What NCSC 10 Steps is
The NCSC’s 10 Steps to Cyber Security.
Who asks for it: UK boards and organisations using the NCSC’s guidance.
What Microsoft 365 can show
10 steps evidenced by 179 checks. A check maps to a step only where its result is genuine evidence for it, so a step is listed only when a tenant setting can show it.
Outside Microsoft 365
Risk management, and engagement and training, are mostly organisational: the checks show only the tenant settings that support them.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every step and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- Cyber Essentials: The UK government-backed baseline: five technical controls for every organisation.
- Cyber Essentials Plus: Cyber Essentials, verified by an assessor’s technical tests.
- NCSC Cyber Assessment Framework: The NCSC’s outcome-based framework for essential services, the NHS and their suppliers.
- Data Security and Protection Toolkit: The NHS self-assessment for organisations that handle patient data.