Supplier security questionnaire: Northwind Traders ================================================== Prepared 12 October 2026 by Harbour IT. Microsoft 365 data from 11 Oct 2026. Gaps to close. Northwind Traders has 4 controls not in place. Controls: 9 Pass, 4 Fail, 9 Partly, 13 Your evidence, 1 Not collected GAPS TO CLOSE External sharing controlled - Anyone, including anonymous links. - SharePoint and OneDrive: Anyone links are allowed - 3 files and folders shared with anyone. - Campaign video.mp4 (Marketing / Documents): Anyone can edit - Brand assets (Marketing / Documents): Anyone can view, link never expires - holiday.jpg (OneDrive of ann.patel@northwindtraders.example): Anyone can view - Anyone, including guests, can invite guests. - Guests can invite other guests Fix: Change SharePoint external sharing to "New and existing guests" so every external person signs in. If the client relies on Anyone links, set them to expire and to view-only. Portable devices encrypted - 4 of 36 computers not encrypted. - DESK-WRIGHT18 (leo.wright@northwindtraders.example): Windows disk isn't encrypted - LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows disk isn't encrypted - LAPTOP-SCOTT29 (olivia.scott@northwindtraders.example): Windows disk isn't encrypted - LAPTOP-SMITH07 (olivia.smith@northwindtraders.example): Windows disk isn't encrypted Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. Supported operating systems - 5 of 36 Windows computers past end of support. - LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-MARTIN22 (maya.martin@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-PATEL13 (hannah.patel@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-ROBERTS31 (george.roberts@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-TAYLOR04 (grace.taylor@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 20 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. Third-party apps controlled - Users can consent to any app. - Any user can grant any app access to their mail and files - 1 app with access to mail, files or the directory. - Mail Sync Pro: Mail.Read (application permission; unverified publisher) Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. GOVERNANCE (YOUR EVIDENCE) Information security policies Verdict: Your evidence Requirement: Documented information security policies exist and are reviewed. Text to paste: Information security policies covering [acceptable use, access control, passwords, data protection and incident response] are approved by [role], reviewed every [12 months] and acknowledged by staff. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Security certifications held Verdict: Your evidence Requirement: Cyber Essentials, CE Plus, ISO 27001 or similar, with dates. Text to paste: The organisation holds [Cyber Essentials or Cyber Essentials Plus or ISO 27001] certification, number [certificate number], valid until [date]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. ACCESS CONTROL (PARTLY) MFA for every user Verdict: Pass Requirement: Multi-factor authentication is required for all users. - Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@northwindtraders.example (break-glass). - But: 14 users without MFA. - Users with an MFA method registered: 62.2% of 37 - Accounts covered by an enforced MFA policy: 36 of 36 Text to paste: Multi-factor authentication (MFA) is enforced for Microsoft 365 email (including Outlook on the web and mobile) and cloud applications, through Microsoft Entra ID. Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@northwindtraders.example (break-glass). What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins only. Add VPNs, remote desktop and other systems. MFA for privileged accounts Verdict: Pass Requirement: Every privileged account uses MFA. - 2 of 3 active admin accounts are required to use MFA by "Require MFA for all users"; the exception is 1 break-glass account: breakglass@northwindtraders.example (excluded from "Require MFA for all users"). - But: 1 admin without MFA, and 1 whose registration isn't known. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 Text to paste: Multi-factor authentication is enforced for the administrator accounts of Microsoft 365 and Microsoft Entra ID. 2 of 3 active admin accounts are required to use MFA by "Require MFA for all users"; the exception is 1 break-glass account: breakglass@northwindtraders.example (excluded from "Require MFA for all users"). What Microsoft 365 can't show: Judged for Microsoft 365 and Entra ID admin roles. Phishing-resistant MFA for administrators Verdict: Partly Requirement: Administrators sign in with FIDO2 keys, passkeys or Windows Hello for Business, not codes. - 2 admins without a phishing-resistant method. - ann.patel@northwindtraders.example: Global Administrator; signs in with Authenticator app - breakglass@northwindtraders.example: Global Administrator; signs in with no MFA method at all Fix: Have each listed admin register a passkey (in Microsoft Authenticator or on a security key) or Windows Hello for Business, then require the Phishing-resistant MFA authentication strength for admin roles in Conditional Access. Codes and push approvals can be relayed by a fake sign-in page; these can't. Text to paste: Administrator accounts don't all use phishing-resistant sign-in methods yet. 2 admins without a phishing-resistant method. What Microsoft 365 can't show: Judged from the sign-in methods admin accounts have registered. No weak MFA methods Verdict: Partly Requirement: Text-message and voice-call MFA are turned off or being retired. - 3 people can only use a text or call as a second factor. - arthur.evans@northwindtraders.example: Second factor is only Mobile phone (SMS or call) - mia.hughes@northwindtraders.example: Second factor is only Mobile phone (SMS or call) - zara.jackson@northwindtraders.example: Second factor is only Mobile phone (SMS or call) Fix: Ask these people to set up the Microsoft Authenticator app (the registration campaign in the authentication methods policy prompts them at sign-in), then turn off text message and voice call sign-in, or keep them only as a backup. Texts and calls can be intercepted or moved to an attacker's SIM. Text to paste: Some users rely on a text message or phone call as their only second factor. 3 people can only use a text or call as a second factor. What Microsoft 365 can't show: Judged from the authentication methods policy and what people have registered. Separate admin accounts Verdict: Partly Requirement: Administrative accounts are separate from standard user accounts. - 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: ann.patel@northwindtraders.example. Fix: Give each administrator a separate, unlicensed admin account with no mailbox, used only for administration, and take the admin roles off the account they use every day. Text to paste: Most administrator accounts are separate from day-to-day accounts. There are exceptions. 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: ann.patel@northwindtraders.example. What Microsoft 365 can't show: Judged from Microsoft 365 admin role holders: an admin account with a licence or a mailbox looks like an everyday account. Privileged access restricted and tracked Verdict: Partly Requirement: Few named administrators, no guests or apps with admin roles, and the list is reviewed. - 2 Global Administrators. - Cloud-only tenant: no accounts are synced from on-premises AD. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 - 1 guest with admin roles. - g#EXT#@northwindtraders.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. Text to paste: Administrator role assignments in Microsoft 365 are tracked, with gaps. 4 accounts hold privileged admin roles, 2 of them Global Administrator (ann.patel@northwindtraders.example, breakglass@northwindtraders.example). 2 Global Administrators. 1 guest with admin roles. 1 app with privileged roles. What Microsoft 365 can't show: Microsoft 365 shows who holds admin roles today; describe how the list is reviewed. Unique accounts, no shared logins Verdict: Pass Requirement: Every user has their own account; shared mailboxes can't be signed in to. - All 3 shared mailboxes block sign-in. Text to paste: Each person signs in to Microsoft 365 with their own named account. Shared mailboxes can't be signed in to directly; people reach them through their own accounts. All 3 shared mailboxes block sign-in. What Microsoft 365 can't show: Judged from whether shared mailboxes can be signed in to. Check devices and other systems. Password policy Verdict: Pass Requirement: Passwords have a minimum length, common ones are banned and repeated failures lock the account. - Microsoft Entra ID requires passwords of at least 8 characters, blocks commonly used and known compromised passwords (Microsoft's global banned password list) and locks out repeated failed sign-in attempts (smart lockout). These are Microsoft defaults for cloud accounts. Multi-factor authentication is enforced as well (see the MFA answer), so a guessed password alone can't be used to sign in. What Microsoft 365 can't show: Microsoft Entra ID's defaults (8 characters, a banned password list and smart lockout) aren't read from the tenant. Add other systems that take passwords. Access removed when people leave Verdict: Partly Requirement: Leavers' accounts are disabled promptly and inactive accounts removed. - 4 accounts inactive for 90+ days or never used. - hannah.robinson@northwindtraders.example: Licensed member, last signed in 7 Apr 2026 - sophie.smith@northwindtraders.example: Licensed member, last signed in 21 Jan 2026 - thomas.clarke@northwindtraders.example: Licensed member, last signed in 2 Jun 2026 - g#EXT#@northwindtraders.example: Guest, never signed in, created ? - 1 disabled account still licensed. - robert.hughes@northwindtraders.example: Disabled, holding 1 licence Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used (after checking with the client), then remove their licences. Inactive accounts are a common foothold for attackers. Text to paste: Some inactive accounts in Microsoft Entra ID have not been disabled. 4 accounts inactive for 90+ days or never used. 1 disabled account still licensed. What Microsoft 365 can't show: Judged from sign-in activity in Microsoft Entra ID. Describe the leavers process in the answer. Guest access reviewed Verdict: Pass Requirement: Guests and external users are reviewed and pending invitations cleared. - No stale guest invitations. - Guests have limited access to directory objects (the default). Text to paste: Guest and external user accounts are not reviewed regularly. 1 guest account: 1 guest inactive for 90+ days or never signed in (g#EXT#@northwindtraders.example). What Microsoft 365 can't show: Judged from guest accounts and the external collaboration settings. DATA PROTECTION (FAIL) Where data is stored Verdict: Pass Requirement: The region the tenant's data is held in. - Email, files and Teams data are held in Microsoft 365, in Microsoft's datacentres. What Microsoft 365 can't show: Microsoft 365 reports the tenant's data location; add any other systems. Encrypted at rest and in transit Verdict: Partly Requirement: Data is encrypted at rest and in transit. - Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 4 of 36 computers not encrypted. Text to paste: Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 4 of 36 computers not encrypted. What Microsoft 365 can't show: Microsoft 365 encrypts stored data and connections; add other systems. External sharing controlled Verdict: Fail Requirement: Data can't be shared with unauthorised people: sharing settings, anyone links and guest invitations. - Anyone, including anonymous links. - SharePoint and OneDrive: Anyone links are allowed - 3 files and folders shared with anyone. - Campaign video.mp4 (Marketing / Documents): Anyone can edit - Brand assets (Marketing / Documents): Anyone can view, link never expires - holiday.jpg (OneDrive of ann.patel@northwindtraders.example): Anyone can view - Anyone, including guests, can invite guests. - Guests can invite other guests Fix: Change SharePoint external sharing to "New and existing guests" so every external person signs in. If the client relies on Anyone links, set them to expire and to view-only. Text to paste: Sharing with anonymous and external users is not restricted in SharePoint and OneDrive. Anyone, including anonymous links. 3 files and folders shared with anyone. Anyone, including guests, can invite guests. What Microsoft 365 can't show: Judged from SharePoint and OneDrive sharing settings and links. Portable devices encrypted Verdict: Fail Requirement: Laptops and other portable devices are encrypted. - 4 of 36 computers not encrypted. - DESK-WRIGHT18 (leo.wright@northwindtraders.example): Windows disk isn't encrypted - LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows disk isn't encrypted - LAPTOP-SCOTT29 (olivia.scott@northwindtraders.example): Windows disk isn't encrypted - LAPTOP-SMITH07 (olivia.smith@northwindtraders.example): Windows disk isn't encrypted Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. Text to paste: Company computers managed in Microsoft Intune are not all encrypted. 4 of 36 computers not encrypted. What Microsoft 365 can't show: Judged for devices managed by Intune. EMAIL SECURITY (PARTLY) Mail filtered for phishing and malware Verdict: Pass Requirement: Incoming email is filtered for phishing and malware. - Incoming email for northwindtraders.example is delivered to Microsoft 365 and filtered by Exchange Online Protection (anti-spam, anti-phishing and anti-malware). Text to paste: Incoming email is filtered for spam, phishing and malware. Incoming email for northwindtraders.example is delivered to Microsoft 365 and filtered by Exchange Online Protection (anti-spam, anti-phishing and anti-malware). What Microsoft 365 can't show: Microsoft 365 shows which mail gateway the domains route through, not its settings. SPF, DKIM and DMARC Verdict: Partly Requirement: Every email domain publishes SPF, signs with DKIM and has a DMARC policy. - 1 domain with SPF problems. - parked.example: Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing - 1 mail domain without DKIM. - northwindtraders.example: Microsoft 365 DKIM isn't set up (selector2 CNAME missing) - 2 domains without DMARC enforcement. - northwindtraders.example: DMARC is monitor-only (p=none); spoofed mail is still delivered - parked.example: Doesn't receive mail but has no DMARC p=reject record Fix: Publish one SPF record per domain ending in -all (or ~all while testing), e.g. "v=spf1 include:spf.protection.outlook.com -all". Domains that never send mail should publish "v=spf1 -all". Text to paste: SPF, DKIM and DMARC are not fully configured for the organisation's email domains. 1 domain with SPF problems. 1 mail domain without DKIM. 2 domains without DMARC enforcement. What Microsoft 365 can't show: Judged from public DNS and Exchange Online for the tenant's domains. No automatic forwarding outside Verdict: Partly Requirement: Automatic forwarding of email outside the organisation is blocked. - The default outbound policy blocks automatic external forwarding. - 4 external forwards. - ann.patel@northwindtraders.example: Mailbox forwarding to ann.patel@homemail.example (keeps a copy) - ann.patel@northwindtraders.example: Inbox rule "Copy to home" forwards to ann.patel.home@homemail.example - grace.taylor@northwindtraders.example: Mailbox forwarding to grace.taylor@homemail.example (doesn't keep a copy) - olivia.smith@northwindtraders.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example - 1 suspicious inbox rule. - ann.patel@northwindtraders.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank Fix: Remove forwarding to outside addresses unless the client has a documented business reason. Forwarding is the most common way attackers keep reading a mailbox after a password reset. Text to paste: Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 4 external forwards found. What Microsoft 365 can't show: Judged from the Exchange Online outbound spam policy, mailbox forwarding and inbox rules. DEVICES (FAIL) Devices managed to a baseline Verdict: Partly Requirement: Devices are centrally managed and must meet a security baseline. - Computers managed by Intune: 36 - Of which encrypted: 32 - Windows computers out of support: 5 - Reaching end of support within 90 days: 20 - Not compliant: 6 - 1 of 37 joined computers not in Intune. - DESK-RECEPTION: Hybrid joined, not managed by Intune - 6 of 37 managed devices not compliant. - DESK-ROBINSON12 (george.robinson@northwindtraders.example): Not compliant - DESK-WRIGHT18 (leo.wright@northwindtraders.example): Not compliant - LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Not compliant - LAPTOP-SCOTT25 (alfie.scott@northwindtraders.example): Not compliant - LAPTOP-SCOTT29 (olivia.scott@northwindtraders.example): Not compliant - and 1 more Fix: Enrol Entra-joined and hybrid-joined computers in Intune (automatic enrolment under Devices > Enrollment > Windows) so compliance, encryption and updates can be enforced on them. Text to paste: Company devices are not all managed centrally. 1 of 37 joined computers not in Intune. 6 of 37 managed devices not compliant. What Microsoft 365 can't show: Judged from Intune enrolment and compliance for devices joined to Entra ID. Supported operating systems Verdict: Fail Requirement: Every operating system is still supported by its vendor. - 5 of 36 Windows computers past end of support. - LAPTOP-HUGHES (robert.hughes@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-MARTIN22 (maya.martin@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-PATEL13 (hannah.patel@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-ROBERTS31 (george.roberts@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-TAYLOR04 (grace.taylor@northwindtraders.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 20 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. Text to paste: Managed Windows computers run versions of Windows that no longer receive security updates. 5 of 36 Windows computers past end of support. What Microsoft 365 can't show: Judged for Windows computers known to Intune or Entra ID. Security updates applied quickly Verdict: Your evidence Requirement: Security updates are applied within an agreed time, 14 days for critical ones. - But: 3 devices haven't checked in for 30+ days. Text to paste: Operating system updates install automatically through [Windows Update for Business, Intune update rings or the RMM tool]. Critical and high-risk updates, including router and firewall firmware, are installed within 14 days of release, and this is checked [weekly] by [IT provider]. What Microsoft 365 can't show: Intune shows when each device last checked in, not when updates were installed. Anti-malware on every device Verdict: Your evidence Requirement: Anti-malware software is installed and kept up to date on all devices. - But: 6 of 37 managed devices not compliant. Text to paste: All desktops and laptops run [anti-malware product, for example Microsoft Defender Antivirus], which updates automatically, scans files when they're opened and blocks malicious websites. Tablets and phones only install apps from the official app stores. What Microsoft 365 can't show: Office Sentry doesn't read Microsoft Defender or anti-malware settings. LOGGING AND MONITORING (NOT COLLECTED) Security events logged Verdict: Pass Requirement: Security events are logged and kept. - Mailbox auditing is on for the organisation. Text to paste: Mailbox audit logging is enabled in Exchange Online, recording access to and actions on mailboxes. Mailbox auditing is on for the organisation. What Microsoft 365 can't show: Judged from Exchange Online mailbox auditing and the unified audit log. Suspicious activity monitored Verdict: Not collected Requirement: Suspicious sign-ins and users are detected and responded to. - Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2). - Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2). Text to paste: Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day]. What Microsoft 365 can't show: Judged from Entra ID Protection (needs Entra ID P2 for the full detections). Vulnerability scanning or penetration testing Verdict: Your evidence Requirement: Vulnerability scans or penetration tests are carried out and findings fixed. Text to paste: External vulnerability scans run [monthly] using [tool or provider]. [A penetration test was last carried out on (date) by (provider).] What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. INCIDENTS, BACKUPS AND CONTINUITY (YOUR EVIDENCE) Incident response and notification Verdict: Your evidence Requirement: An incident response plan exists and clients are told about incidents affecting their data. Text to paste: A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Backups and tested restores Verdict: Your evidence Requirement: Data is backed up and restores are tested. Text to paste: Microsoft 365 data (Exchange Online mail, OneDrive, SharePoint and Teams) is backed up [daily] by [backup product or provider] to storage separate from Microsoft 365. Backups are kept for [retention period], are [immutable or offline], and use credentials separate from the Microsoft 365 administrator accounts. Restores were last tested on [date]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Continuity and recovery plans Verdict: Your evidence Requirement: Business continuity and disaster recovery plans exist. Text to paste: A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. THIRD PARTIES, PEOPLE AND PREMISES (FAIL) Third-party apps controlled Verdict: Fail Requirement: Users can't consent to third-party apps on their own, and apps with risky permissions are known. - Users can consent to any app. - Any user can grant any app access to their mail and files - 1 app with access to mail, files or the directory. - Mail Sync Pro: Mail.Read (application permission; unverified publisher) Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. Text to paste: Third-party application access to Microsoft 365 data is not controlled. Users can consent to any app. 1 app with access to mail, files or the directory. What Microsoft 365 can't show: Judged from Entra ID consent settings and app permissions. Cloud services and sub-processors Verdict: Pass Requirement: The cloud services and sub-processors that hold the client's data. - Microsoft 365 (Microsoft 365 Business Basic, Microsoft 365 Business Premium). Cloud services connected to Microsoft 365 sign-in: Mail Sync Pro, Survey Tool, Zoom. What Microsoft 365 can't show: Microsoft 365 lists the apps connected to its sign-in; add the rest. Security awareness training Verdict: Your evidence Requirement: Staff receive security awareness training. Text to paste: All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Staff vetted before access Verdict: Your evidence Requirement: Staff are vetted before they're given access. Text to paste: New staff go through [right-to-work, reference and DBS] checks before they get access, and sign [confidentiality agreements]. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Premises and equipment secured Verdict: Your evidence Requirement: Premises and equipment are physically secured. Text to paste: Offices are protected by [locked doors, access control and alarms]. [Servers and network equipment are kept in a locked room or cabinet.] What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. Network protected by firewalls Verdict: Your evidence Requirement: The network is protected by firewalls. Text to paste: A [make and model] firewall protects the internet connection at [site]. Home and remote workers are protected by the software firewall on their company devices. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. MFA on remote access Verdict: Your evidence Requirement: Remote access is protected by MFA. Text to paste: Remote access to the network is only possible through [VPN or remote access product], which requires multi-factor authentication. Remote support tools ([product]) also require multi-factor authentication. What Microsoft 365 can't show: Not something Microsoft 365 shows; answer from the client's own records. ANSWERS FOR THE FORM: SUPPLIER SECURITY QUESTIONNAIRE Governance Do you have documented information security policies? Answer: Your input Information security policies covering [acceptable use, access control, passwords, data protection and incident response] are approved by [role], reviewed every [12 months] and acknowledged by staff. Based on: Microsoft 365 can't show this. Do you hold any security certifications, such as Cyber Essentials or ISO 27001? Answer: Your input The organisation holds [Cyber Essentials or Cyber Essentials Plus or ISO 27001] certification, number [certificate number], valid until [date]. Based on: Microsoft 365 can't show this. Access control Is multi-factor authentication required for all users? Answer: Yes Multi-factor authentication (MFA) is enforced for Microsoft 365 email (including Outlook on the web and mobile) and cloud applications, through Microsoft Entra ID. Enforced by Conditional Access ("Require MFA for all users") for everyone except 1 named exclusion: breakglass@northwindtraders.example (break-glass). Still to check: This covers Microsoft 365 sign-ins only. Add VPN, remote desktop and any other system people reach from outside the office. Is multi-factor authentication required for privileged accounts? Answer: Yes Multi-factor authentication is enforced for the administrator accounts of Microsoft 365 and Microsoft Entra ID. 2 of 3 active admin accounts are required to use MFA by "Require MFA for all users"; the exception is 1 break-glass account: breakglass@northwindtraders.example (excluded from "Require MFA for all users"). Still to check: Covers Microsoft 365 and Entra ID admin roles. Add admin access to servers, firewalls, backup consoles and other cloud services. Do administrators use phishing-resistant MFA? Answer: No Administrator accounts don't all use phishing-resistant sign-in methods yet. 2 admins without a phishing-resistant method. Do you avoid weaker MFA methods such as text messages? Answer: No Some users rely on a text message or phone call as their only second factor. 3 people can only use a text or call as a second factor. Are administrative accounts separate from standard user accounts? Answer: Partly Most administrator accounts are separate from day-to-day accounts. There are exceptions. 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: ann.patel@northwindtraders.example. Still to check: Covers Microsoft 365 admin roles. Add local administrator, server and domain admin accounts. Is privileged access restricted and tracked? Answer: Partly Administrator role assignments in Microsoft 365 are tracked, with gaps. 4 accounts hold privileged admin roles, 2 of them Global Administrator (ann.patel@northwindtraders.example, breakglass@northwindtraders.example). 2 Global Administrators. 1 guest with admin roles. 1 app with privileged roles. Still to check: Add administrators of servers, firewalls and other systems, and say how the list is kept. Does every user have a unique account, with no shared logins? Answer: Yes Each person signs in to Microsoft 365 with their own named account. Shared mailboxes can't be signed in to directly; people reach them through their own accounts. All 3 shared mailboxes block sign-in. Still to check: Check devices, line-of-business apps and other systems for shared logins. Describe your password policy. Answer: Answered Microsoft Entra ID requires passwords of at least 8 characters, blocks commonly used and known compromised passwords (Microsoft's global banned password list) and locks out repeated failed sign-in attempts (smart lockout). These are Microsoft defaults for cloud accounts. Multi-factor authentication is enforced as well (see the MFA answer), so a guessed password alone can't be used to sign in. Still to check: The password rules are Microsoft's defaults, not read from the tenant. Add other systems that use passwords (devices, servers, other cloud services). How quickly is access removed when someone leaves? Answer: No Some inactive accounts in Microsoft Entra ID have not been disabled. 4 accounts inactive for 90+ days or never used. 1 disabled account still licensed. Still to check: Describe the leavers process: who tells IT, and how quickly accounts are disabled. Is access by guests and external users reviewed? Answer: No Guest and external user accounts are not reviewed regularly. 1 guest account: 1 guest inactive for 90+ days or never signed in (g#EXT#@northwindtraders.example). Still to check: Say how often guest access is reviewed, and by whom. Data protection Where is our data stored? Answer: Answered Email, files and Teams data are held in Microsoft 365, in Microsoft's datacentres. Still to check: Confirm the data location in the Microsoft 365 admin centre (Settings > Org settings > Organization profile > Data location), and add data held anywhere else. Is data encrypted at rest and in transit? Answer: Partly Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 4 of 36 computers not encrypted. Still to check: The Microsoft 365 encryption is Microsoft's own, not read from the tenant. Add servers, backups and other systems. How do you stop data being shared with unauthorised people? Answer: No Sharing with anonymous and external users is not restricted in SharePoint and OneDrive. Anyone, including anonymous links. 3 files and folders shared with anyone. Anyone, including guests, can invite guests. Are laptops and other portable devices encrypted? Answer: No Company computers managed in Microsoft Intune are not all encrypted. 4 of 36 computers not encrypted. Still to check: Covers computers managed by Intune. Add any computers that aren't. Email security How is email protected against phishing and malware? Answer: Yes Incoming email is filtered for spam, phishing and malware. Incoming email for northwindtraders.example is delivered to Microsoft 365 and filtered by Exchange Online Protection (anti-spam, anti-phishing and anti-malware). Still to check: Office Sentry sees the mail routing and licences, not the filtering policies. Confirm Safe Links and Safe Attachments (or the gateway's equivalent) apply to every user. Do you use SPF, DKIM and DMARC to stop your domains being spoofed? Answer: No SPF, DKIM and DMARC are not fully configured for the organisation's email domains. 1 domain with SPF problems. 1 mail domain without DKIM. 2 domains without DMARC enforcement. Is automatic forwarding of email outside the organisation blocked? Answer: Partly Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 4 external forwards found. Devices Are devices centrally managed and required to meet a security baseline? Answer: No Company devices are not all managed centrally. 1 of 37 joined computers not in Intune. 6 of 37 managed devices not compliant. Still to check: Covers devices joined to Entra ID. Add any company devices that aren't. Are all operating systems supported by their vendor? Answer: No Managed Windows computers run versions of Windows that no longer receive security updates. 5 of 36 Windows computers past end of support. Still to check: Covers Windows computers known to Intune or Entra ID. Add servers, macOS, phones, network devices and other software. How quickly are security updates applied? Answer: Your input Operating system updates install automatically through [Windows Update for Business, Intune update rings or the RMM tool]. Critical and high-risk updates, including router and firewall firmware, are installed within 14 days of release, and this is checked [weekly] by [IT provider]. Based on: Microsoft 365 can't show this. Intune shows which Windows version each computer runs (see the supported systems answer), not when updates were installed. Is anti-malware software installed and kept up to date on all devices? Answer: Your input All desktops and laptops run [anti-malware product, for example Microsoft Defender Antivirus], which updates automatically, scans files when they're opened and blocks malicious websites. Tablets and phones only install apps from the official app stores. Based on: Microsoft 365 can't show this. Office Sentry doesn't read anti-malware settings. Logging and monitoring Are security events logged? Answer: Yes Mailbox audit logging is enabled in Exchange Online, recording access to and actions on mailboxes. Mailbox auditing is on for the organisation. Still to check: How long audit logs are kept depends on the Microsoft 365 licence; confirm the retention period. Do you monitor for and respond to suspicious activity? Answer: Your input Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day]. Based on: Sign-in risk needs Entra ID P2. Do you carry out vulnerability scanning or penetration testing? Answer: Your input External vulnerability scans run [monthly] using [tool or provider]. [A penetration test was last carried out on (date) by (provider).] Based on: Microsoft 365 can't show this. Incidents, backups and continuity Do you have an incident response plan, and would you tell us about an incident affecting our data? Answer: Your input A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date]. Based on: Microsoft 365 can't show this. Is data backed up, and are restores tested? Answer: Your input Microsoft 365 data (Exchange Online mail, OneDrive, SharePoint and Teams) is backed up [daily] by [backup product or provider] to storage separate from Microsoft 365. Backups are kept for [retention period], are [immutable or offline], and use credentials separate from the Microsoft 365 administrator accounts. Restores were last tested on [date]. Based on: Backups aren't visible in Microsoft 365 data. Answer from the backup product's records. Do you have business continuity and disaster recovery plans? Answer: Your input A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date]. Based on: Microsoft 365 can't show this. Third parties How do you control third-party applications' access to data? Answer: No Third-party application access to Microsoft 365 data is not controlled. Users can consent to any app. 1 app with access to mail, files or the directory. Which cloud services and sub-processors do you use? Answer: Answered Microsoft 365 (Microsoft 365 Business Basic, Microsoft 365 Business Premium). Cloud services connected to Microsoft 365 sign-in: Mail Sync Pro, Survey Tool, Zoom. Still to check: Add cloud services people sign in to with separate accounts (accounting, payroll, CRM, file transfer, social media); Microsoft 365 can't see them. People and premises Do staff receive security awareness training? Answer: Your input All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role]. Based on: Training isn't visible in Microsoft 365 data. Answer from the training provider's records. Are staff vetted before they're given access? Answer: Your input New staff go through [right-to-work, reference and DBS] checks before they get access, and sign [confidentiality agreements]. Based on: Microsoft 365 can't show this. How are your premises and equipment secured? Answer: Your input Offices are protected by [locked doors, access control and alarms]. [Servers and network equipment are kept in a locked room or cabinet.] Based on: Microsoft 365 can't show this. Network Is your network protected by firewalls? Answer: Your input A [make and model] firewall protects the internet connection at [site]. Home and remote workers are protected by the software firewall on their company devices. Based on: Microsoft 365 can't show this. Firewalls aren't part of Microsoft 365. Is remote access protected by multi-factor authentication? Answer: Your input Remote access to the network is only possible through [VPN or remote access product], which requires multi-factor authentication. Remote support tools ([product]) also require multi-factor authentication. Based on: Microsoft 365 can't show this. It sees Microsoft 365 sign-ins (see the MFA answer), not VPNs or remote desktop. ABOUT THIS EVIDENCE Scope: the client's customer asks about the client's whole business. A Pass here covers Microsoft 365; the answer should say what covers the rest. Requirements: Supplier and vendor due-diligence questionnaires as commonly worded in 2026. Questions drawn from the supplier security questionnaires UK organisations send their suppliers, in their typical wording; no organisation's form is copied. Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; nothing was changed. Answers marked [in brackets] still need completing.