NIST Cybersecurity Framework 2.0: Fabrikam Dental Group ======================================================= Prepared 12 October 2026 by Harbour IT. Microsoft 365 data from 12 Oct 2026. Gaps to close. Fabrikam Dental Group has 4 controls not in place. Controls: 1 Pass, 4 Fail, 4 Partly, 9 Your evidence GAPS TO CLOSE GV.SC Supply chain risk management - Users can consent to any app. - Any user can grant any app access to their mail and files - 1 app with access to mail, files or the directory. - Mail Sync Pro: Mail.Read (application permission; unverified publisher) Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. ID.RA Risk assessment - 7 of 54 Windows computers past end of support. - LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 31 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. PR.AA Identity, authentication and access: MFA - Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. - breakglass@fabrikam.example: Excluded from "CA002 — All users: Require MFA" - 1 admin not covered by MFA. - breakglass@fabrikam.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block - Legacy authentication is allowed. - No enabled policy blocks legacy authentication for all users Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. DE.CM Continuous monitoring - 1 suspicious inbox rule. - anna.kowalski@fabrikam.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank Fix: Check each rule with the mailbox owner. Rules that delete or bury messages about payments or security alerts are a sign of a compromised account: reset the password, revoke sessions and review sign-ins. GOVERN (GV) (FAIL) GV.RR Roles, responsibilities and authorities Verdict: Your evidence Requirement: Leadership is accountable for cybersecurity, and roles are set and resourced. Text to paste: [Name], [role], has overall responsibility for information security and data protection and reports to [the board or partners], where security is a standing agenda item. Day-to-day IT security is managed by [IT provider]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. GV.PO Policy Verdict: Your evidence Requirement: Cybersecurity policy is set, communicated, enforced and reviewed. Text to paste: Information security policies covering [acceptable use, access control, passwords, data protection and incident response] are approved by [role], reviewed every [12 months] and acknowledged by staff. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. GV.RM Risk management strategy Verdict: Your evidence Requirement: Risk appetite and priorities are set and used to make decisions. Text to paste: An information security risk assessment covering [scope] names an owner for each risk, the agreed treatment and an action plan. It was last reviewed on [date] by [name and role] and approved by [director or partner]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. GV.SC Supply chain risk management Verdict: Fail Requirement: Suppliers are known, assessed and bound by security requirements, and the cloud apps that reach company data are controlled. - Users can consent to any app. - Any user can grant any app access to their mail and files - 1 app with access to mail, files or the directory. - Mail Sync Pro: Mail.Read (application permission; unverified publisher) Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. Text to paste: Suppliers and contractors that handle the organisation's data are checked before they're used, must meet [Cyber Essentials or equivalent security requirements], and are reviewed [every 12 months]. They're listed in [supplier register]. What Microsoft 365 can't show: Microsoft 365 shows which apps can reach its data; the supplier reviews are the organisation's own. IDENTIFY (ID) (FAIL) ID.AM Asset management Verdict: Partly Requirement: Hardware, software, services and data are inventoried, and stale entries are removed. - Computers managed by Intune: 54 - Of which encrypted: 48 - Windows computers out of support: 7 - Reaching end of support within 90 days: 29 - Not compliant: 9 - 1 of 57 device records unused for 90+ days. - OLD-PC: Windows, last seen 200 days ago Fix: Disable, then after 30 days delete, device records that haven't signed in for 90 days (Entra admin center > Devices > All devices, filter by activity). Old records can still hold BitLocker keys and count toward device limits. Text to paste: An asset register in [tool or spreadsheet] lists [hardware, software, cloud services and the information held], each with a named owner, a category and where it is. Devices are added when they're set up and removed when they're disposed of, and the register was last reviewed on [date]. What Microsoft 365 can't show: Microsoft 365 lists the devices Intune and Entra ID know; the inventory covers everything else. ID.RA Risk assessment Verdict: Fail Requirement: Vulnerabilities are identified, including systems out of vendor support, and risks are assessed. - 7 of 54 Windows computers past end of support. - LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 31 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. Text to paste: External vulnerability scans run [monthly] using [tool or provider]. [A penetration test was last carried out on (date) by (provider).] What Microsoft 365 can't show: Judged from the Windows versions Intune reports. Describe scanning of everything else. PROTECT (PR) (FAIL) PR.AA Identity, authentication and access: MFA Verdict: Fail Requirement: Users are authenticated in proportion to risk: multi-factor authentication for everyone, and legacy protocols blocked. - But: 2 admins without a phishing-resistant method. - But: 4 people can only use a text or call as a second factor. - Users with an MFA method registered: 50.9% of 55 - Accounts covered by an enforced MFA policy: 54 of 55 - Not covered: breakglass@fabrikam.example - Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. - breakglass@fabrikam.example: Excluded from "CA002 — All users: Require MFA" - 1 admin not covered by MFA. - breakglass@fabrikam.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block - Legacy authentication is allowed. - No enabled policy blocks legacy authentication for all users Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. Text to paste: Multi-factor authentication (MFA) is enforced through Microsoft Entra ID for Microsoft 365 email and cloud applications, with exceptions. Enforced by Conditional Access ("CA002 — All users: Require MFA"), but with 12 exclusions to review: breakglass@fabrikam.example (break-glass), Application Administrator (role), Cloud Application Administrator (role), Conditional Access Administrator (role), Exchange Administrator (role), Global Administrator (role), Password Administrator (role), Privileged Authentication Administrator (role), Privileged Role Administrator (role), Security Administrator (role), SharePoint Administrator (role), User Administrator (role). What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins. Add other systems. PR.AA Identity, authentication and access: least privilege Verdict: Partly Requirement: Access rights are managed with least privilege, admin rights are few, and leavers lose access. - 2 Global Administrators. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 - 1 guest with admin roles. - g#EXT#@fabrikam.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator - 7 accounts inactive for 90+ days or never used. - aaron.smith@fabrikam.example: Licensed member, last signed in 22 Apr 2026 - aisha.brown@fabrikam.example: Licensed member, last signed in 7 Mar 2026 - jack.lee@fabrikam.example: Licensed member, last signed in 3 Jun 2026 - noah.wood@fabrikam.example: Licensed member, last signed in 7 Feb 2026 - rhys.walker@fabrikam.example: Licensed member, last signed in 5 Jun 2026 - and 2 more Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. Text to paste: Administrator role assignments in Microsoft 365 are tracked, with gaps. 4 accounts hold privileged admin roles, 2 of them Global Administrator (anna.kowalski@fabrikam.example, breakglass@fabrikam.example). 2 Global Administrators. 1 guest with admin roles. 1 app with privileged roles. What Microsoft 365 can't show: Judged from Entra ID roles and sign-in activity. PR.AT Awareness and training Verdict: Your evidence Requirement: People are trained to do their work with security in mind. Text to paste: All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. PR.DS Data security Verdict: Partly Requirement: Data is protected at rest and in transit, and isn't shared or forwarded outside unnoticed. - The default outbound policy blocks automatic external forwarding. - But: 1 of 1 mail domain doesn't fully enforce MTA-STS. - But: 2 domains without DMARC enforcement. - 6 of 54 computers not encrypted. - DESK-MOORE18 (ava.moore@fabrikam.example): Windows disk isn't encrypted - DESK-ROBINSON51 (owen.robinson@fabrikam.example): Windows disk isn't encrypted - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows disk isn't encrypted - LAPTOP-ROBINSON07 (thomas.robinson@fabrikam.example): Windows disk isn't encrypted - LAPTOP-WARD29 (jack.ward@fabrikam.example): Windows disk isn't encrypted - and 1 more - 2 files and folders shared with anyone. - holiday.jpg (OneDrive of anna.kowalski@fabrikam.example): Anyone can view - Open day flyer.pdf (Marketing / Documents): Anyone can view, link never expires - 5 external forwards. - anna.kowalski@fabrikam.example: Mailbox forwarding to anna.kowalski@homemail.example (keeps a copy) - anna.kowalski@fabrikam.example: Inbox rule "Copy to home" forwards to anna.kowalski.home@homemail.example - rhys.hall@fabrikam.example: Mailbox forwarding to rhys.hall@homemail.example (doesn't keep a copy) - rhys.walker@fabrikam.example: Mailbox forwarding to rhys.walker@homemail.example (doesn't keep a copy) - thomas.robinson@fabrikam.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. Text to paste: Data in Microsoft 365 is encrypted at rest by Microsoft (BitLocker and per-file service encryption) and in transit using TLS. Not every company computer is encrypted: 6 of 54 computers not encrypted. What Microsoft 365 can't show: Judged from Intune encryption, SharePoint sharing and Exchange forwarding. PR.PS Platform security Verdict: Partly Requirement: Hardware and software are managed, configured securely and kept updated, and logs are generated. - Mailbox auditing is on for the organisation. - Not checked: users can't create new tenants (Microsoft didn't return this setting). - Computers managed by Intune: 54 - Of which encrypted: 48 - Windows computers out of support: 7 - Reaching end of support within 90 days: 29 - Not compliant: 9 - 1 of 55 joined computers not in Intune. - DESK-RECEPTION: Hybrid joined, not managed by Intune - 9 of 55 managed devices not compliant. - DESK-LEWIS12 (william.lewis@fabrikam.example): Not compliant - DESK-MOORE18 (ava.moore@fabrikam.example): Not compliant - DESK-ROBINSON51 (owen.robinson@fabrikam.example): Not compliant - LAPTOP-DAVIES38 (ruby.davies@fabrikam.example): Not compliant - LAPTOP-LEE25 (arthur.lee@fabrikam.example): Not compliant - and 4 more - Any user can register an app. - Users can register apps that nobody reviews Fix: Enrol Entra-joined and hybrid-joined computers in Intune (automatic enrolment under Devices > Enrollment > Windows) so compliance, encryption and updates can be enforced on them. Text to paste: Company devices are not all managed centrally. 1 of 55 joined computers not in Intune. 9 of 55 managed devices not compliant. What Microsoft 365 can't show: Judged from Intune, Exchange Online auditing and Entra ID tenant settings. PR.IR Technology infrastructure resilience Verdict: Pass (decided by demo) Requirement: Networks are protected and capacity and backups keep services running. - But: 88% of about 1.45 TB used (1 TB + 10 GB × 46 licences). Text to paste: Microsoft 365 mail, OneDrive, SharePoint and Teams data is backed up daily by Datto SaaS Protection to storage separate from Microsoft 365, kept for 12 months, with credentials separate from the Microsoft 365 administrator accounts. The last restore test was on 2 September 2026. What Microsoft 365 can't show: Microsoft 365 doesn't back itself up for this purpose; describe the backup of Microsoft 365 too. DETECT (DE) (FAIL) DE.CM Continuous monitoring Verdict: Fail Requirement: Sign-ins, accounts and mailboxes are monitored for anomalies. - Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2). - Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2). - But: 1 domain had sign-in settings changed in the last 30 days. - 1 suspicious inbox rule. - anna.kowalski@fabrikam.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank Fix: Check each rule with the mailbox owner. Rules that delete or bury messages about payments or security alerts are a sign of a compromised account: reset the password, revoke sessions and review sign-ins. Text to paste: Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day]. What Microsoft 365 can't show: Judged from Entra ID Protection and inbox rules (Entra ID P2 for the full detections). DE.AE Adverse event analysis Verdict: Your evidence Requirement: Alerts are analysed to understand what happened and its impact. Text to paste: Security alerts and sign-in logs are reviewed [daily or weekly] by [team or provider]. Logs are kept for [period] where users can't change them. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. RESPOND (RS) (YOUR EVIDENCE) RS.MA Incident management Verdict: Your evidence Requirement: An incident response plan is run when an incident is declared. Text to paste: A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. RS.MI Incident mitigation Verdict: Your evidence Requirement: Incidents are contained, for example by securing a compromised account. Text to paste: If an account may be compromised, [IT provider] resets the password, signs the account out of every session, checks its MFA methods and inbox rules, and reviews its sign-ins. Staff report concerns to [contact]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. RS.CO Incident reporting and communication Verdict: Your evidence Requirement: Incidents are reported to the people and authorities who must be told. Text to paste: Every personal data breach is recorded in a breach log with what happened, its effects and what was done. [Role] decides whether it must be reported; reportable breaches go to the ICO within 72 hours of the organisation becoming aware, and to the people affected when the risk to them is high. Lessons learned are reviewed by [role]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. RECOVER (RC) (YOUR EVIDENCE) RC.RP Incident recovery plan execution Verdict: Your evidence Requirement: Systems and data are restored from backups by a tested plan. Text to paste: A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date]. What Microsoft 365 can't show: All of this. Answer from the organisation's own records. ABOUT THIS EVIDENCE The CSF has no pass mark. Use Pass as evidence a category's outcome is achieved for Microsoft 365, and Fail and Partly as the gaps for the target profile. Requirements: NIST Cybersecurity Framework (CSF) 2.0, February 2024. Category identifiers are NIST's; outcomes are paraphrased. A CSF profile is the organisation's own: this pack is the Microsoft 365 evidence for it. Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; nothing was changed. Answers marked [in brackets] still need completing.