A practical checklist for reviewing Microsoft 365 security and compliance readiness across MFA, Conditional Access, guest access, privileged accounts, Secure Score, evidence collection, and ISO 27001 readiness.
Free download
Review the Microsoft 365 controls that often matter during ISO 27001 and SOC 2 readiness work.
This checklist is designed for IT managers, security engineers, and compliance leads who manage Microsoft 365 environments. It is especially useful for teams that are:
ISO 27001 auditors will ask about access controls, authentication, and evidence. This checklist maps directly to the most common M365-related control areas.
Enterprise customers often send security questionnaires. This checklist covers the Microsoft 365 controls that come up most frequently.
Even without an upcoming audit, running through this checklist regularly helps you catch configuration gaps before they become incidents.
The checklist covers six control areas. Each item is a concrete configuration check you can run in your Microsoft 365 admin centre or Entra ID.
IT managers, security engineers, and compliance leads who are responsible for Microsoft 365 security — particularly those preparing for ISO 27001 or SOC 2 audits, or responding to customer security questionnaires.
No. This checklist covers common Microsoft 365 security controls that are relevant to ISO 27001 readiness, but it is not a substitute for a full gap assessment or working with a qualified ISO 27001 consultant and certification body.
At minimum once per quarter, and before any external audit or customer security review. Some items — like Secure Score and access reviews — should be checked monthly.
Yes. Certvik connects to your Microsoft 365 tenant via the Graph API, reads your configuration automatically, and maps the results to ISO 27001 and SOC 2 controls — so you don't need to run through this manually every time.
Yes, the checklist is completely free. Enter your email and the PDF will be sent to your inbox.
Related resources