Microsoft Sentinel Compliance
1 certificate · 104 atomic requirements assessed
1 certificate · 104 atomic requirements assessed
AI-Discovered Resources
These compliance resources were discovered by AI web scraping and may include self-reported certifications. Always verify compliance documentation directly with the vendor before making procurement or audit decisions.
SOC 2
Network Intelligence
View CertificateAbout Compliance Certifications
These compliance certifications demonstrate Microsoft Sentinel's commitment to security, privacy, and regulatory standards. Click each certificate to view the official documentation.
AI Atomic Compliance Determination
Multi-model AI assessment of how Microsoft Sentinel satisfies individual compliance requirements — evaluated atom-by-atom across each framework.
5-Model AI Ensemble — AI Proposed
Each requirement was evaluated independently by 5 AI models (GPT-4o-mini, Llama 3.3, DeepSeek V3, Qwen 72B, Gemini Flash). Results represent AI consensus — not a formal audit or legal compliance opinion. Confidence scores are capped by evidence tier; all results are AI-proposed pending human review.
NIST CSF version 2.0
104 requirements evaluated
✓ 5 Meets
~ 85 Partial
✗ 8 Does Not Meet
| Determination | Type | Req. ID | Statement | Conf. |
|---|---|---|---|---|
| Meets | hybrid | DE.AE-03.a | Information is correlated from multiple sources | 65% |
| Partially Meets | hybrid | DE.AE-06.a | Information on adverse events is provided to authorized staff and tools | 65% |
| Partially Meets | hybrid | DE.AE-02.a | Potentially adverse events are analyzed to better understand associated activities | 65% |
| Partially Meets | hybrid | DE.AE-08.a | Incidents are declared when adverse events meet the defined incident criteria | 65% |
| Partially Meets | hybrid | DE.AE-07.a | Cyber threat intelligence and other contextual information are integrated into the analysis | 65% |
| Cannot Determine | process | GV.OV-02.a | The cybersecurity risk management strategy is reviewed. | 50% |
| Cannot Determine | process | GV.PO-01.a | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities. | 50% |
| Cannot Determine | process | GV.OC-03.c | Civil liberties obligations are understood and managed | 50% |
| Cannot Determine | process | GV.OC-02.c | Their needs and expectations regarding cybersecurity risk management are considered. | 50% |
| Cannot Determine | process | GV.OC-02.b | Their needs and expectations regarding cybersecurity risk management are understood. | 50% |
| Cannot Determine | process | GV.PO-02.c | Policy for managing cybersecurity risks is communicated. | 50% |
| Meets | technical | PR.PS-04.a | Log records are generated. | 65% |
| Meets | technical | RS.AN-07.a | Incident data and metadata are collected. | 65% |
| Meets | hybrid | PR.PS-04.b | Log records are made available for continuous monitoring. | 65% |
| Meets | hybrid | DE.CM-01.a | Networks and network services are monitored to find potentially adverse events | 65% |
| Partially Meets | hybrid | RS.MI-01.a | Incidents are contained | 65% |
| Partially Meets | hybrid | RS.CO-03.a | Information is shared with designated internal and external stakeholders | 65% |
| Partially Meets | process | GV.OV-02.b | The cybersecurity risk management strategy is adjusted. | 65% |
| Partially Meets | hybrid | PR.AA-01.a | Identities and credentials for authorized users are managed by the organization | 65% |
| Partially Meets | hybrid | ID.RA-02.a | Cyber threat intelligence is received from information sharing forums and sources | 65% |
| Partially Meets | technical | PR.PS-05.a | Installation and execution of unauthorized software are prevented | 65% |
| Partially Meets | hybrid | ID.RA-03.b | Internal and external threats to the organization are recorded. | 65% |
| Partially Meets | hybrid | PR.DS-01.b | The integrity of data-at-rest are protected | 65% |
| Partially Meets | hybrid | RS.AN-03.b | Analysis is performed to establish the root cause of the incident. | 65% |
| Partially Meets | hybrid | PR.DS-01.a | The confidentiality of data-at-rest are protected | 65% |
| Partially Meets | hybrid | RS.MA-03.b | Incidents are prioritized. | 65% |
| Partially Meets | hybrid | RS.CO-03.b | Information is shared with designated external stakeholders | 65% |
| Partially Meets | hybrid | RC.RP-05.b | Systems and services are restored | 65% |
| Partially Meets | hybrid | PR.AA-01.c | Identities and credentials for authorized hardware are managed by the organization | 62% |
| Partially Meets | process | ID.IM-03.a | Improvements are identified from execution of operational processes, procedures, and activities | 65% |
| Partially Meets | process | GV.OC-03.a | Legal, regulatory, and contractual requirements regarding cybersecurity are understood and managed | 65% |
| Partially Meets | process | ID.IM-04.c | Incident response plans are maintained. | 64% |
| Partially Meets | hybrid | DE.CM-03.a | Personnel activity and technology usage are monitored to find potentially adverse events | 65% |
| Partially Meets | hybrid | ID.AM-08.c | Software is managed throughout their life cycles | 65% |
| Partially Meets | process | ID.IM-04.d | Incident response plans are improved. | 65% |
| Partially Meets | process | GV.PO-01.c | The policy for managing cybersecurity risks is enforced. | 65% |
| Partially Meets | hybrid | PR.AA-05.f | Access permissions, entitlements, and authorizations incorporate the principles of separation of duties. | 65% |
| Partially Meets | hybrid | ID.RA-03.a | Internal and external threats to the organization are identified. | 65% |
| Partially Meets | process | ID.IM-04.a | Incident response plans are established. | 64% |
| Partially Meets | hybrid | ID.AM-02.a | Inventories of software, services, and systems managed by the organization are maintained | 65% |
| Partially Meets | process | RC.RP-02.a | Recovery actions are selected. | 64% |
| Partially Meets | technical | PR.PS-05.b | Execution of unauthorized software is prevented | 65% |
| Partially Meets | hybrid | ID.AM-08.a | Systems are managed throughout their life cycles | 65% |
| Partially Meets | process | RC.RP-05.c | Normal operating status is confirmed | 65% |
| Partially Meets | hybrid | PR.IR-03.a | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | 65% |
| Partially Meets | hybrid | RS.AN-06.c | The records' provenance is preserved. | 65% |
| Partially Meets | hybrid | ID.AM-07.a | Inventories of data and corresponding metadata for designated data types are maintained | 65% |
| Partially Meets | process | GV.PO-02.d | Policy for managing cybersecurity risks is enforced. | 65% |
| Partially Meets | technical | PR.DS-02.b | The integrity of data-in-transit are protected | 65% |
| Partially Meets | hybrid | ID.RA-05.b | Threats, vulnerabilities, likelihoods, and impacts are used to inform risk response prioritization. | 65% |
| Partially Meets | process | RC.RP-02.d | Recovery actions are performed. | 65% |
| Partially Meets | technical | PR.AA-03.b | Services are authenticated | 65% |
| Partially Meets | hybrid | PR.IR-01.a | Networks and environments are protected from unauthorized logical access and usage | 65% |
| Partially Meets | hybrid | RS.AN-06.a | Actions performed during an investigation are recorded. | 65% |
| Partially Meets | hybrid | RC.RP-05.a | The integrity of restored assets is verified | 60% |
| Partially Meets | hybrid | RS.MA-02.a | Incident reports are triaged. | 65% |
| Partially Meets | hybrid | ID.RA-05.a | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk. | 65% |
| Partially Meets | hybrid | ID.IM-02.a | Improvements are identified from security tests and exercises. | 65% |
| Partially Meets | hybrid | PR.AA-05.d | Access permissions, entitlements, and authorizations are reviewed. | 65% |
| Partially Meets | hybrid | RS.MI-02.a | Incidents are eradicated | 65% |
| Partially Meets | process | GV.OV-03.a | Organizational cybersecurity risk management performance is evaluated. | 65% |
| Partially Meets | hybrid | ID.AM-08.e | Data is managed throughout their life cycles | 65% |
| Partially Meets | hybrid | PR.AA-05.e | Access permissions, entitlements, and authorizations incorporate the principles of least privilege. | 65% |
| Partially Meets | hybrid | ID.RA-01.c | Vulnerabilities in assets are recorded. | 65% |
| Partially Meets | process | GV.PO-02.b | Policy for managing cybersecurity risks is updated. | 65% |
| Partially Meets | hybrid | RS.CO-02.a | Internal and external stakeholders are notified of incidents | 65% |
| Partially Meets | hybrid | PR.DS-02.c | The availability of data-in-transit are protected | 65% |
| Partially Meets | process | PR.AA-05.a | Access permissions, entitlements, and authorizations are defined in a policy. | 65% |
| Partially Meets | process | ID.IM-04.b | Incident response plans are communicated. | 57% |
| Partially Meets | process | GV.OV-03.b | Organizational cybersecurity risk management performance is reviewed for adjustments needed. | 65% |
| Partially Meets | hybrid | PR.DS-11.b | Backups of data are protected. | 65% |
| Partially Meets | process | GV.OC-03.d | Privacy obligations regarding cybersecurity are understood and managed | 56% |
| Partially Meets | process | RC.RP-02.b | Recovery actions are scoped. | 65% |
| Partially Meets | process | GV.OV-01.a | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | 65% |
| Partially Meets | hybrid | RS.MA-02.b | Incident reports are validated. | 65% |
| Partially Meets | hybrid | RS.MA-03.a | Incidents are categorized. | 65% |
| Partially Meets | hybrid | PR.AA-01.b | Identities and credentials for authorized services are managed by the organization | 65% |
| Partially Meets | hybrid | DE.CM-06.a | External service provider activities and services are monitored to find potentially adverse events | 65% |
| Partially Meets | hybrid | RS.AN-06.b | The records' integrity is preserved. | 65% |
| Partially Meets | hybrid | ID.RA-01.a | Vulnerabilities in assets are identified. | 65% |
| Partially Meets | technical | PR.AA-03.a | Users are authenticated | 65% |
| Partially Meets | hybrid | DE.CM-09.a | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events. | 65% |
| Does Not Meet | hybrid | ID.AM-08.b | Hardware is managed throughout their life cycles | 65% |
| Does Not Meet | process | GV.OC-02.a | Internal and external stakeholders are understood. | 65% |
| Does Not Meet | hybrid | PR.DS-11.c | Backups of data are maintained. | 65% |
| Does Not Meet | process | GV.PO-02.a | Policy for managing cybersecurity risks is reviewed. | 65% |
| Does Not Meet | hybrid | PR.DS-11.a | Backups of data are created. | 65% |
| Does Not Meet | technical | PR.AA-03.c | Hardware are authenticated | 65% |
| Does Not Meet | process | GV.PO-01.b | The policy for managing cybersecurity risks is communicated. | 65% |
| Partially Meets | process | ID.AM-08.d | Services are managed throughout their life cycles | 63% |
| Partially Meets | hybrid | PR.DS-02.a | The confidentiality of data-in-transit are protected | 65% |
| Partially Meets | process | RC.RP-02.c | Recovery actions are prioritized. | 65% |
| Partially Meets | hybrid | PR.AA-05.b | Access permissions, entitlements, and authorizations are managed. | 65% |
| Partially Meets | hybrid | ID.RA-01.b | Vulnerabilities in assets are validated. | 65% |
| Partially Meets | technical | RS.AN-07.b | The integrity of incident data and metadata is preserved. | 65% |
| Partially Meets | process | ID.IM-01.a | Improvements are identified from evaluations | 65% |
| Partially Meets | process | GV.OC-03.b | Privacy obligations are understood and managed | 58% |
| Partially Meets | process | RC.CO-04.a | Public updates on incident recovery are shared using approved methods and messaging | 65% |
| Partially Meets | hybrid | RS.MA-04.a | Incidents are escalated or elevated as needed | 65% |
| Partially Meets | technical | RS.AN-07.c | The provenance of incident data and metadata is preserved. | 65% |
| Partially Meets | technical | PR.AA-05.c | Access permissions, entitlements, and authorizations are enforced. | 65% |
| Partially Meets | hybrid | RS.AN-03.a | Analysis is performed to establish what has taken place during an incident. | 65% |
| Partially Meets | hybrid | PR.DS-01.c | The availability of data-at-rest are protected | 65% |
| Does Not Meet | hybrid | PR.DS-11.d | Backups of data are tested. | 59% |