ISO 27001 compliance Microsoft 365
Can you prove your controls worked in February, not just this week?
Certification runs on a three-year cycle - a stage 1 and stage 2 audit, then annual surveillance audits, then recertification - and the surveillance question is always the same: show that the controls operated all year, not that they exist this week. 1Security measures the tenant-side Annex A controls continuously - access rights, logging, supplier relationships, label protection - captures a dated snapshot every Monday, and exports a per-framework evidence pack, so the year is already on record when the audit is booked.
The scenario
Certification was the project. Staying certified is the job.
ISO/IEC 27001:2022 asks for a running information security management system, backed by 93 Annex A controls across four themes and a Statement of Applicability that says which ones you claim. Stage 2 checks that the design exists. The annual surveillance audit checks that it operated - and this is where programs bleed, because evidence assembled the week before the audit proves the control existed that week. The auditor asks for March.
Here is the arithmetic that makes the tenant side tractable: across eleven frameworks - ISO/IEC 27001 next to NIS2, GDPR, DORA and the EU AI Act - the obligations collapse into 15 shared requirements, 11 of them measured directly from tenant data and only four attested documents. The Annex A controls that live in Microsoft 365 are exactly the measurable ones: access rights (A.5.18), privileged access (A.8.2), logging and monitoring (A.8.15, A.8.16), supplier and cloud relationships (A.5.19, A.5.23). The incident-management controls A.5.24 to A.5.28 - planning, assessment, response, learning, evidence collection - are evidenced the same way: every detection carries a History & Comments trail written as the work happens and an Incident record generated from it, and the notification log shows alerting operated every week of the year. One fix moves ISO 27001, NIS2 and SOC 2 in the same pass.
And if you are not certified yet, the same evaluation answers the earlier question. Frameworks you have not adopted are measured anyway and shown with their own readiness percentage, so how close the tenant already is to certifiable is visible before anyone commits to the project - with deliberately conservative statuses, because not evaluated never counts as a pass. ISO/IEC 42001, the AI management sibling standard, sits in the same eleven and is scored by the same pass.
The walkthrough
From Statement of Applicability to evidence pack, on screens.
Each beat is a screen with a filter and an artifact at the end, not a workshop.
- 01
Open the ISO 27001 framework view
The Compliance screen scores the tenant against ISO/IEC 27001 control by control, in the order of the standard itself, each citing the shared requirements that satisfy it - with chips like "NIS2 ×2" showing what else a fix moves. The worklist orders every open requirement by how many articles it unlocks, and articles that changed since the last snapshot say what they changed from. Where you know the whole picture differs - devices managed in another tool, say - you record your own assessment with a note, and the measured status stays visible beside it.
- 02
Evidence the supplier controls
A.5.19 and A.5.23 ask how supplier and cloud relationships are governed. The Apps screen lists every OAuth app and integration with publisher, access channel and the admin who consented it. The Domains screen lists every external organisation seen in guests, shared files and mail, with its configured standing next to observed activity and contradictions flagged.
- 03
Answer access and logging from measurement
Open a requirement panel and the verdict comes with its numbers: dormant accounts against the 90-day window for A.5.18, sign-ins outside Conditional Access for A.8.2, log ingestion freshness and open critical anomaly episodes for A.8.15 and A.8.16, restricted files without a protecting label for the data controls. Next-step links land on the screen where each number lives. For A.5.26 to A.5.28, open any episode: the response actions, status changes and comments are already on its History & Comments tab, and the Incident record exports them.
- 04
Hand the auditor a dated year
Snapshots of the whole status document are captured every Monday and on demand, so "show me the state in March" has a real answer instead of a reconstruction. The per-framework evidence pack exports as a dated document and is served over the read-only REST API - the same artifact for the certification body, the internal audit and the board.
Строительные блоки
Одно подключение только для чтения. Весь стек Microsoft 365.
Каждый блок - это экран, который ваша команда открывает в первый день. Каждый отвечает на вопрос о собственном тенанте, на который сегодня ничего в центрах администрирования не отвечает.
Местоположения
Откуда на самом деле приходит каждый вход и каждое действие, на карте, по каждому тенанту. Нарушения по местоположению, невозможные перемещения, списки разрешённых по каждому человеку. Работает без премиальных журналов входа.
Местоположения
Откуда на самом деле приходит каждый вход и каждое действие, на карте, по каждому тенанту. Нарушения по местоположению, невозможные перемещения, списки разрешённых по каждому человеку. Работает без премиальных журналов входа.
Что для этого нужно
Business Premium достаточно. Без агентов, без миграции, без E5 для старта.
1Security читает тенант, в котором вы уже работаете, с вашими лицензиями и вашей моделью разрешений, по согласию только на чтение, которое занимает минуты. Нечего устанавливать и нечего мигрировать: он стоит рядом с Entra, Purview, Defender и вашим SIEM и отвечает на вопросы, которые лежат между ними.
История активности хранится до трёх лет в цене лицензии, на любом уровне, так что у расследования или аудита есть запись без дополнения для хранения.
Это ещё и более дешёвый путь. Большинство организаций покупает нужные контроли старшим уровнем Microsoft. С 1Security на стандартном уровне они приходят к тому же примерно на четверть дешевле, с большей частью выполненной работы, на лицензии, за которую уже платят.
- Business Premium достаточно
- Без требования E5
- Согласие только на чтение
- 3 года журналов в цене
- Примерно на 25% дешевле лицензионного пути
- Наше облако, ваше облако, on-premise
What makes it work
Three parts of the platform behind the ISO 27001 answer.
The same 15 requirements score NIS2, GDPR, DORA and the EU AI Act in the same pass - one fix moves every framework that cites it.
Compliance monitoring
Eleven frameworks measured continuously from tenant data, with snapshots, a worklist and a per-framework evidence pack.
Explore the feature →Security score
Microsoft Secure Score beside the observed score, each control cross-referenced to the ISO 27001 articles it moves - so hardening work and audit evidence are the same list.
Explore the feature →Label coverage
Which restricted files actually carry a protecting sensitivity label - the measured half of the information-protection controls, counted file by file.
Explore the feature →
Microsoft Innovation Alley
Рекомендовано собственной инновационной программой Microsoft.
Microsoft Innovation Alley сотрудничает с 1Security и рекомендует его экосистеме, что отвечает на вопрос, который проект по безопасности ставит первым: можно ли доверить вендору доступ только для чтения в тенанте, где лежат ваши данные.
Возьмите это на управляющий комитет. Это отвечает на вопрос о доверии до того, как его зададут.
FAQ
Common questions.
Does this get us ISO 27001 certified?
No - certification is issued by an accredited body after its own audit, and the ISMS covers people and processes beyond any tool. What 1Security does is evidence the Microsoft 365 slice of it continuously: the tenant-side Annex A controls as measured statuses with dated history, which is the material the surveillance audit spends most of its time on.
How much of Annex A does this actually cover?
The controls that are observable in the tenant: access rights, privileged access, logging and monitoring, supplier and cloud relationships, and information protection through labels. Physical controls, HR processes and systems outside Microsoft 365 need their own evidence sources. The evidence pack is honest about what it covers.
How do we evidence A.5.28, collection of evidence?
From the detection itself. Every anomaly or incident is an episode whose drawer holds the attributed activity in the incident window, the indicators drawn from it, the containment actions run through the Action Center and a History & Comments tab with every status change, severity verdict and comment, with who and when. The Report button turns that one detection into an Incident record in PDF, PowerPoint, HTML, CSV or JSON, and the generated report is itself recorded on the tab. The notification log on the Alerting screen adds what was sent, to whom, and what was withheld and why, kept for up to three years.
Do we need E5 licenses for this?
No. The measurement, the retained history and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
We are mid-certification. Is this still useful?
That is the best moment to start. The snapshots begin accumulating the day the tenant is connected, so by the time stage 2 or the first surveillance audit arrives there is a dated record of the controls operating - and the worklist tells you which open gaps close the most articles before the auditor finds them.
What about ISO 42001?
ISO/IEC 42001, the AI management system standard, is one of the eleven frameworks the same evaluation scores - fed by the AI-side requirements like an accountable person per agent and captured agent instructions. If AI governance is on your certification roadmap, the readiness percentage is already on the screen.
Платформа 1Security
Соответствие ISO 27001 — это только начало
Соответствие ISO 27001 — один экран платформы 1Security для Microsoft 365. Локации, устройства, приложения, ИИ-агенты, журналы, разрешения, чувствительные данные, соответствие, отчёты и действия работают на том же подключении только для чтения, на лицензии, которая у вас уже есть.
- Разрешения и общий доступКто до чего может дотянуться, через какую группу, ссылку или гостя, и хотел ли этого кто-нибудь. Карта общего доступа, которую запрашивает каждый аудит.
- Чувствительные данныеПерсональные данные, учётные данные, финансовые и медицинские записи, найденные нашими собственными классификаторами, со вторым мнением Microsoft там, где оно у заказчика есть.
- Метки конфиденциальностиПокрытие метками и пробелы по сайтам и файлам, чтобы защита, за которую заказчик заплатил, действительно применялась.
- Файлы, сайты и колоночный обозревательПросматривайте тенант как файловую систему: сайт, библиотека, папка, файл, с разрешениями и уровнем чувствительности каждого уровня рядом. Проблема, решённая сама по себе.
- Пользователи, группы и жизненный циклНеактивные учётные записи, гости, которые так и не ушли, группы с тройной вложенностью, осиротевшие владельцы, администраторы без MFA. Проверка, которая везде остальном - таблица.
- Внешние доменыКаждая сторонняя организация с точкой опоры в тенанте, её доверительный статус, её дрейф и кто её пригласил.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- Все функцииПосмотреть всё
Walk into the surveillance audit with the year already recorded.
Connect read-only and the ISO 27001 control statuses, the worklist and the first evidence pack land the same day - and every Monday after that adds to the record.
Or keep assembling the binder the week before the audit.