Fabrikam Dental Group
Fabrikam Dental Group has 3 controls not in place.
Judged from Microsoft 365 data collected ; 10 controls need evidence Microsoft 365 can't show.
What changed
No data from 13 July 2026: the oldest data held is from 7 September 2026.
Gaps to close
8 controls-
Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. For example breakglass@fabrikam.example: Excluded from "CA002 — All users: Require MFA".
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. See the rows →
-
7 of 54 Windows computers past end of support. For example LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release. See the rows →
-
Users can consent to any app. Any user can grant any app access to their mail and files.
Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. See the rows →
-
Anyone, including guests, can invite guests. Guests can invite other guests.
Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. See the rows →
-
7 accounts inactive for 90+ days or never used. For example aaron.smith@fabrikam.example: Licensed member, last signed in 22 Apr 2026.
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used. See the rows →
-
5 external forwards. For example anna.kowalski@fabrikam.example: Mailbox forwarding to anna.kowalski@homemail.example (keeps a copy).
Fix: Remove forwarding to outside addresses unless the client has a documented business reason. See the rows →
-
1 suspicious inbox rule. For example anna.kowalski@fabrikam.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank.
Fix: Check each rule with the mailbox owner. See the rows →
-
Partly CC8.1 Change management
Any user can register an app. Users can register apps that nobody reviews.
Fix: Set "Users can register applications" to No. See the rows →
Control environment, risk and communication (CC1 to CC5)
Your evidenceOversight and accountability, competent and vetted people, policies, and risk assessment.
Management sets structures, reporting lines and responsibilities for security.
[Name], [role], has overall responsibility for information security and data protection and reports to [the board or partners], where security is a standing agenda item. Day-to-day IT security is managed by [IT provider].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
People are checked before they join and trained for their responsibilities.
New staff go through [right-to-work, reference and DBS] checks before they get access, and sign [confidentiality agreements].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Security responsibilities are communicated to staff, including through training.
All staff complete security awareness training [when they join and every year], through [training provider or platform]. Simulated phishing exercises run [monthly or quarterly] and the results are reviewed by [role].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Risks to the service's objectives are identified and analysed.
An information security risk assessment covering [scope] names an owner for each risk, the agreed treatment and an action plan. It was last reviewed on [date] by [name and role] and approved by [director or partner].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Control activities are set out in policies and put into practice through procedures.
Information security policies covering [acceptable use, access control, passwords, data protection and incident response] are approved by [role], reviewed every [12 months] and acknowledged by staff.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Logical and physical access (CC6)
FailAccess is authenticated and authorised, given and removed by process, data movement is restricted and devices are protected.
Access to systems and data is protected by authentication: multi-factor for everyone, legacy protocols blocked, and data encrypted.
- But: 2 admins without a phishing-resistant method.
- But: 6 of 54 computers not encrypted.
- Users with an MFA method registered
- 50.9% of 55
- Accounts covered by an enforced MFA policy
- 54 of 55
- Not covered
- breakglass@fabrikam.example
- Enforced by CA002 — All users: Require MFA, with 1 exclusion to review.
- breakglass@fabrikam.example: Excluded from "CA002 — All users: Require MFA"
- 1 admin not covered by MFA.
- breakglass@fabrikam.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block
- Legacy authentication is allowed.
- No enabled policy blocks legacy authentication for all users
- SMTP AUTH is on for the organisation.
- SMTP AUTH is allowed
Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. See the rows →
Multi-factor authentication (MFA) is enforced through Microsoft Entra ID for Microsoft 365 email and cloud applications, with exceptions. Enforced by Conditional Access ("CA002 — All users: Require MFA"), but with 12 exclusions to review: breakglass@fabrikam.example (break-glass), Application Administrator (role), Cloud Application Administrator (role), Conditional Access Administrator (role), Exchange Administrator (role), Global Administrator (role), Password Administrator (role), Privileged Authentication Administrator (role), Privileged Role Administrator (role), Security Administrator (role), SharePoint Administrator (role), User Administrator (role).
What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins. Add the service's own systems.
Change this answer
New users and guests are registered and authorised before they're given access; old invitations go.
- No stale guest invitations.
- Anyone, including guests, can invite guests.
- Guests can invite other guests
Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. See the rows →
New accounts are created only after a request from [manager or HR] is approved by [role], recorded in [ticket system].
What Microsoft 365 can't show: Microsoft 365 shows who can invite guests; describe how staff accounts are approved.
Write this answer for Fabrikam Dental Group
Access follows least privilege and is removed when people leave or change role; admin rights are few.
- 2 Global Administrators.
- Accounts holding privileged roles
- 4
- Admins with no MFA policy
- 1
- Admins with no MFA method registered
- 2
- 7 accounts inactive for 90+ days or never used.
- aaron.smith@fabrikam.example: Licensed member, last signed in 22 Apr 2026
- aisha.brown@fabrikam.example: Licensed member, last signed in 7 Mar 2026
- jack.lee@fabrikam.example: Licensed member, last signed in 3 Jun 2026
- noah.wood@fabrikam.example: Licensed member, last signed in 7 Feb 2026
- rhys.walker@fabrikam.example: Licensed member, last signed in 5 Jun 2026
- and 2 more
- 1 disabled account still licensed.
- ben.okafor@fabrikam.example: Disabled, holding 1 licence
- 1 guest with admin roles.
- g#EXT#@fabrikam.example: Guest holding Exchange Administrator
Fix: Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never used (after checking with the client), then remove their licences. Inactive accounts are a common foothold for attackers. See the rows →
Access to files and systems is given through role-based groups, approved by [role], and changed when people move roles. [Access is reviewed every 12 months.]
What Microsoft 365 can't show: Judged from Entra ID sign-in activity and admin roles.
Write this answer for Fabrikam Dental Group
Physical access to facilities and equipment is restricted to authorised people.
Offices are protected by [locked doors, access control and alarms]. [Servers and network equipment are kept in a locked room or cabinet.]
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Data is removed from equipment before it's disposed of.
Before devices and storage are reused or disposed of, data is securely wiped [with an Intune wipe or a certified erasure tool] or the storage is destroyed by [certified disposal company], and the certificate is kept.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Access from outside is restricted: firewalls at the boundary and no open sharing.
- Anyone, including anonymous links.
- SharePoint and OneDrive: Anyone links are allowed
- 2 files and folders shared with anyone.
- holiday.jpg (OneDrive of anna.kowalski@fabrikam.example): Anyone can view
- Open day flyer.pdf (Marketing / Documents): Anyone can view, link never expires
A WatchGuard Firebox T45 firewall protects the internet connection at the Manchester practice, and the Leeds practice uses the same model. Home and remote workers are protected by the Microsoft Defender Firewall on their company laptops, enforced by Intune.
Answer set by demo on 12 Oct 2026. Suggested from the data: Not known.
What Microsoft 365 can't show: Microsoft 365 shows its sharing; describe the network boundary.
Change or clear this answer
Data moving outside is restricted and protected: no unnoticed forwarding, domains can't be spoofed.
- The default outbound policy blocks automatic external forwarding.
- But: 1 of 1 mail domain doesn't fully enforce MTA-STS.
- But: 1 domain with SPF problems.
- But: 1 mail domain without DKIM.
- 5 external forwards.
- anna.kowalski@fabrikam.example: Mailbox forwarding to anna.kowalski@homemail.example (keeps a copy)
- anna.kowalski@fabrikam.example: Inbox rule "Copy to home" forwards to anna.kowalski.home@homemail.example
- rhys.hall@fabrikam.example: Mailbox forwarding to rhys.hall@homemail.example (doesn't keep a copy)
- rhys.walker@fabrikam.example: Mailbox forwarding to rhys.walker@homemail.example (doesn't keep a copy)
- thomas.robinson@fabrikam.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example
- 2 domains without DMARC enforcement.
- fabrikam.example: DMARC is monitor-only (p=none); spoofed mail is still delivered
- parked.example: Doesn't receive mail but has no DMARC p=reject record
Fix: Remove forwarding to outside addresses unless the client has a documented business reason. Forwarding is the most common way attackers keep reading a mailbox after a password reset. See the rows →
Automatic forwarding to external addresses is restricted in Exchange Online, with exceptions. The default outbound policy blocks automatic external forwarding. But 5 external forwards found.
What Microsoft 365 can't show: Judged from Exchange Online forwarding and public DNS.
Change this answer
Unauthorised or malicious software is prevented or detected on managed devices.
- Computers managed by Intune
- 54
- Of which encrypted
- 48
- Windows computers out of support
- 7
- Reaching end of support within 90 days
- 29
- Not compliant
- 9
- 9 of 55 managed devices not compliant.
- DESK-LEWIS12 (william.lewis@fabrikam.example): Not compliant
- DESK-MOORE18 (ava.moore@fabrikam.example): Not compliant
- DESK-ROBINSON51 (owen.robinson@fabrikam.example): Not compliant
- LAPTOP-DAVIES38 (ruby.davies@fabrikam.example): Not compliant
- LAPTOP-LEE25 (arthur.lee@fabrikam.example): Not compliant
- and 4 more
- 1 of 55 joined computers not in Intune.
- DESK-RECEPTION: Hybrid joined, not managed by Intune
All laptops and desktops run Microsoft Defender Antivirus with Defender for Endpoint, which updates automatically, scans files on access and blocks malicious websites through SmartScreen. Phones and tablets only install apps from the Apple App Store and Google Play, enforced by Intune.
Answer set by demo on 12 Oct 2026. Suggested from the data: Not known.
What Microsoft 365 can't show: Intune shows devices are managed and compliant; describe the anti-malware product.
Change or clear this answer
System operations and change (CC7 and CC8)
FailVulnerabilities and anomalies are detected, events are evaluated, incidents responded to and recovered from, and changes are controlled.
Vulnerabilities and unexpected configuration changes are found, including systems out of support.
- 7 of 54 Windows computers past end of support.
- LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade.
- and 31 more
- 1 domain had sign-in settings changed in the last 30 days.
- fabrikam.example: Set domain authentication by mallory.quinn@fabrikam.example on 9 Oct 2026
Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. See the rows →
External vulnerability scans run [monthly] using [tool or provider]. [A penetration test was last carried out on (date) by (provider).]
What Microsoft 365 can't show: Judged from Intune and Entra ID domain settings. Describe vulnerability scanning.
Write this answer for Fabrikam Dental Group
Sign-ins, accounts and mailboxes are monitored for anomalies, and activity is logged.
- Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2).
- Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2).
- Mailbox auditing is on for the organisation.
- 1 suspicious inbox rule.
- anna.kowalski@fabrikam.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank
Fix: Check each rule with the mailbox owner. Rules that delete or bury messages about payments or security alerts are a sign of a compromised account: reset the password, revoke sessions and review sign-ins. See the rows →
Sign-ins are monitored for suspicious activity by [tool or service], and alerts are reviewed by [team or provider] [within one working day].
What Microsoft 365 can't show: Judged from Entra ID Protection, inbox rules and Exchange auditing.
Write this answer for Fabrikam Dental Group
Security events are evaluated to decide whether they're incidents.
Security alerts and sign-in logs are reviewed [daily or weekly] by [team or provider]. Logs are kept for [period] where users can't change them.
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Security incidents are contained, fixed and communicated by a defined programme.
A documented incident response plan sets out roles, contacts and the steps to contain and recover from a cyber incident, including notifying [the insurer and IT provider]. It was last reviewed on [date] and tested on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Activities to recover from incidents are identified and carried out.
A business continuity and disaster recovery plan covers [key systems and services]. Recovery targets are [time to restore] to restore service and no more than [data loss window] of data loss. It was last tested on [date].
What Microsoft 365 can't show: All of this. Answer from the organisation's own records.
Write this answer for Fabrikam Dental Group
Changes to infrastructure, data and software are authorised, tested and approved; tenant settings that let users make their own changes are locked down.
- Not checked: users can't create new tenants (Microsoft didn't return this setting).
- Only admins and members of Group creators can create teams and groups.
- Any user can register an app.
- Users can register apps that nobody reviews
Fix: Set "Users can register applications" to No (Entra admin center > Users > User settings) and give the Application Developer role to the people who need it. See the rows →
Changes to systems, applications and networks are logged in [ticket system], checked for their security effect, tested where possible and approved by [role] before they're made. Emergency changes are reviewed afterwards.
What Microsoft 365 can't show: Microsoft 365 shows the tenant settings; describe the change process.
Write this answer for Fabrikam Dental Group
Risk mitigation and availability (CC9 and A1)
FailVendors and partners are managed, and data is backed up and recoverable.
Risks from vendors and business partners are assessed and managed, including apps connected to the tenant.
- Users can consent to any app.
- Any user can grant any app access to their mail and files
- 1 app with access to mail, files or the directory.
- Mail Sync Pro: Mail.Read (application permission; unverified publisher)
Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. See the rows →
Suppliers and contractors that handle the organisation's data are checked before they're used, must meet [Cyber Essentials or equivalent security requirements], and are reviewed [every 12 months]. They're listed in [supplier register].
What Microsoft 365 can't show: Microsoft 365 shows which apps reach its data; describe the vendor reviews.
Write this answer for Fabrikam Dental Group
Data is backed up and the recovery infrastructure is in place and monitored.
Microsoft 365 mail, OneDrive, SharePoint and Teams data is backed up daily by Datto SaaS Protection to storage separate from Microsoft 365, kept for 12 months, with credentials separate from the Microsoft 365 administrator accounts. The last restore test was on 2 September 2026.
Answer set by demo on 12 Oct 2026. Suggested from the data: Not known.
What Microsoft 365 can't show: Microsoft 365 doesn't back itself up for this purpose; describe the backup of Microsoft 365 too.
Change or clear this answer
What the assessor checks
The on-site tests, what each needs, and what Microsoft 365 already shows for it.
The auditor tests that each control worked throughout the period (often 6 or 12 months), sampling access changes, leavers, alerts and changes.
Microsoft 365 shows: Microsoft 365 shows the access and monitoring controls on this page, and the What changed view shows how each one stood at the start of the period.
About this pack
A Pass is evidence for the Microsoft 365 part of a criterion; the auditor still tests the service's own systems and processes.
Requirements: AICPA 2017 Trust Services Criteria (revised points of focus, 2022): Security and Availability. Criteria identifiers are the AICPA's; criteria are paraphrased. This pack covers the criteria Microsoft 365 speaks to, not every point of focus. Source
Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; accepted risks count as documented exceptions. Oldest data used: .