ISO/IEC 27001 Annex A
Northwind Traders has 7 controls not in place.
Judged from Microsoft 365 data collected ; 21 controls need evidence Microsoft 365 can't show.
What changed
No data from 13 July 2026: the oldest data held is from 6 September 2026.
Gaps to close
16 controls-
14 users without MFA. For example breakglass@northwindtraders.example: No MFA method registered.
Fix: Ask these users to register the Microsoft Authenticator app. See the rows →
-
Users can consent to any app. Any user can grant any app access to their mail and files.
Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. See the rows →
-
Fail 6.7 Remote working
Enforced by Require MFA for all users, with 1 exclusion to review. For example breakglass@northwindtraders.example: Excluded from "Require MFA for all users".
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. See the rows →
-
4 of 36 computers not encrypted. For example DESK-WRIGHT18 (leo.wright@northwindtraders.example): Windows disk isn't encrypted.
Fix: Turn on BitLocker. See the rows →
-
3 files and folders shared with anyone. For example Campaign video.mp4 (Marketing / Documents): Anyone can edit.
Fix: Remove anyone links that are no longer needed, and set the rest to view-only with an expiry date. See the rows →
-
Enforced by Require MFA for all users, with 1 exclusion to review. For example breakglass@northwindtraders.example: Excluded from "Require MFA for all users".
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. See the rows →
-
5 of 36 Windows computers past end of support. For example LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release. See the rows →
-
Partly 5.14 Information transfer
1 domain with SPF problems. For example parked.example: Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing.
Fix: Publish one SPF record per domain ending in -all. See the rows →
-
Partly 5.15 Access control
Anyone, including guests, can invite guests. Guests can invite other guests.
Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. See the rows →
-
Partly 5.16 Identity management
4 accounts inactive for 90+ days or never used. For example hannah.robinson@northwindtraders.example: Licensed member, last signed in 7 Apr 2026.
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used. See the rows →
-
4 accounts inactive for 90+ days or never used. For example hannah.robinson@northwindtraders.example: Licensed member, last signed in 7 Apr 2026.
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used. See the rows →
-
Partly 8.1 User endpoint devices
1 of 37 joined computers not in Intune. For example DESK-RECEPTION: Hybrid joined, not managed by Intune.
Fix: Enrol Entra-joined and hybrid-joined computers in Intune. See the rows →
-
Partly 8.2 Privileged access rights
1 guest with admin roles. For example g#EXT#@northwindtraders.example: Guest holding Exchange Administrator.
Fix: Remove admin roles from guest accounts. See the rows →
-
Partly 8.9 Configuration management
Any user can register an app. Users can register apps that nobody reviews.
Fix: Set "Users can register applications" to No. See the rows →
-
Partly 8.12 Data leakage prevention
4 external forwards. For example ann.patel@northwindtraders.example: Mailbox forwarding to ann.patel@homemail.example (keeps a copy).
Fix: Remove forwarding to outside addresses unless the client has a documented business reason. See the rows →
-
Partly 8.24 Use of cryptography
Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 4 of 36 computers not encrypted.
Organisational controls (5)
FailPolicies, roles, assets, access rules, suppliers and cloud services, incidents and continuity.
A security policy and topic-specific policies are defined, approved by management, published, acknowledged by staff and reviewed.
Information security policies covering [acceptable use, access control, passwords, data protection and incident response] are approved by [role], reviewed every [12 months] and acknowledged by staff.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Responsibilities for information security are defined and given to named people.
[Name], [role], has overall responsibility for information security and data protection and reports to [the board or partners], where security is a standing agenda item. Day-to-day IT security is managed by [IT provider].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Information and the assets that hold it are listed, with an owner for each.
- But: 1 of 39 device records unused for 90+ days.
- But: 1 of 37 joined computers not in Intune.
- Computers managed by Intune
- 36
- Of which encrypted
- 32
- Windows computers out of support
- 5
- Reaching end of support within 90 days
- 20
- Not compliant
- 6
An asset register in [tool or spreadsheet] lists [hardware, software, cloud services and the information held], each with a named owner, a category and where it is. Devices are added when they're set up and removed when they're disposed of, and the register was last reviewed on [date].
What Microsoft 365 can't show: Microsoft 365 lists the devices Intune and Entra ID know; the inventory covers everything else.
Write this answer for Northwind Traders
Rules protect information sent by email and other means: domains can't be spoofed and mail travels encrypted.
- But: 1 of 1 mail domain doesn't fully enforce MTA-STS.
- 1 domain with SPF problems.
- parked.example: Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing
- 1 mail domain without DKIM.
- northwindtraders.example: Microsoft 365 DKIM isn't set up (selector2 CNAME missing)
- 2 domains without DMARC enforcement.
- northwindtraders.example: DMARC is monitor-only (p=none); spoofed mail is still delivered
- parked.example: Doesn't receive mail but has no DMARC p=reject record
Fix: Publish one SPF record per domain ending in -all (or ~all while testing), e.g. "v=spf1 include:spf.protection.outlook.com -all". Domains that never send mail should publish "v=spf1 -all". See the rows →
SPF, DKIM and DMARC are not fully configured for the organisation's email domains. 1 domain with SPF problems. 1 mail domain without DKIM. 2 domains without DMARC enforcement.
What Microsoft 365 can't show: Judged from public DNS and Exchange Online for the tenant's domains.
Change this answer
Rules for who can reach which information are set by business need, including what guests can see.
- Guests have limited access to directory objects (the default).
- Anyone, including guests, can invite guests.
- Guests can invite other guests
- Anyone, including anonymous links.
- SharePoint and OneDrive: Anyone links are allowed
Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. See the rows →
Access to files and systems is given through role-based groups, approved by [role], and changed when people move roles. [Access is reviewed every 12 months.]
What Microsoft 365 can't show: Judged from Entra ID guest settings and SharePoint sharing. Describe how staff access is decided.
Write this answer for Northwind Traders
Every identity belongs to one person and is removed when it's no longer needed; shared accounts can't sign in.
- All 3 shared mailboxes block sign-in.
- 4 accounts inactive for 90+ days or never used.
- hannah.robinson@northwindtraders.example: Licensed member, last signed in 7 Apr 2026
- sophie.smith@northwindtraders.example: Licensed member, last signed in 21 Jan 2026
- thomas.clarke@northwindtraders.example: Licensed member, last signed in 2 Jun 2026
- g#EXT#@northwindtraders.example: Guest, never signed in, created ?
- 1 disabled account still licensed.
- robert.hughes@northwindtraders.example: Disabled, holding 1 licence
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used (after checking with the client), then remove their licences. Inactive accounts are a common foothold for attackers. See the rows →
Some inactive accounts in Microsoft Entra ID have not been disabled. 4 accounts inactive for 90+ days or never used. 1 disabled account still licensed.
What Microsoft 365 can't show: Judged from Entra ID accounts, sign-in activity and shared mailboxes.
Change this answer
Passwords and other sign-in secrets are protected: everyone has a second factor, and weak ones are avoided.
- 14 users without MFA.
- breakglass@northwindtraders.example: No MFA method registered
- alfie.roberts@northwindtraders.example: No MFA method registered
- alfie.scott@northwindtraders.example: No MFA method registered
- carl.jensen@northwindtraders.example: No MFA method registered
- grace.wilson@northwindtraders.example: No MFA method registered
- and 9 more
- 3 people can only use a text or call as a second factor.
- arthur.evans@northwindtraders.example: Second factor is only Mobile phone (SMS or call)
- mia.hughes@northwindtraders.example: Second factor is only Mobile phone (SMS or call)
- zara.jackson@northwindtraders.example: Second factor is only Mobile phone (SMS or call)
Fix: Ask these users to register the Microsoft Authenticator app. Until they do, anyone with their password can register MFA in their place. See the rows →
Microsoft Entra ID requires passwords of at least 8 characters, blocks commonly used and known compromised passwords (Microsoft's global banned password list) and locks out repeated failed sign-in attempts (smart lockout). These are Microsoft defaults for cloud accounts. Multi-factor authentication is enforced as well (see the MFA answer), so a guessed password alone can't be used to sign in.
What Microsoft 365 can't show: Judged from Entra ID authentication methods. Add other systems that use passwords.
Change this answer
Access rights are given, reviewed and removed through a defined process, including guests.
- No stale guest invitations.
- But: 4 teams and groups without an owner.
- Supporting: Unused teams and groups expire after 365 days.
Administrator access is reviewed [quarterly] by [role] against the list of current administrators, and anyone who no longer needs it has it removed.
What Microsoft 365 can't show: Microsoft 365 shows guests and group owners; describe the review and when it last happened.
Write this answer for Northwind Traders
Security risks from suppliers are managed, with requirements agreed before they get access.
Suppliers and contractors that handle the organisation's data are checked before they're used, must meet [Cyber Essentials or equivalent security requirements], and are reviewed [every 12 months]. They're listed in [supplier register].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Contracts with suppliers set out their security and data protection obligations.
Every supplier that processes personal data for the organisation has a written contract with the terms UK GDPR Article 28 requires: acting only on instructions, confidentiality, security, approval of sub-processors, help with people's rights, and deleting or returning the data at the end. They're recorded in [register].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Cloud services are taken on, used and left under the organisation's control: people can't connect apps to company data on their own, and app access is known.
- Supporting: Users can consent to most apps themselves, so admin consent requests are off (see the user consent check).
- Users can consent to any app.
- Any user can grant any app access to their mail and files
- 1 app with access to mail, files or the directory.
- Mail Sync Pro: Mail.Read (application permission; unverified publisher)
- 1 app registration with expiring or expired credentials.
- Old connector: The 1 credential expired, last on 1 Jan 2025
Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. See the rows →
Third-party application access to Microsoft 365 data is not controlled. Users can consent to any app. 1 app with access to mail, files or the directory.
What Microsoft 365 can't show: Judged from Entra ID consent settings, app permissions and app credentials.
Change this answer
Roles and procedures for handling security incidents are planned and documented.
A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Incidents are responded to by the documented procedure, such as containing a compromised account.
If an account may be compromised, [IT provider] resets the password, signs the account out of every session, checks its MFA methods and inbox rules, and reviews its sign-ins. Staff report concerns to [contact].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Security is kept up during disruption, with continuity plans that are tested.
A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Legal requirements for personal data (UK GDPR in the UK) are identified and met.
A record of processing activities lists each kind of personal data held, its purpose and lawful basis, who it's shared with, where it's stored and how long it's kept. [Role] maintains it, and it was last reviewed on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
People controls (6)
FailScreening, awareness and training, leavers, and remote working.
People are checked before they join, in proportion to the information they'll reach.
New staff go through [right-to-work, reference and DBS] checks before they get access, and sign [confidentiality agreements].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Staff get security awareness training and regular updates relevant to their job.
All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Access ends when people leave or change role, and duties that continue are communicated.
- 4 accounts inactive for 90+ days or never used.
- hannah.robinson@northwindtraders.example: Licensed member, last signed in 7 Apr 2026
- sophie.smith@northwindtraders.example: Licensed member, last signed in 21 Jan 2026
- thomas.clarke@northwindtraders.example: Licensed member, last signed in 2 Jun 2026
- g#EXT#@northwindtraders.example: Guest, never signed in, created ?
- 1 disabled account still licensed.
- robert.hughes@northwindtraders.example: Disabled, holding 1 licence
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used (after checking with the client), then remove their licences. Inactive accounts are a common foothold for attackers. See the rows →
Some inactive accounts in Microsoft Entra ID have not been disabled. 4 accounts inactive for 90+ days or never used. 1 disabled account still licensed.
What Microsoft 365 can't show: Judged from sign-in activity in Entra ID. Describe the leavers process.
Change this answer
People working away from the office reach company data securely.
- Enforced by Require MFA for all users, with 1 exclusion to review.
- breakglass@northwindtraders.example: Excluded from "Require MFA for all users"
- Legacy authentication is allowed.
- No enabled policy blocks legacy authentication for all users
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. See the rows →
Home and remote workers connect over [home broadband or business-provided routers] to Microsoft 365, with multi-factor authentication. [Office systems are reached through (VPN product).]
What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins. Add VPNs and remote desktop.
Write this answer for Northwind Traders
Staff know how to report suspected security events quickly.
Every personal data breach is recorded in a breach log with what happened, its effects and what was done. [Role] decides whether it must be reported; reportable breaches go to the ICO within 72 hours of the organisation becoming aware, and to the people affected when the risk to them is high. Lessons learned are reviewed by [role].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Physical controls (7)
FailPremises, equipment away from the office, storage media and disposal.
Offices and secure areas have perimeters, entry controls and monitoring.
Offices are protected by [locked doors, access control and alarms]. [Servers and network equipment are kept in a locked room or cabinet.]
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Laptops and other equipment used away from the office are protected, including by encryption.
- 4 of 36 computers not encrypted.
- DESK-WRIGHT18 (leo.wright@northwindtraders.example): Windows disk isn't encrypted
- LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows disk isn't encrypted
- LAPTOP-SCOTT29 (olivia.scott@northwindtraders.example): Windows disk isn't encrypted
- LAPTOP-SMITH07 (olivia.smith@northwindtraders.example): Windows disk isn't encrypted
Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. See the rows →
Company computers managed in Microsoft Intune are not all encrypted. 4 of 36 computers not encrypted.
What Microsoft 365 can't show: Judged from Intune for company computers.
Change this answer
Removable storage is controlled from first use to disposal.
Removable media is [blocked by Intune policy or allowed only on encrypted, company-issued drives], and drives that hold the organisation's data are recorded in the asset register.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Data is securely removed before equipment is reused or disposed of.
Before devices and storage are reused or disposed of, data is securely wiped [with an Intune wipe or a certified erasure tool] or the storage is destroyed by [certified disposal company], and the certificate is kept.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Technological controls (8)
FailEndpoints, privileged access, authentication, malware, vulnerabilities, configuration, leakage, backup, logging, monitoring, networks, web filtering, cryptography and change.
Laptops, desktops and phones that reach company data are managed and meet policy.
- Computers managed by Intune
- 36
- Of which encrypted
- 32
- Windows computers out of support
- 5
- Reaching end of support within 90 days
- 20
- Not compliant
- 6
- 1 of 37 joined computers not in Intune.
- DESK-RECEPTION: Hybrid joined, not managed by Intune
- 6 of 37 managed devices not compliant.
- DESK-ROBINSON12 (george.robinson@northwindtraders.example): Not compliant
- DESK-WRIGHT18 (leo.wright@northwindtraders.example): Not compliant
- LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Not compliant
- LAPTOP-SCOTT25 (alfie.scott@northwindtraders.example): Not compliant
- LAPTOP-SCOTT29 (olivia.scott@northwindtraders.example): Not compliant
- and 1 more
- 3 devices haven't checked in for 30+ days.
- DESK-ROBINSON12 (george.robinson@northwindtraders.example): Last check-in 38 days ago
- LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Last check-in 45 days ago
- LAPTOP-SCOTT25 (alfie.scott@northwindtraders.example): Last check-in 38 days ago
Fix: Enrol Entra-joined and hybrid-joined computers in Intune (automatic enrolment under Devices > Enrollment > Windows) so compliance, encryption and updates can be enforced on them. See the rows →
Company devices are not all managed centrally. 1 of 37 joined computers not in Intune. 6 of 37 managed devices not compliant.
What Microsoft 365 can't show: Judged from Intune and Entra ID.
Change this answer
Administrator rights are few, given to named internal people, and separate from everyday accounts.
- 2 Global Administrators.
- Cloud-only tenant: no accounts are synced from on-premises AD.
- But: 1 admin without MFA, and 1 whose registration isn't known.
- Accounts holding privileged roles
- 4
- Admins with no MFA policy
- 1
- Admins with no MFA method registered
- 2
- 1 guest with admin roles.
- g#EXT#@northwindtraders.example: Guest holding Exchange Administrator
- 1 app with privileged roles.
- Some app: App holding Exchange Administrator
Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. See the rows →
Administrator role assignments in Microsoft 365 are tracked, with gaps. 4 accounts hold privileged admin roles, 2 of them Global Administrator (ann.patel@northwindtraders.example, breakglass@northwindtraders.example). 2 Global Administrators. 1 guest with admin roles. 1 app with privileged roles.
What Microsoft 365 can't show: Judged from Microsoft 365 and Entra ID admin roles. Add administrators of other systems.
Change this answer
Access to files is restricted as the access rules say: nothing open to anyone with the link.
- 3 files and folders shared with anyone.
- Campaign video.mp4 (Marketing / Documents): Anyone can edit
- Brand assets (Marketing / Documents): Anyone can view, link never expires
- holiday.jpg (OneDrive of ann.patel@northwindtraders.example): Anyone can view
- Anyone, including anonymous links.
- SharePoint and OneDrive: Anyone links are allowed
Fix: Remove anyone links that are no longer needed, and set the rest to view-only with an expiry date. The Shared files report lists each one. See the rows →
Sharing with anonymous and external users is not restricted in SharePoint and OneDrive. Anyone, including anonymous links. 3 files and folders shared with anyone. Anyone, including guests, can invite guests.
What Microsoft 365 can't show: Judged from SharePoint and OneDrive sharing settings and links.
Change this answer
Sign-in is protected by multi-factor authentication, for administrators especially, and protocols that can't use it are blocked.
- But: 2 admins without a phishing-resistant method.
- Users with an MFA method registered
- 62.2% of 37
- Accounts covered by an enforced MFA policy
- 36 of 36
- Enforced by Require MFA for all users, with 1 exclusion to review.
- breakglass@northwindtraders.example: Excluded from "Require MFA for all users"
- 1 admin not covered by MFA.
- breakglass@northwindtraders.example: Global Administrator: excluded from Require MFA for all users
- Legacy authentication is allowed.
- No enabled policy blocks legacy authentication for all users
- SMTP AUTH is on for the organisation.
- SMTP AUTH is allowed
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. See the rows →
Multi-factor authentication (MFA) is enforced for Microsoft 365 email (including Outlook on the web and mobile) and cloud applications, through Microsoft Entra ID. Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@northwindtraders.example (break-glass).
What Microsoft 365 can't show: Judged from Conditional Access, Security Defaults and Exchange Online for Microsoft 365.
Change this answer
Malware protection runs on every device, and mail is filtered for malicious content.
- But: 6 of 37 managed devices not compliant.
All desktops and laptops run [anti-malware product, for example Microsoft Defender Antivirus], which updates automatically, scans files when they're opened and blocks malicious websites. Tablets and phones only install apps from the official app stores.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Vulnerabilities are found and fixed in time, and systems that no longer get updates are replaced.
- Computers managed by Intune
- 36
- Of which encrypted
- 32
- Windows computers out of support
- 5
- Reaching end of support within 90 days
- 20
- Not compliant
- 6
- 5 of 36 Windows computers past end of support.
- LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-MARTIN22 (maya.martin@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-PATEL13 (hannah.patel@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-ROBERTS31 (george.roberts@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-TAYLOR04 (grace.taylor@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- and 20 more
Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. See the rows →
Managed Windows computers run versions of Windows that no longer receive security updates. 5 of 36 Windows computers past end of support.
What Microsoft 365 can't show: Judged from the Windows versions Intune reports. Add servers and network devices.
Change this answer
Secure settings are defined and kept: ordinary users can't create tenants, register apps or join by verifying an email address.
- Not checked: users can't create new tenants (Microsoft didn't return this setting).
- Not checked: people can't join the tenant just by verifying an email address (Microsoft didn't return this setting).
- Only admins and members of Group creators can create teams and groups.
- Any user can register an app.
- Users can register apps that nobody reviews
Fix: Set "Users can register applications" to No (Entra admin center > Users > User settings) and give the Application Developer role to the people who need it. See the rows →
Changes to systems, applications and networks are logged in [ticket system], checked for their security effect, tested where possible and approved by [role] before they're made. Emergency changes are reviewed afterwards.
What Microsoft 365 can't show: Judged from Entra ID tenant settings. Describe how settings are recorded and changed.
Write this answer for Northwind Traders
Information is deleted when it's no longer needed.
A retention schedule sets how long each kind of data is kept. Data past its retention period is deleted [by Microsoft 365 retention policies or at a review every (period)], and the data held is reviewed [every 12 months] to check it's still needed.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Mail can't be forwarded outside unnoticed, and inbox rules that hide or forward mail are caught.
- The default outbound policy blocks automatic external forwarding.
- 4 external forwards.
- ann.patel@northwindtraders.example: Mailbox forwarding to ann.patel@homemail.example (keeps a copy)
- ann.patel@northwindtraders.example: Inbox rule "Copy to home" forwards to ann.patel.home@homemail.example
- grace.taylor@northwindtraders.example: Mailbox forwarding to grace.taylor@homemail.example (doesn't keep a copy)
- olivia.smith@northwindtraders.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example
- 1 suspicious inbox rule.
- ann.patel@northwindtraders.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank
Fix: Remove forwarding to outside addresses unless the client has a documented business reason. Forwarding is the most common way attackers keep reading a mailbox after a password reset. See the rows →
Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 4 external forwards found.
What Microsoft 365 can't show: Judged from the Exchange Online outbound spam policy, mailbox forwarding and inbox rules.
Change this answer
Backups are taken and restores tested, as the backup policy says.
Microsoft 365 data (Exchange Online mail, OneDrive, SharePoint and Teams) is backed up [daily] by [backup product or provider] to storage separate from Microsoft 365. Backups are kept for [retention period], are [immutable or offline], and use credentials separate from the Microsoft 365 administrator accounts. Restores were last tested on [date].
What Microsoft 365 can't show: Microsoft 365 doesn't back itself up for this purpose; describe the backup of Microsoft 365 too.
Write this answer for Northwind Traders
Logs of activity and security events are produced, kept and protected.
- Mailbox auditing is on for the organisation.
Mailbox audit logging is enabled in Exchange Online, recording access to and actions on mailboxes. Mailbox auditing is on for the organisation.
What Microsoft 365 can't show: Judged from Exchange Online mailbox auditing and the unified audit log.
Change this answer
Networks, systems and sign-ins are watched for unusual behaviour, and it's acted on.
- Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2).
- Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2).
- But: 1 domain had sign-in settings changed in the last 30 days.
Risky users need Entra ID P2.
Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day].
What Microsoft 365 can't show: Judged from Entra ID Protection (needs Entra ID P2 for the full detections).
Write this answer for Northwind Traders
Networks are protected by firewalls and managed.
A [make and model] firewall protects the internet connection at [site]. Home and remote workers are protected by the software firewall on their company devices.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Access to malicious websites is blocked.
Malicious websites are blocked by [Microsoft Defender SmartScreen and network protection, a filtering DNS service such as Quad9, or the firewall's web filter].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Encryption protects data at rest and in transit, by an agreed approach.
- But: 4 of 36 computers not encrypted.
- But: 1 of 1 mail domain doesn't fully enforce MTA-STS.
- Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 4 of 36 computers not encrypted.
Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 4 of 36 computers not encrypted.
What Microsoft 365 can't show: Microsoft encrypts Microsoft 365 data itself; laptops are judged from Intune.
Change this answer
Changes to systems are planned, tested and approved.
Changes to systems, applications and networks are logged in [ticket system], checked for their security effect, tested where possible and approved by [role] before they're made. Emergency changes are reviewed afterwards.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
What the assessor checks
The on-site tests, what each needs, and what Microsoft 365 already shows for it.
The auditor samples Annex A controls from the Statement of Applicability and asks for evidence that each works in practice: records, settings and interviews.
Microsoft 365 shows: Microsoft 365 can show the technical evidence the day it's asked for: authentication, privileged access, endpoints, logging and leakage controls on this page, with the rows behind them, and what changed since the last audit.
About this pack
Use the controls marked Pass as evidence in the Statement of Applicability, with this pack's date. A Partly is a likely minor nonconformity; a Fail is a likely major one.
Scope: the ISMS scope may be wider than Microsoft 365. A Pass here covers Microsoft 365; say what covers the rest.
Requirements: ISO/IEC 27001:2022 with Amendment 1:2024, Annex A. Control numbers are ISO's; titles and requirements are paraphrased. This pack is part of the Statement of Applicability, not all of it: the other Annex A controls and the management system clauses 4 to 10 are the organisation's own. Source
Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; accepted risks count as documented exceptions. Oldest data used: .