What NIS2 Directive is
The EU directive’s minimum cybersecurity risk-management measures, Article 21(2) (a) to (j).
Who asks for it: Medium and large organisations in critical sectors in the EU.
What Microsoft 365 can show
9 measures evidenced by 162 checks. A check maps to a measure only where its result is genuine evidence for it, so a measure is listed only when a tenant setting can show it.
Outside Microsoft 365
Risk analysis policies, business continuity, supplier contracts and training are organisational measures assessed separately.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every measure and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- Digital Operational Resilience Act: The EU regulation on ICT risk for financial entities and their ICT providers.
- ISO/IEC 27001:2022: The international standard for an information security management system.
- Cyber Essentials: The UK government-backed baseline: five technical controls for every organisation.
- CIS Microsoft 365 Foundations v6.0.0: The Center for Internet Security’s hardening benchmark for Microsoft 365.