Security frameworks, mapped to Microsoft 365
19 frameworks, from Cyber Essentials to ISO 27001, each mapped to the Microsoft 365 settings it asks about. For each one: the controls the 179 checks can evidence in a tenant, the checks behind them, and what sits outside Microsoft 365.
UK frameworks
Cyber Essentials
The UK government-backed baseline: five technical controls for every organisation.
8 of 17 requirements evidenced from the tenant
Cyber Essentials Plus
Cyber Essentials, verified by an assessor’s technical tests.
7 tests and controls evidenced by 37 checks
NCSC Cyber Assessment Framework
The NCSC’s outcome-based framework for essential services, the NHS and their suppliers.
20 contributing outcomes evidenced by 178 checks
Data Security and Protection Toolkit
The NHS self-assessment for organisations that handle patient data.
8 standards evidenced by 156 checks
NCSC 10 Steps
The NCSC’s guidance for boards and organisations, in ten steps.
10 steps evidenced by 179 checks
EU regulations
Digital Operational Resilience Act
The EU regulation on ICT risk for financial entities and their ICT providers.
9 provisions evidenced by 89 checks
NIS2 Directive
The EU directive’s minimum cyber security measures for critical sectors.
9 measures evidenced by 162 checks
International standards and benchmarks
Microsoft Cloud Security Benchmark
Microsoft’s own baseline for securing its cloud services.
25 controls evidenced by 125 checks
Zero Trust
Microsoft’s Zero Trust deployment pillars, from identities to data.
6 pillars evidenced by 171 checks
Microsoft Secure Score
Microsoft’s own score for a tenant, read beside the checks.
16 items evidenced by 12 checks
PCI DSS 4.0.1
The card industry’s data security standard.
25 requirements evidenced by 86 checks
ISO/IEC 27001:2022
The international standard for an information security management system.
30 controls evidenced by 179 checks
CIS Microsoft 365 Foundations v6.0.0
The Center for Internet Security’s hardening benchmark for Microsoft 365.
107 of 140 recommendations checked in full, 5 in part
CIS Controls v8.1
The CIS Critical Security Controls, by implementation group.
39 safeguards evidenced by 150 checks
US frameworks
SOC 2
The AICPA Trust Services Criteria, asked of SaaS and service providers.
14 criteria evidenced by 167 checks
NIST SP 800-171
Protecting controlled unclassified information in the US defence supply chain.
26 requirements evidenced by 155 checks
CMMC Level 2
The NIST SP 800-171 practices, as US defence contractors are assessed on them.
26 practices evidenced by 155 checks
CISA SCuBA Microsoft 365 baselines
CISA’s secure configuration baselines for Microsoft 365.
59 of 104 policies checked in full, 14 in part
NIST CSF 2.0
The NIST Cybersecurity Framework: govern, identify, protect, detect, respond and recover.
26 subcategories evidenced by 177 checks
How the mapping is made
Genuine evidence only
A check maps to a control only where its result is genuine evidence for that control. A control no tenant setting can show is not claimed.What Microsoft 365 cannot show, said plainly
Physical security, training, policies, backups of other systems and networks outside Microsoft 365 are named on each framework’s page where they apply, and left out of its readiness.The benchmarks, counted control by control
The CIS Microsoft 365 benchmark and CISA’s SCuBA baselines are listed control by control, the ones no check covers too, so their coverage figures are worked out from the checks, never written by hand.Readiness, not certification
A readiness report shows how close a tenant is. Certification and audit opinions stay with each scheme’s own assessors. The mappings were last checked against the published standards in October 2026.
One framework, across every tenant
In ConfigCheckup, pick a framework and see every tenant’s readiness against it, weakest first: controls met, partly met and not met, from the same assessment as every other check.
- Pick a framework
- One framework across every tenant
- Every tenant, weakest first
Each framework links to its checks, and each check to how to fix it. Browse the Microsoft 365 security checks
Run a framework report on every tenant.
Pick the frameworks you are asked about, and see each tenant’s readiness from one read-only assessment.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.