Compliance & Data Protection Architecture

Frameworks covered

SOC 2

Trust Service Criteria

Security, availability, and confidentiality controls mapped to Microsoft 365 configuration. Audit log enablement, access control evidence, and monitoring alignment.

ISO 27001

Information Security Management

Annex A control alignment across identity, data, access, and incident response capabilities within your Microsoft 365 environment.

HIPAA

Healthcare data protection

PHI handling controls, audit logging, access governance, and DLP enforcement for organisations handling healthcare information.

GDPR

EU data protection

Data discovery, classification, subject access request readiness, retention enforcement, and cross-border transfer governance.

PCI DSS

Payment card industry

Cardholder data environment alignment, access restrictions, logging, and monitoring controls within the Microsoft 365 estate.

NIST

Cybersecurity Framework

Identify, Protect, Detect, Respond, Recover function alignment mapped to Microsoft Purview and Defender capabilities.

What this engagement covers

Sensitivity label framework — taxonomy design, auto-classification policies, label publishing

DLP policy design across SharePoint, Exchange, Teams, and endpoint — enforcement without workflow disruption

Retention label and policy governance — regulatory obligation mapping, litigation hold readiness

Insider Risk Management — policy configuration, indicator selection, alert threshold calibration

Compliance Manager assessment and improvement prioritisation — control evidence and remediation actions

Communication compliance configuration where required

eDiscovery readiness — Content Search, Core eDiscovery, Advanced eDiscovery alignment

Audit log configuration — Advanced Audit enablement, log retention, search readiness

SharePoint external sharing governance

When SharePoint external sharing is configured to allow "anyone with the link", files can be accessed by anyone who receives or forwards the link — no Microsoft account required, no login event recorded, no expiry unless manually set. Property documents, client files, and financial records shared this way sit in an uncontrolled state. Most organisations don't know how many of these links exist, who created them, or what they point to. This is a data exposure gap, not just a configuration preference. The fix involves disabling anonymous sharing at tenant level, inventorying existing links, and replacing them with governed guest access where external collaboration is genuinely needed.

Anonymous "anyone with the link" sharing disabled at SharePoint tenant level

Existing anonymous links inventoried using SharePoint admin reporting — scope of current exposure established

External sharing replaced with named guest access — Microsoft account or organisational identity required, expiry enforced

Site-level sharing controls reviewed — overly permissive sites tightened to match data sensitivity

OneDrive external sharing policy aligned to match SharePoint governance baseline

Email authentication — SPF, DKIM, and DMARC

SPF tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain. DKIM cryptographically signs each message so recipients can verify it wasn't tampered with in transit. DMARC ties both together and instructs receiving servers what to do when either check fails — quarantine the message, reject it, or do nothing. Without a published DMARC policy at enforcement, the answer is always "do nothing" — meaning attackers can send convincing phishing emails that appear to originate from your exact domain to your clients, partners, and staff. Recipients have no technical signal that the email is fraudulent. This is particularly damaging for professional services, financial advisory, and client-facing organisations where trust in email communication is foundational.

SPF record audited and corrected — all authorised sending sources included, over-permissive mechanisms removed

DKIM signing enabled across all sending domains including third-party services (CRMs, marketing platforms, helpdesks)

DMARC policy published and progressively enforced — monitoring phase first, then quarantine, then reject

DMARC reporting configured — aggregate and forensic reports delivered to a monitored mailbox

Subdomain policy included — subdomains covered to prevent spoofing via unused or forgotten domain variants

Frameworks covered

What this engagement covers

SharePoint external sharing governance

Email authentication — SPF, DKIM, and DMARC

Align your Microsoft 365 toyour compliance obligations.

Align your Microsoft 365 to
your compliance obligations.