What CIS Controls v8.1 is
CIS Critical Security Controls v8.1 safeguards, with the lowest implementation group (IG1, IG2 or IG3) each belongs to.
Who asks for it: Organisations using the CIS Critical Security Controls.
What Microsoft 365 can show
39 safeguards evidenced by 150 checks. A check maps to a safeguard only where its result is genuine evidence for it, so a safeguard is listed only when a tenant setting can show it.
Outside Microsoft 365
Network, penetration testing and application security controls sit outside Microsoft 365.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every safeguard and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- CIS Microsoft 365 Foundations v6.0.0: The Center for Internet Security’s hardening benchmark for Microsoft 365.
- Microsoft Cloud Security Benchmark: Microsoft’s own baseline for securing its cloud services.
- Zero Trust: Microsoft’s Zero Trust deployment pillars, from identities to data.
- Microsoft Secure Score: Microsoft’s own score for a tenant, read beside the checks.