What Digital Operational Resilience Act is
The EU regulation on ICT risk management for banks, insurers, investment firms and their critical ICT suppliers. The ICT risk management chapter (Articles 5 to 16) is where Microsoft 365 configuration counts.
Who asks for it: EU financial entities and their ICT providers.
What Microsoft 365 can show
9 provisions evidenced by 89 checks. A check maps to a provision only where its result is genuine evidence for it, so a provision is listed only when a tenant setting can show it.
Outside Microsoft 365
Governance, resilience testing, incident reporting to regulators and third-party contracts are organisational. The FCA’s operational resilience rules (SYSC 15A) are about impact tolerances for important business services, with no configuration controls to map; these checks support the technical side of both.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every provision and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- NIS2 Directive: The EU directive’s minimum cyber security measures for critical sectors.
- Cyber Essentials: The UK government-backed baseline: five technical controls for every organisation.
- ISO/IEC 27001:2022: The international standard for an information security management system.
- CIS Microsoft 365 Foundations v6.0.0: The Center for Internet Security’s hardening benchmark for Microsoft 365.