Northwind Traders
Northwind Traders has 4 controls not in place.
Judged from Microsoft 365 data collected ; 11 controls need evidence Microsoft 365 can't show.
What changed
Pick a point in time to see which controls passed then and not now, or the other way round: useful before a renewal, which comes round every 12 months.
Gaps to close
10 controls-
Enforced by Require MFA for all users, with 1 exclusion to review. For example breakglass@northwindtraders.example: Excluded from "Require MFA for all users".
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. See the rows →
-
Anyone, including anonymous links. For example SharePoint and OneDrive: Anyone links are allowed.
Fix: Change SharePoint external sharing to "New and existing guests". See the rows →
-
5 of 36 Windows computers past end of support. For example LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release. See the rows →
-
Users can consent to any app. Any user can grant any app access to their mail and files.
Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. See the rows →
-
Anyone, including guests, can invite guests. Guests can invite other guests.
Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. See the rows →
-
4 accounts inactive for 90+ days or never used. For example hannah.robinson@northwindtraders.example: Licensed member, last signed in 8 Apr 2026.
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used. See the rows →
-
4 external forwards. For example ann.patel@northwindtraders.example: Mailbox forwarding to ann.patel@homemail.example (keeps a copy).
Fix: Remove forwarding to outside addresses unless the client has a documented business reason. See the rows →
-
6 of 37 managed devices not compliant. For example DESK-ROBINSON12 (george.robinson@northwindtraders.example): Not compliant.
Fix: Open each non-compliant device in Intune. See the rows →
-
1 suspicious inbox rule. For example ann.patel@northwindtraders.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank.
Fix: Check each rule with the mailbox owner. See the rows →
-
Partly CC8.1 Change management
Any user can register an app. Users can register apps that nobody reviews.
Fix: Set "Users can register applications" to No. See the rows →
Control environment, risk and communication (CC1 to CC5)
Your evidenceOversight and accountability, competent and vetted people, policies, and risk assessment.
Management sets structures, reporting lines and responsibilities for security.
[Name], [role], has overall responsibility for information security and data protection and reports to [the board or partners], where security is a standing agenda item. Day-to-day IT security is managed by [IT provider].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
People are checked before they join and trained for their responsibilities.
New staff go through [right-to-work, reference and DBS] checks before they get access, and sign [confidentiality agreements].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Security responsibilities are communicated to staff, including through training.
All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Risks to the service's objectives are identified and analysed.
An information security risk assessment covering [scope] names an owner for each risk, the agreed treatment and an action plan. It was last reviewed on [date] by [name and role] and approved by [director or partner].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Control activities are set out in policies and put into practice through procedures.
Information security policies covering [acceptable use, access control, passwords, data protection and incident response] are approved by [role], reviewed every [12 months] and acknowledged by staff.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Logical and physical access (CC6)
FailAccess is authenticated and authorised, given and removed by process, data movement is restricted and devices are protected.
Access to systems and data is protected by authentication: multi-factor for everyone, legacy protocols blocked, and data encrypted.
- But: 2 admins without a phishing-resistant method.
- But: 4 of 36 computers not encrypted.
- Users with an MFA method registered
- 62.2% of 37
- Accounts covered by an enforced MFA policy
- 36 of 37
- Not covered
- breakglass@northwindtraders.example
- Enforced by Require MFA for all users, with 1 exclusion to review.
- breakglass@northwindtraders.example: Excluded from "Require MFA for all users"
- 1 admin not covered by MFA.
- breakglass@northwindtraders.example: Global Administrator: excluded from Require MFA for all users
- Legacy authentication is allowed.
- No enabled policy blocks legacy authentication for all users
- SMTP AUTH is on for the organisation.
- SMTP AUTH is allowed
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. See the rows →
Multi-factor authentication (MFA) is enforced for Microsoft 365 email (including Outlook on the web and mobile) and cloud applications, through Microsoft Entra ID. Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@northwindtraders.example (break-glass).
What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins. Add the service's own systems.
Change this answer
New users and guests are registered and authorised before they're given access; old invitations go.
- No stale guest invitations.
- Anyone, including guests, can invite guests.
- Guests can invite other guests
Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. See the rows →
New accounts are created only after a request from [manager or HR] is approved by [role], recorded in [ticket system].
What Microsoft 365 can't show: Microsoft 365 shows who can invite guests; describe how staff accounts are approved.
Write this answer for Northwind Traders
Access follows least privilege and is removed when people leave or change role; admin rights are few.
- 2 Global Administrators.
- Accounts holding privileged roles
- 4
- Admins with no MFA policy
- 1
- Admins with no MFA method registered
- 2
- 4 accounts inactive for 90+ days or never used.
- hannah.robinson@northwindtraders.example: Licensed member, last signed in 8 Apr 2026
- sophie.smith@northwindtraders.example: Licensed member, last signed in 22 Jan 2026
- thomas.clarke@northwindtraders.example: Licensed member, last signed in 3 Jun 2026
- g#EXT#@northwindtraders.example: Guest, never signed in, created ?
- 1 disabled account still licensed.
- robert.hughes@northwindtraders.example: Disabled, holding 1 licence
- 1 guest with admin roles.
- g#EXT#@northwindtraders.example: Guest holding Exchange Administrator
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used (after checking with the client), then remove their licences. Inactive accounts are a common foothold for attackers. See the rows →
Access to files and systems is given through role-based groups, approved by [role], and changed when people move roles. [Access is reviewed every 12 months.]
What Microsoft 365 can't show: Judged from Entra ID sign-in activity and admin roles.
Write this answer for Northwind Traders
Physical access to facilities and equipment is restricted to authorised people.
Offices are protected by [locked doors, access control and alarms]. [Servers and network equipment are kept in a locked room or cabinet.]
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Data is removed from equipment before it's disposed of.
Before devices and storage are reused or disposed of, data is securely wiped [with an Intune wipe or a certified erasure tool] or the storage is destroyed by [certified disposal company], and the certificate is kept.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Access from outside is restricted: firewalls at the boundary and no open sharing.
- Anyone, including anonymous links.
- SharePoint and OneDrive: Anyone links are allowed
- 3 files and folders shared with anyone.
- Campaign video.mp4 (Marketing / Documents): Anyone can edit
- Brand assets (Marketing / Documents): Anyone can view, link never expires
- holiday.jpg (OneDrive of ann.patel@northwindtraders.example): Anyone can view
Fix: Change SharePoint external sharing to "New and existing guests" so every external person signs in. If the client relies on Anyone links, set them to expire and to view-only. See the rows →
A [make and model] firewall protects the internet connection at [site]. Home and remote workers are protected by the software firewall on their company devices.
What Microsoft 365 can't show: Microsoft 365 shows its sharing; describe the network boundary.
Write this answer for Northwind Traders
Data moving outside is restricted and protected: no unnoticed forwarding, domains can't be spoofed.
- The default outbound policy blocks automatic external forwarding.
- But: 1 of 1 mail domain doesn't fully enforce MTA-STS.
- But: 1 domain with SPF problems.
- But: 1 mail domain without DKIM.
- 4 external forwards.
- ann.patel@northwindtraders.example: Mailbox forwarding to ann.patel@homemail.example (keeps a copy)
- ann.patel@northwindtraders.example: Inbox rule "Copy to home" forwards to ann.patel.home@homemail.example
- grace.taylor@northwindtraders.example: Mailbox forwarding to grace.taylor@homemail.example (doesn't keep a copy)
- olivia.smith@northwindtraders.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example
- 2 domains without DMARC enforcement.
- northwindtraders.example: DMARC is monitor-only (p=none); spoofed mail is still delivered
- parked.example: Doesn't receive mail but has no DMARC p=reject record
Fix: Remove forwarding to outside addresses unless the client has a documented business reason. Forwarding is the most common way attackers keep reading a mailbox after a password reset. See the rows →
Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 4 external forwards found.
What Microsoft 365 can't show: Judged from Exchange Online forwarding and public DNS.
Change this answer
Unauthorised or malicious software is prevented or detected on managed devices.
- Computers managed by Intune
- 36
- Of which encrypted
- 32
- Windows computers out of support
- 5
- Reaching end of support within 90 days
- 20
- Not compliant
- 6
- 6 of 37 managed devices not compliant.
- DESK-ROBINSON12 (george.robinson@northwindtraders.example): Not compliant
- DESK-WRIGHT18 (leo.wright@northwindtraders.example): Not compliant
- LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Not compliant
- LAPTOP-SCOTT25 (alfie.scott@northwindtraders.example): Not compliant
- LAPTOP-SCOTT29 (olivia.scott@northwindtraders.example): Not compliant
- and 1 more
- 1 of 37 joined computers not in Intune.
- DESK-RECEPTION: Hybrid joined, not managed by Intune
Fix: Open each non-compliant device in Intune (Devices > Monitor > Noncompliant devices) to see which setting fails, fix it or retire the device, and block non-compliant devices with a Conditional Access policy that requires a compliant device. See the rows →
All desktops and laptops run [anti-malware product, for example Microsoft Defender Antivirus], which updates automatically, scans files when they're opened and blocks malicious websites. Tablets and phones only install apps from the official app stores.
What Microsoft 365 can't show: Intune shows devices are managed and compliant; describe the anti-malware product.
Write this answer for Northwind Traders
System operations and change (CC7 and CC8)
FailVulnerabilities and anomalies are detected, events are evaluated, incidents responded to and recovered from, and changes are controlled.
Vulnerabilities and unexpected configuration changes are found, including systems out of support.
- 5 of 36 Windows computers past end of support.
- LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-MARTIN22 (maya.martin@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-PATEL13 (hannah.patel@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-ROBERTS31 (george.roberts@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-TAYLOR04 (grace.taylor@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- and 20 more
- 1 domain had sign-in settings changed in the last 30 days.
- northwindtraders.example: Set domain authentication by mallory.price@northwindtraders.example on 10 Oct 2026
Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. See the rows →
External vulnerability scans run [monthly] using [tool or provider]. [A penetration test was last carried out on (date) by (provider).]
What Microsoft 365 can't show: Judged from Intune and Entra ID domain settings. Describe vulnerability scanning.
Write this answer for Northwind Traders
Sign-ins, accounts and mailboxes are monitored for anomalies, and activity is logged.
- Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2).
- Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2).
- Mailbox auditing is on for the organisation.
- 1 suspicious inbox rule.
- ann.patel@northwindtraders.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank
Fix: Check each rule with the mailbox owner. Rules that delete or bury messages about payments or security alerts are a sign of a compromised account: reset the password, revoke sessions and review sign-ins. See the rows →
Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day].
What Microsoft 365 can't show: Judged from Entra ID Protection, inbox rules and Exchange auditing.
Write this answer for Northwind Traders
Security events are evaluated to decide whether they're incidents.
Security alerts and sign-in logs are reviewed [daily or weekly] by [team or provider]. Logs are kept for [period] where users can't change them.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Security incidents are contained, fixed and communicated by a defined programme.
A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Activities to recover from incidents are identified and carried out.
A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Northwind Traders
Changes to infrastructure, data and software are authorised, tested and approved; tenant settings that let users make their own changes are locked down.
- Not checked: users can't create new tenants (Microsoft didn't return this setting).
- Only admins and members of Group creators can create teams and groups.
- Any user can register an app.
- Users can register apps that nobody reviews
Fix: Set "Users can register applications" to No (Entra admin center > Users > User settings) and give the Application Developer role to the people who need it. See the rows →
Changes to systems, applications and networks are logged in [ticket system], checked for their security effect, tested where possible and approved by [role] before they're made. Emergency changes are reviewed afterwards.
What Microsoft 365 can't show: Microsoft 365 shows the tenant settings; describe the change process.
Write this answer for Northwind Traders
Risk mitigation and availability (CC9 and A1)
FailVendors and partners are managed, and data is backed up and recoverable.
Risks from vendors and business partners are assessed and managed, including apps connected to the tenant.
- Users can consent to any app.
- Any user can grant any app access to their mail and files
- 1 app with access to mail, files or the directory.
- Mail Sync Pro: Mail.Read (application permission; unverified publisher)
Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. See the rows →
Suppliers and contractors that handle the organisation's data are checked before they're used, must meet [Cyber Essentials or equivalent security requirements], and are reviewed [every 12 months]. They're listed in [supplier register].
What Microsoft 365 can't show: Microsoft 365 shows which apps reach its data; describe the vendor reviews.
Write this answer for Northwind Traders
Data is backed up and the recovery infrastructure is in place and monitored.
Microsoft 365 data (Exchange Online mail, OneDrive, SharePoint and Teams) is backed up [daily] by [backup product or provider] to storage separate from Microsoft 365. Backups are kept for [retention period], are [immutable or offline], and use credentials separate from the Microsoft 365 administrator accounts. Restores were last tested on [date].
What Microsoft 365 can't show: Microsoft 365 doesn't back itself up for this purpose; describe the backup of Microsoft 365 too.
Write this answer for Northwind Traders
What the assessor checks
The on-site tests, what each needs, and what Microsoft 365 already shows for it.
The auditor tests that each control worked throughout the period (often 6 or 12 months), sampling access changes, leavers, alerts and changes.
Microsoft 365 shows: Microsoft 365 shows the access and monitoring controls on this page, and the What changed view shows how each one stood at the start of the period.
About this pack
A Pass is evidence for the Microsoft 365 part of a criterion; the auditor still tests the service's own systems and processes.
Requirements: AICPA 2017 Trust Services Criteria (revised points of focus, 2022): Security and Availability. Criteria identifiers are the AICPA's; criteria are paraphrased. This pack covers the criteria Microsoft 365 speaks to, not every point of focus. Source
Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; accepted risks count as documented exceptions. Oldest data used: .