of it. No configuration experience assumed; where the course needs a setting changed, it says who to ask.

Recertification

Valid for 12 months

A free renewal assessment, annually, with a regulatory-delta section. NIS2 is a directive transposed differently in each member state and the transpositions are still moving; a two-year-old compliance credential is a liability rather than a signal.

Price

€150 for the exam; the course free

Same split as the Administrator credential. Purchased in the console.

How you would prepare, and how you would be assessed

What the labs assume

  • A Qorionix tenant with at least thirty days of history. An evidence bundle from a tenant connected yesterday is technically valid and pedagogically useless.
  • Read access to the audit trail and to the compliance module. You do not need permission to change anything.
  • A copy of your own organisation's relevant obligation — your member state's NIS2 transposition, your DORA scope determination, or your ISO 27001 statement of applicability. The exercises compare the platform's output against your real obligation rather than a generic one.