Skip to content
Tenant Excellence
Request a demo

Frameworks

Evaluated from your tenant configuration

Each framework maps to controls that can be read from Microsoft 365 and Azure settings. Every covered control carries the tenant data that proves it. Results are configuration indications, not an audit opinion or a certification.

  • ISO 27001

    From Complete

    International

    Annex A technical controls of ISO/IEC 27001:2022, evaluated from Entra ID, Exchange Online, SharePoint, Intune, Defender and Azure settings.

  • NCA ECC

    From Complete

    Saudi Arabia

    Essential Cybersecurity Controls (ECC-2:2024) of Saudi Arabia’s National Cybersecurity Authority, evaluated from tenant and subscription configuration.

  • SAMA

    From Complete

    Saudi Arabia · financial sector

    The Saudi Central Bank Cyber Security Framework for supervised financial institutions, evaluated from Microsoft 365 and Azure configuration.

  • NIS2

    From Complete

    European Union

    Article 21 security measures of Directive (EU) 2022/2555 for essential and important entities, evaluated from tenant configuration.

  • DORA

    From Complete

    European Union · financial sector

    ICT risk-management requirements of Regulation (EU) 2022/2554 for financial entities, evaluated from Microsoft 365 and Azure configuration.

  • SOC 2

    From Complete

    International · service organisations

    The AICPA Trust Services Criteria for security, availability and confidentiality that Microsoft 365 and Azure configuration can show, evaluated to prepare for your SOC 2 audit.

  • Best Practices Check

    All packages

    Every tenant · every package

    A best-practices configuration baseline for Microsoft 365 and, in Premium, Azure, scored control by control with a manual-verification guide where Graph cannot answer. Advisory; not a certification.

  • NCA CCC

    Premium

    Saudi Arabia · government and critical national infrastructure

    The cloud tenant controls of the National Cybersecurity Authority's Cloud Cybersecurity Controls (CCC-2:2024), evaluated from Azure configuration, with your evidence for the controls configuration cannot show.

Results are configuration indications drawn from your tenant. They are not an audit opinion or a certification.

In depth

Give the auditor a link, not a folder

Every covered control shows the data Microsoft Graph returned and the endpoint it came from. One click creates a read-only snapshot for one framework; it needs no account and expires after 24 hours.

  • Structured proof per control, with its Graph or ARM source
  • Scoped to one framework, read-only, no sign-in for the auditor
  • Expires after 24 hours; creation is written to the audit log
Learn more

Request a demo

Which frameworks do you report against?

Tell us in the demo request and we will show the matching controls on a demo tenant.

0 / 5,000

We use these details only to arrange your demo. See the privacy policy.