Microsoft 365 Compliance
27 atomic requirements assessed
27 atomic requirements assessed
AI Atomic Compliance Determination
Multi-model AI assessment of how Microsoft 365 satisfies individual compliance requirements — evaluated atom-by-atom across each framework.
5-Model AI Ensemble — AI Proposed
Each requirement was evaluated independently by 5 AI models (GPT-4o-mini, Llama 3.3, DeepSeek V3, Qwen 72B, Gemini Flash). Results represent AI consensus — not a formal audit or legal compliance opinion. Confidence scores are capped by evidence tier; all results are AI-proposed pending human review.
CIS IG3 All Controls
27 requirements evaluated
✓ 22 Meets
~ 3 Partial
✗ 2 Does Not Meet
| Determination | Type | Req. ID | Statement | Conf. |
|---|---|---|---|---|
| Meets | hybrid | 1.1.b | Maintain Detailed Enterprise Asset Inventory. | 79% |
| Meets | hybrid | 1.1.a | Establish and Maintain Detailed Enterprise Asset Inventory | 79% |
| Meets | hybrid | 13.11.a | Tune Security Event Alerting Thresholds | 92% |
| Meets | technical | 10.1.a | Deploy and Maintain Anti-Malware Software | 89% |
| Meets | technical | 10.1.b | Maintain anti-malware software | 89% |
| Meets | process | 14.2.a | Train Workforce Members to Recognize Social Engineering Attacks | 81% |
| Meets | process | 17.5.a | Assign Key Roles and Responsibilities | 73% |
| Meets | process | 14.4.a | Train Workforce on Data Handling Best Practices | 81% |
| Meets | process | 17.3.a | Establish and Maintain an Enterprise Process for Reporting Incidents | 85% |
| Meets | process | 3.7.a | Establish and Maintain a Data Classification Scheme | 69% |
| Meets | process | 17.6.a | Define Mechanisms for Communicating During Incident Response | 86% |
| Meets | process | 17.1.a | Designate Personnel to Manage Incident Handling | 85% |
| Does Not Meet | process | 17.2.a | Establish and Maintain Contact Information for Reporting Security Incidents | 33% |
| Meets | hybrid | 3.14.a | Log Sensitive Data Access | 79% |
| Does Not Meet | technical | 10.4.a | Configure Automatic Anti-Malware Scanning of Removable Media | 33% |
| Partially Meets | hybrid | 2.3.a | Address Unauthorized Software | 73% |
| Meets | process | 14.6.a | Train Workforce Members on Recognizing and Reporting Security Incidents | 74% |
| Meets | hybrid | 11.5.a | Test Data Recovery | 85% |
| Meets | process | 11.1.a | Establish and Maintain a Data Recovery Process | 85% |
| Partially Meets | hybrid | 3.2.a | Establish and Maintain a Data Inventory | 77% |
| Meets | hybrid | 4.1.a | Establish and Maintain a Secure Configuration Process | 79% |
| Meets | hybrid | 10.6.a | Centrally Manage Anti-Malware Software | 85% |
| Meets | process | 14.3.a | Train Workforce Members on Authentication Best Practices | 74% |
| Meets | hybrid | 2.1.a | Establish and Maintain a Software Inventory | 79% |
| Meets | hybrid | 2.1.b | Maintain a Software Inventory. | 79% |
| Meets | technical | 11.2.a | Perform Automated Backups | 82% |
| Partially Meets | hybrid | 1.2.a | Address Unauthorized Assets | 80% |