Compliance Overview
Last scan: Today at 2:04 AM · 190 controls evaluated
74%
Compliance Rate
↑ 4.2% this week
141
Passing
↑ 8 since last scan
31
Failing
↓ 5 fixed
12
Manual Review
6
Risk Accepted
30-Day Compliance Trend
Compliance by Framework
CIS M365 Foundations
74%
CISA SCuBA
68%
NIST 800-53
71%
DISA STIGs
52%
ISO 27001
78%
By Application
Entra ID
52 Pass
12 Fail
8 Manual
6 Override
Exchange Online
34 Pass
6 Fail
4 Manual
Defender for Office
28 Pass
4 Fail
3 Manual
SharePoint Online
22 Pass
5 Fail
3 Manual
Microsoft Teams
14 Pass
3 Fail
2 Manual
Purview
11 Pass
5 Fail
2 Manual
Controls
5,000+ controls · 19 frameworks · showing 30 results
All Domains
Identity
Email Security
Data Protection
Endpoint
Network
Audit & Logging
30 controls
Documentation
Living configuration documentation · auto-updated by AI Compliance Analyst
4 documents
Entra ID Tenant Configuration
AI-generated
Updated today · v3
MFA & Authentication
MFA is enforced for all users via Conditional Access policy "Require MFA — All Users" (State: Enabled). Legacy authentication protocols are blocked tenant-wide via CA policy "Block Legacy Auth". SSPR is enabled for all users with mobile app authenticator as primary method.
Conditional Access Policies
14 active CA policies. 2 gaps identified: Privileged admin accounts lack dedicated high-frequency MFA policy. Guest accounts not included in device compliance requirement. Recommended: Create separate CA policy for Global Admins requiring phishing-resistant MFA (FIDO2 or Windows Hello).
Infrastructure Dependencies
Tenant: contoso.onmicrosoft.com · Region: East US · Azure AD Premium P2 licensed · PIM active for 6 privileged roles · Entitlement Management: enabled
Exchange Online Security Settings
Updated Apr 18 · v5
SharePoint External Sharing Configuration
Action needed
Updated Apr 15 · v2
Defender for Office 365 — Preset Policies
Updated Apr 12 · v1
Policy Library
4 policies · generate audit-ready documents from templates in minutes
📋
Information Security Policy
Publishedv2.1 · Updated Mar 15
Frameworks: CIS, NIST 800-53, ISO 27001
Owner: Sarah Chen (CISO)
Frameworks: CIS, NIST 800-53, ISO 27001
Owner: Sarah Chen (CISO)
🚨
Incident Response Policy
Publishedv3.0 · Updated Apr 1
Frameworks: NIST CSF, HIPAA, SOC 2
Owner: Marcus Rivera (IR Lead)
Frameworks: NIST CSF, HIPAA, SOC 2
Owner: Marcus Rivera (IR Lead)
🔐
Access Control Policy
Draftv1.0 · Updated Apr 10
Frameworks: CIS, NIST AC-2, ISO A.9
Owner: James Kim (IAM Lead)
Frameworks: CIS, NIST AC-2, ISO A.9
Owner: James Kim (IAM Lead)
🛡️
Data Protection & Privacy Policy
Publishedv1.3 · Updated Feb 28
Frameworks: HIPAA, NIST SP-28, GDPR
Owner: Lisa Park (DPO)
Frameworks: HIPAA, NIST SP-28, GDPR
Owner: Lisa Park (DPO)
🔄
Vulnerability Management Policy
Publishedv1.1 · Updated Jan 20
Frameworks: CIS, NIST SI-2, PCI DSS 6.3
Owner: Tom Walsh (SecOps)
Frameworks: CIS, NIST SI-2, PCI DSS 6.3
Owner: Tom Walsh (SecOps)
🌐
Acceptable Use Policy
Draftv0.9 · Updated Apr 14
Frameworks: CIS, ISO A.8, NIST AC-17
Owner: Rachel Nguyen (HR Security)
Frameworks: CIS, ISO A.8, NIST AC-17
Owner: Rachel Nguyen (HR Security)
Playbooks
Incident response procedures · step-by-step with role assignments
Active Playbooks
🎣
Phishing Response
Triage, contain, and remediate a phishing attack targeting M365 accounts. Includes user notification, session revocation, and email quarantine steps.
8 steps
Reviewed Apr 1, 2026
Active
💀
Ransomware Response
Isolation, investigation, and recovery procedures for ransomware incidents. Covers MDE device isolation, backup verification, and business continuity handoff.
12 steps
Reviewed Mar 15, 2026
Active
🔺
Privilege Escalation Response
Detect, investigate, and revoke unauthorized privilege escalation in Entra ID. Covers PIM alerts, role audit, Conditional Access lockdown, and evidence collection.
7 steps
Reviewed Apr 1, 2026
Active
📤
Data Exfiltration Response
Respond to suspected data exfiltration events. Covers DLP alert triage, Purview audit log review, account suspension, and regulatory notification timeline.
9 steps
Reviewed Feb 20, 2026
Review Needed
🔑
Credential Compromise Response
Handle compromised credentials in Entra ID. Includes forced password reset, MFA re-registration, Risky Users remediation, and sign-in log review.
6 steps
Reviewed Apr 10, 2026
Active
Compliance Roadmap
Q2 2026 · CIS M365 + CISA SCuBA · 4 phases
1
Phase Complete
1
In Progress
2
Upcoming
18
Open Items
58%
Overall Progress
✓
Phase 1 — Identity Hardening
Entra ID · Conditional Access · MFA Enforcement
Apr 1 – Apr 15
Complete
Complete
ENT-001ENT-002ENT-003ENT-024ENT-031ENT-040ENT-045
+11 more
2
Phase 2 — Email Security
Exchange Online · Defender for Office · Anti-Phishing
Apr 15 – May 5
In Progress
In Progress
EXO-001EXO-002EXO-005DEF-001DEF-002DEF-003DEF-008
+15 more
3
Phase 3 — Data Protection & SharePoint
SharePoint Online · Purview · DLP · Sensitivity Labels
May 5 – May 26
Upcoming
Upcoming
SPO-001SPO-005SPO-012PUR-001PUR-005PUR-010
+10 more
4
Phase 4 — Teams & Governance
Microsoft Teams · GRC Modules · Risk Register · Audit Prep
May 26 – Jun 20
Upcoming
Upcoming
SPT-001SPT-002SPT-005ENT-011EXO-008
+16 more