ISO 27001 compliance Microsoft 365
Can you prove your controls worked in February, not just this week?
Certification runs on a three-year cycle - a stage 1 and stage 2 audit, then annual surveillance audits, then recertification - and the surveillance question is always the same: show that the controls operated all year, not that they exist this week. 1Security measures the tenant-side Annex A controls continuously - access rights, logging, supplier relationships, label protection - captures a dated snapshot every Monday, and exports a per-framework evidence pack, so the year is already on record when the audit is booked.
The scenario
Certification was the project. Staying certified is the job.
ISO/IEC 27001:2022 asks for a running information security management system, backed by 93 Annex A controls across four themes and a Statement of Applicability that says which ones you claim. Stage 2 checks that the design exists. The annual surveillance audit checks that it operated - and this is where programs bleed, because evidence assembled the week before the audit proves the control existed that week. The auditor asks for March.
Here is the arithmetic that makes the tenant side tractable: across eleven frameworks - ISO/IEC 27001 next to NIS2, GDPR, DORA and the EU AI Act - the obligations collapse into 15 shared requirements, 11 of them measured directly from tenant data and only four attested documents. The Annex A controls that live in Microsoft 365 are exactly the measurable ones: access rights (A.5.18), privileged access (A.8.2), logging and monitoring (A.8.15, A.8.16), supplier and cloud relationships (A.5.19, A.5.23). The incident-management controls A.5.24 to A.5.28 - planning, assessment, response, learning, evidence collection - are evidenced the same way: every detection carries a History & Comments trail written as the work happens and an Incident record generated from it, and the notification log shows alerting operated every week of the year. One fix moves ISO 27001, NIS2 and SOC 2 in the same pass.
And if you are not certified yet, the same evaluation answers the earlier question. Frameworks you have not adopted are measured anyway and shown with their own readiness percentage, so how close the tenant already is to certifiable is visible before anyone commits to the project - with deliberately conservative statuses, because not evaluated never counts as a pass. ISO/IEC 42001, the AI management sibling standard, sits in the same eleven and is scored by the same pass.
The walkthrough
From Statement of Applicability to evidence pack, on screens.
Each beat is a screen with a filter and an artifact at the end, not a workshop.
- 01
Open the ISO 27001 framework view
The Compliance screen scores the tenant against ISO/IEC 27001 control by control, in the order of the standard itself, each citing the shared requirements that satisfy it - with chips like "NIS2 ×2" showing what else a fix moves. The worklist orders every open requirement by how many articles it unlocks, and articles that changed since the last snapshot say what they changed from. Where you know the whole picture differs - devices managed in another tool, say - you record your own assessment with a note, and the measured status stays visible beside it.
- 02
Evidence the supplier controls
A.5.19 and A.5.23 ask how supplier and cloud relationships are governed. The Apps screen lists every OAuth app and integration with publisher, access channel and the admin who consented it. The Domains screen lists every external organisation seen in guests, shared files and mail, with its configured standing next to observed activity and contradictions flagged.
- 03
Answer access and logging from measurement
Open a requirement panel and the verdict comes with its numbers: dormant accounts against the 90-day window for A.5.18, sign-ins outside Conditional Access for A.8.2, log ingestion freshness and open critical anomaly episodes for A.8.15 and A.8.16, restricted files without a protecting label for the data controls. Next-step links land on the screen where each number lives. For A.5.26 to A.5.28, open any episode: the response actions, status changes and comments are already on its History & Comments tab, and the Incident record exports them.
- 04
Hand the auditor a dated year
Snapshots of the whole status document are captured every Monday and on demand, so "show me the state in March" has a real answer instead of a reconstruction. The per-framework evidence pack exports as a dated document and is served over the read-only REST API - the same artifact for the certification body, the internal audit and the board.
The building blocks
One read-only connection. The whole Microsoft 365 stack.
Every block is a screen your team opens on the first day. Each one answers a question about your own tenant that nothing in the admin centres answers today.
Locations
Where every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
Locations
Where every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
What it takes
Business Premium is enough. No agents, no migration, no E5 to start.
1Security reads the tenant you already run, with your own licences and your own permission model, through a read-only consent that takes minutes. There is nothing to install and nothing to migrate: it sits beside Entra, Purview, Defender and your SIEM and answers the questions that sit between them.
Activity history is kept for up to three years in the licence price, on any tier, so an investigation or an audit has the record behind it without a retention add-on.
It is also the cheaper route. Most organisations buy their way to the controls they need with the top Microsoft tier. With 1Security on the standard tier they get there for about a quarter less, with more of the work done, on a licence they already pay for.
- Business Premium is enough
- No E5 requirement
- Read-only consent
- 3 years of logs in the price
- About 25% less than the licence route
- Our cloud, your cloud, on premise
What makes it work
Three parts of the platform behind the ISO 27001 answer.
The same 15 requirements score NIS2, GDPR, DORA and the EU AI Act in the same pass - one fix moves every framework that cites it.
Compliance monitoring
Eleven frameworks measured continuously from tenant data, with snapshots, a worklist and a per-framework evidence pack.
Explore the feature →Security score
Microsoft Secure Score beside the observed score, each control cross-referenced to the ISO 27001 articles it moves - so hardening work and audit evidence are the same list.
Explore the feature →Label coverage
Which restricted files actually carry a protecting sensitivity label - the measured half of the information-protection controls, counted file by file.
Explore the feature →
Microsoft Innovation Alley
Recommended by Microsoft’s own innovation programme.
Microsoft’s Innovation Alley partners with 1Security and recommends it to the ecosystem, which answers the question a security project raises first: whether a vendor can be trusted read-only inside the tenant that holds your data.
Bring it to the steering meeting. It answers the trust question before it is asked.
FAQ
Common questions.
Does this get us ISO 27001 certified?
No - certification is issued by an accredited body after its own audit, and the ISMS covers people and processes beyond any tool. What 1Security does is evidence the Microsoft 365 slice of it continuously: the tenant-side Annex A controls as measured statuses with dated history, which is the material the surveillance audit spends most of its time on.
How much of Annex A does this actually cover?
The controls that are observable in the tenant: access rights, privileged access, logging and monitoring, supplier and cloud relationships, and information protection through labels. Physical controls, HR processes and systems outside Microsoft 365 need their own evidence sources. The evidence pack is honest about what it covers.
How do we evidence A.5.28, collection of evidence?
From the detection itself. Every anomaly or incident is an episode whose drawer holds the attributed activity in the incident window, the indicators drawn from it, the containment actions run through the Action Center and a History & Comments tab with every status change, severity verdict and comment, with who and when. The Report button turns that one detection into an Incident record in PDF, PowerPoint, HTML, CSV or JSON, and the generated report is itself recorded on the tab. The notification log on the Alerting screen adds what was sent, to whom, and what was withheld and why, kept for up to three years.
Do we need E5 licenses for this?
No. The measurement, the retained history and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
We are mid-certification. Is this still useful?
That is the best moment to start. The snapshots begin accumulating the day the tenant is connected, so by the time stage 2 or the first surveillance audit arrives there is a dated record of the controls operating - and the worklist tells you which open gaps close the most articles before the auditor finds them.
What about ISO 42001?
ISO/IEC 42001, the AI management system standard, is one of the eleven frameworks the same evaluation scores - fed by the AI-side requirements like an accountable person per agent and captured agent instructions. If AI governance is on your certification roadmap, the readiness percentage is already on the screen.
The 1Security platform
ISO 27001 Compliance is just the beginning
ISO 27001 Compliance is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Permissions and sharingWho can reach what, through which group, link or guest, and whether anyone meant it. The sharing map every audit asks for.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Walk into the surveillance audit with the year already recorded.
Connect read-only and the ISO 27001 control statuses, the worklist and the first evidence pack land the same day - and every Monday after that adds to the record.
Or keep assembling the binder the week before the audit.