Microsoft Entra ID Compliance
59 atomic requirements assessed
59 atomic requirements assessed
AI Atomic Compliance Determination
Multi-model AI assessment of how Microsoft Entra ID satisfies individual compliance requirements — evaluated atom-by-atom across each framework.
5-Model AI Ensemble — AI Proposed
Each requirement was evaluated independently by 5 AI models (GPT-4o-mini, Llama 3.3, DeepSeek V3, Qwen 72B, Gemini Flash). Results represent AI consensus — not a formal audit or legal compliance opinion. Confidence scores are capped by evidence tier; all results are AI-proposed pending human review.
NIST SP 800-171 Rev. 2 Level 2 (CMMC)
49 requirements evaluated
✓ 3 Meets
~ 32 Partial
✗ 10 Does Not Meet
| Determination | Type | Req. ID | Statement | Conf. |
|---|---|---|---|---|
| Cannot Determine | process | 3.14.1[a].a | The time within which to identify system flaws is specified. | 48% |
| Cannot Determine | technical | 3.5.11.a | Determine if authentication information is obscured during the authentication process. | 50% |
| Cannot Determine | process | 3.7.1.a | Determine if system maintenance is performed. | 50% |
| Cannot Determine | process | 3.12.1[a].a | The frequency of security control assessments is defined. | 50% |
| Meets | technical | 3.1.1[a].a | Authorized users are identified. | 65% |
| Meets | technical | 3.5.1[a].a | System users are identified. | 65% |
| Meets | technical | 3.5.2[a].a | The identity of each user is authenticated or verified as a prerequisite to system access. | 65% |
| Partially Meets | process | 3.1.7[a].a | Privileged functions are defined. | 65% |
| Partially Meets | hybrid | 3.8.7.a | Determine if the use of removable media on system components containing CUI is controlled. | 58% |
| Partially Meets | technical | 3.5.9.a | Determine if an immediate change to a permanent password is required when a temporary password is used for system logon. | 65% |
| Partially Meets | process | 3.12.4.[h].a | System security plan is updated with the defined frequency. | 64% |
| Partially Meets | process | 3.2.1[a].a | Security risks associated with organizational activities involving CUI are identified. | 65% |
| Partially Meets | process | 3.13.1[a].a | The external system boundary is defined. | 63% |
| Partially Meets | process | 3.9.1.a | Determine if individuals are screened prior to authorizing access to organizational systems. | 65% |
| Partially Meets | technical | 3.13.15.a | Determine if the authenticity of communications sessions is protected. | 65% |
| Partially Meets | hybrid | 3.13.5[a].a | Publicly accessible system components are identified. | 65% |
| Partially Meets | hybrid | 3.13.4.a | Determine if unauthorized and unintended information transfer via shared system resources is prevented. | 65% |
| Partially Meets | hybrid | 3.13.11.a | Determine if FIPS-validated cryptography is employed to protect the confidentiality of CUI. | 65% |
| Partially Meets | hybrid | 3.5.3[a].a | Privileged accounts are identified. | 65% |
| Partially Meets | process | 3.14.2[a].a | Designated locations for malicious code protection are identified. | 65% |
| Partially Meets | process | 3.1.3[a].a | Information flow control policies are defined. | 65% |
| Does Not Meet | hybrid | 3.7.4.a | Determine if media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI. | 65% |
| Does Not Meet | hybrid | 3.7.3.a | Determine if equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI. | 65% |
| Does Not Meet | process | 3.8.1[a].a | Paper media containing CUI is physically controlled. | 65% |
| Does Not Meet | hybrid | 3.10.4.a | Determine if audit logs of physical access are maintained. | 64% |
| Does Not Meet | process | 3.7.6.a | Determine if maintenance personnel without required access authorization are supervised during maintenance activities. | 65% |
| Does Not Meet | process | 3.11.1[a].a | The frequency to assess risk to organizational operations, organizational assets, and individuals is defined. | 65% |
| Does Not Meet | process | 3.6.1[a].a | An operational incident-handling capability is established. | 65% |
| Partially Meets | hybrid | 3.4.2[a].a | Security configuration settings for information technology products employed in the system are established and included in the baseline configuration. | 65% |
| Partially Meets | process | 3.2.2[a].a | Information security-related duties, roles, and responsibilities are defined. | 65% |
| Partially Meets | hybrid | 3.4.1[a].a | A baseline configuration is established. | 65% |
| Partially Meets | hybrid | 3.1.2[a].a | The types of transactions and functions that authorized users are permitted to execute are defined. | 65% |
| Partially Meets | hybrid | 3.8.6.a | Determine if the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards. | 65% |
| Partially Meets | technical | 3.1.18[a].a | Mobile devices that process, store, or transmit CUI are identified. | 65% |
| Partially Meets | process | 3.3.2[a].a | The content of the audit records needed to support the ability to uniquely trace users to their actions is defined. | 65% |
| Partially Meets | hybrid | 3.6.3.a | Determine if the incident response capability is tested. | 65% |
| Partially Meets | hybrid | 3.13.16.a | Determine if the confidentiality of CUI at rest is protected. | 65% |
| Partially Meets | hybrid | 3.8.2.a | Determine if access to CUI on system media is limited to authorized users. | 65% |
| Partially Meets | hybrid | 3.8.9.a | Determine if the confidentiality of backup CUI is protected at storage locations. | 65% |
| Partially Meets | hybrid | 3.5.4.b | Determine if replay-resistant authentication mechanisms are implemented for all network account access to non-privileged accounts. | 65% |
| Partially Meets | hybrid | 3.13.7.a | Determine if remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks. | 65% |
| Partially Meets | hybrid | 3.12.3.a | Determine if security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls. | 65% |
| Partially Meets | process | 3.8.8.a | Determine if the use of portable storage devices is prohibited when such devices have no identifiable owner. | 58% |
| Partially Meets | hybrid | 3.5.4.a | Determine if replay-resistant authentication mechanisms are implemented for all network account access to privileged and non-privileged accounts. | 65% |
| Partially Meets | hybrid | 3.14.4.a | Determine if malicious code protection mechanisms are updated when new releases are available. | 61% |
| Partially Meets | hybrid | 3.3.1[a].a | Audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified. | 65% |
| Does Not Meet | hybrid | 3.8.6.b | Determine if the confidentiality of CUI stored on digital media is protected during transport using alternative physical safeguards. | 65% |
| Does Not Meet | process | 3.4.4.a | Determine if the security impact of changes to each organizational system is analyzed prior to implementation. | 65% |
| Does Not Meet | process | 3.10.1[a].a | Authorized individuals allowed physical access are identified. | 65% |
NIST CSF version 2.0
10 requirements evaluated
✓ 5 Meets
~ 5 Partial
| Determination | Type | Req. ID | Statement | Conf. |
|---|---|---|---|---|
| Meets | hybrid | PR.AA-05.d | Access permissions, entitlements, and authorizations are reviewed. | 90% |
| Meets | hybrid | PR.AA-05.e | Access permissions, entitlements, and authorizations incorporate the principles of least privilege. | 100% |
| Meets | process | PR.AA-05.a | Access permissions, entitlements, and authorizations are defined in a policy. | 100% |
| Meets | hybrid | PR.AA-05.b | Access permissions, entitlements, and authorizations are managed. | 100% |
| Meets | technical | PR.AA-05.c | Access permissions, entitlements, and authorizations are enforced. | 100% |
| Partially Meets | hybrid | PR.AA-05.f | Access permissions, entitlements, and authorizations incorporate the principles of separation of duties. | 79% |
| Partially Meets | process | GV.OC-03.a | Legal, regulatory, and contractual requirements regarding cybersecurity are understood and managed | 77% |
| Partially Meets | process | GV.OC-03.c | Civil liberties obligations are understood and managed | 68% |
| Partially Meets | process | GV.OC-03.d | Privacy obligations regarding cybersecurity are understood and managed | 74% |
| Partially Meets | process | GV.OC-03.b | Privacy obligations are understood and managed | 74% |