ConfigCheckup
Free trial

NIST CSF 2.0 in Microsoft 365, subcategory by subcategory

26 subcategories can be evidenced from a Microsoft 365 tenant, by 177 checks. Each one is listed below with its checks, and so is what sits outside Microsoft 365.

Every framework mapped to Microsoft 365 · Mappings checked against the published standards in October 2026

What NIST CSF 2.0 is

NIST Cybersecurity Framework 2.0 subcategories (functions Govern, Identify, Protect, Detect, Respond and Recover), with their official wording.

Who asks for it: Organisations using the NIST Cybersecurity Framework.

What Microsoft 365 can show

26 subcategories evidenced by 177 checks. A check maps to a subcategory only where its result is genuine evidence for it, so a subcategory is listed only when a tenant setting can show it.

Outside Microsoft 365

The Govern function and most of Respond and Recover are organisational.

Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.

Every subcategory and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

NIST CSF 2.0: each of the 26 subcategories and the checks that evidence it
SubcategoryChecks that evidence it
DE.AE-02: Potentially adverse events are analyzed to better understand associated activities
DE.AE-06: Information on adverse events is provided to authorized staff and tools
DE.CM-01: Networks and network services are monitored to find potentially adverse events
DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events
DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
ID.AM-01: Inventories of hardware managed by the organization are maintained
ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained
ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained
ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles
ID.IM-01: Improvements are identified from evaluations
PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization
15 more checks for PR.AA-01
PR.AA-03: Users, services, and hardware are authenticated
15 more checks for PR.AA-03
PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
47 more checks for PR.AA-05
PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected
15 more checks for PR.DS-01
PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected
PR.DS-11: Backups of data are created, protected, maintained, and tested
PR.IR-01: Networks and environments are protected from unauthorized logical access and usage
PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
PR.PS-01: Configuration management practices are established and applied
22 more checks for PR.PS-01
PR.PS-02: Software is maintained, replaced, and removed commensurate with risk
PR.PS-04: Log records are generated and made available for continuous monitoring
RS.CO-02: Internal and external stakeholders are notified of incidents
RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared
RS.MA-02: Incident reports are triaged and validated
RS.MI-01: Incidents are contained
  • SOC 2: The AICPA Trust Services Criteria, asked of SaaS and service providers.
  • NIST SP 800-171: Protecting controlled unclassified information in the US defence supply chain.
  • CMMC Level 2: The NIST SP 800-171 practices, as US defence contractors are assessed on them.
  • CISA SCuBA Microsoft 365 baselines: CISA’s secure configuration baselines for Microsoft 365.

Run the NIST CSF 2.0 report on every tenant.

ConfigCheckup checks each tenant you connect against NIST CSF 2.0: each subcategory met, partly met or not met, and what Microsoft 365 cannot show.

Start free trialTake the 2-minute tour

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. See the price per tenant