Microsoft Intune Compliance
49 atomic requirements assessed
49 atomic requirements assessed
AI Atomic Compliance Determination
Multi-model AI assessment of how Microsoft Intune satisfies individual compliance requirements — evaluated atom-by-atom across each framework.
5-Model AI Ensemble — AI Proposed
Each requirement was evaluated independently by 5 AI models (GPT-4o-mini, Llama 3.3, DeepSeek V3, Qwen 72B, Gemini Flash). Results represent AI consensus — not a formal audit or legal compliance opinion. Confidence scores are capped by evidence tier; all results are AI-proposed pending human review.
NIST SP 800-171 Rev. 2 Level 2 (CMMC)
49 requirements evaluated
~ 42 Partial
✗ 5 Does Not Meet
| Determination | Type | Req. ID | Statement | Conf. |
|---|---|---|---|---|
| Partially Meets | hybrid | 3.4.2[a].a | Security configuration settings for information technology products employed in the system are established and included in the baseline configuration. | 65% |
| Partially Meets | hybrid | 3.7.4.a | Determine if media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI. | 64% |
| Partially Meets | process | 3.1.7[a].a | Privileged functions are defined. | 65% |
| Partially Meets | hybrid | 3.8.7.a | Determine if the use of removable media on system components containing CUI is controlled. | 65% |
| Partially Meets | hybrid | 3.7.3.a | Determine if equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI. | 60% |
| Partially Meets | technical | 3.1.1[a].a | Authorized users are identified. | 65% |
| Partially Meets | hybrid | 3.8.6.b | Determine if the confidentiality of CUI stored on digital media is protected during transport using alternative physical safeguards. | 65% |
| Does Not Meet | process | 3.2.2[a].a | Information security-related duties, roles, and responsibilities are defined. | 65% |
| Partially Meets | technical | 3.5.9.a | Determine if an immediate change to a permanent password is required when a temporary password is used for system logon. | 65% |
| Partially Meets | hybrid | 3.4.1[a].a | A baseline configuration is established. | 65% |
| Partially Meets | hybrid | 3.1.2[a].a | The types of transactions and functions that authorized users are permitted to execute are defined. | 65% |
| Partially Meets | process | 3.12.4.[h].a | System security plan is updated with the defined frequency. | 65% |
| Partially Meets | hybrid | 3.8.6.a | Determine if the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards. | 65% |
| Does Not Meet | process | 3.8.1[a].a | Paper media containing CUI is physically controlled. | 65% |
| Partially Meets | technical | 3.1.18[a].a | Mobile devices that process, store, or transmit CUI are identified. | 65% |
| Partially Meets | hybrid | 3.10.4.a | Determine if audit logs of physical access are maintained. | 61% |
| Does Not Meet | process | 3.7.6.a | Determine if maintenance personnel without required access authorization are supervised during maintenance activities. | 57% |
| Partially Meets | process | 3.3.2[a].a | The content of the audit records needed to support the ability to uniquely trace users to their actions is defined. | 65% |
| Partially Meets | process | 3.14.1[a].a | The time within which to identify system flaws is specified. | 65% |
| Partially Meets | technical | 3.5.11.a | Determine if authentication information is obscured during the authentication process. | 62% |
| Partially Meets | process | 3.7.1.a | Determine if system maintenance is performed. | 65% |
| Partially Meets | technical | 3.5.1[a].a | System users are identified. | 65% |
| Partially Meets | hybrid | 3.6.3.a | Determine if the incident response capability is tested. | 63% |
| Partially Meets | hybrid | 3.13.16.a | Determine if the confidentiality of CUI at rest is protected. | 65% |
| Cannot Determine | technical | 3.5.2[a].a | The identity of each user is authenticated or verified as a prerequisite to system access. | 50% |
| Partially Meets | process | 3.4.4.a | Determine if the security impact of changes to each organizational system is analyzed prior to implementation. | 65% |
| Partially Meets | hybrid | 3.8.2.a | Determine if access to CUI on system media is limited to authorized users. | 65% |
| Does Not Meet | process | 3.11.1[a].a | The frequency to assess risk to organizational operations, organizational assets, and individuals is defined. | 65% |
| Partially Meets | process | 3.2.1[a].a | Security risks associated with organizational activities involving CUI are identified. | 65% |
| Partially Meets | hybrid | 3.8.9.a | Determine if the confidentiality of backup CUI is protected at storage locations. | 65% |
| Partially Meets | process | 3.13.1[a].a | The external system boundary is defined. | 62% |
| Does Not Meet | process | 3.10.1[a].a | Authorized individuals allowed physical access are identified. | 65% |
| Partially Meets | hybrid | 3.5.4.b | Determine if replay-resistant authentication mechanisms are implemented for all network account access to non-privileged accounts. | 63% |
| Partially Meets | hybrid | 3.13.7.a | Determine if remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks. | 65% |
| Cannot Determine | process | 3.9.1.a | Determine if individuals are screened prior to authorizing access to organizational systems. | 50% |
| Partially Meets | technical | 3.13.15.a | Determine if the authenticity of communications sessions is protected. | 65% |
| Partially Meets | hybrid | 3.12.3.a | Determine if security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls. | 65% |
| Partially Meets | hybrid | 3.13.5[a].a | Publicly accessible system components are identified. | 59% |
| Partially Meets | hybrid | 3.13.4.a | Determine if unauthorized and unintended information transfer via shared system resources is prevented. | 65% |
| Partially Meets | hybrid | 3.13.11.a | Determine if FIPS-validated cryptography is employed to protect the confidentiality of CUI. | 64% |
| Partially Meets | process | 3.6.1[a].a | An operational incident-handling capability is established. | 65% |
| Partially Meets | process | 3.8.8.a | Determine if the use of portable storage devices is prohibited when such devices have no identifiable owner. | 65% |
| Partially Meets | hybrid | 3.5.4.a | Determine if replay-resistant authentication mechanisms are implemented for all network account access to privileged and non-privileged accounts. | 65% |
| Partially Meets | hybrid | 3.5.3[a].a | Privileged accounts are identified. | 65% |
| Partially Meets | process | 3.12.1[a].a | The frequency of security control assessments is defined. | 65% |
| Partially Meets | hybrid | 3.14.4.a | Determine if malicious code protection mechanisms are updated when new releases are available. | 65% |
| Partially Meets | process | 3.14.2[a].a | Designated locations for malicious code protection are identified. | 65% |
| Partially Meets | hybrid | 3.3.1[a].a | Audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified. | 65% |
| Partially Meets | process | 3.1.3[a].a | Information flow control policies are defined. | 65% |