Microsoft Security Compliance Mapper

## Mapping Microsoft 365 Security to Compliance If you run Microsoft 365 and need to satisfy a compliance framework, the hard question is usually "which product covers which requirement, and where am I still exposed?" This tool maps Microsoft 365 security products to six major frameworks and highlights the gaps your current licensing leaves open. ## Frameworks Covered - **NIST CSF 2.0** — the six functions: Govern, Identify, Protect, Detect, Respond, Recover. - **HIPAA** — the Security Rule's administrative, physical, and technical safeguards for protected health information. - **SOC 2** — the AICPA Trust Service Criteria (Security plus optional Availability, Confidentiality, Processing Integrity, Privacy). - **PCI DSS 4.0** — the requirements for handling cardholder data. - **CMMC 2.0** — the U.S. defense supply chain's tiered model built on NIST SP 800-171. - **CIS Controls v8** — 18 prioritized safeguards grouped into implementation groups. ## How the Mapping Works The tool associates Microsoft capabilities — Entra ID conditional access and identity protection, Defender's endpoint and email protection, Intune device compliance, Purview information protection and DLP — with the specific control families each framework defines. The result shows coverage and, more importantly, the controls Microsoft tooling alone does not satisfy. ### Mind the Gaps No product suite makes you compliant by itself. Two limits are worth stressing: - **Tooling is not evidence.** Owning a capability is different from configuring it, operating it, and documenting that it works — which is what auditors assess. - **Process controls remain yours.** Risk assessments, policies, training, and incident response are organizational obligations no license covers. Use the gap view to plan both the configuration work and the non-technical controls you must add. ## Privacy The mapping is computed in your browser; the products and frameworks you select are never uploaded. To dig deeper into one framework's readiness, see the [SOC 2 Gap Analysis](/tools/compliance/soc2-gap-analysis).