In Compliance Manager, regulatory templates consist of a set of improvement actions derived from the requirements of a law or a standard. Some of these actions must be implemented by the organization itself, while others are already implemented by Microsoft. You can read more about regulatory templates in a separate article.
Although the improvement actions are defined by Microsoft, there may be a need to adjust the wording of certain actions or to add additional ones. With the ability to customize regulatory templates, we can tailor them to our own needs.
Three ways to get a template
This has changed since I first wrote about it, and the change is worth knowing about. You now have three options:
- Customize an existing template. Start from one of Microsoft’s templates and adjust it. This is what the rest of this article covers.
- Upload a regulation as a PDF. Compliance Manager scans the document, extracts the controls and maps them to improvement actions that already exist.
- Start from a blank template. Build the controls and actions yourself, from nothing.
The second and third options matter in Europe, where national legislation routinely goes beyond what the EU directive requires, and no Microsoft template will ever cover it. To use either, you need the Compliance Manager Administration or Compliance Manager Assessor role.
Uploading a regulation as a PDF
From the Regulations page, select Create new template, then Upload PDF document. Give the template a name, optionally enter an overarching regulation name if you want to group several templates under one, select the applicable services, and select Scan and extract.
The system then analyzes the document for malware, extracts the controls it finds, and maps those controls to improvement actions that already exist in Compliance Manager. This takes a few minutes. When it finishes you get a summary: malware found, controls extracted, controls mapped.
Select Review draft template and go through what it produced. Add, remove and edit the controls as needed, then publish. The extraction gets you a long way, but it is a draft, and the review is not optional. A control that was mapped to an improvement action addressing something adjacent but not identical is the failure mode to watch for.
Two requirements on the document itself: it has to be a PDF, and it should be a regulation published by an official regulator or standards body. This is not a tool for turning an internal policy document into a template.
Customizing the NIS2 regulation template
Let’s use the EU NIS2 Directive template as an example of the first approach. Keep in mind that when you customize a template, it is activated and consumes a regulatory license.
Search for the EU NIS2 Directive under Regulations and select Customize regulation. Compliance Manager creates a copy of the template and appends «Extension» to the title. You can change the title before you publish.
Now we can customize.
A particularly important provision in the NIS2 Directive is Article 21, which defines the security requirements organizations must comply with. These requirements represent the core obligations for organizations covered by the directive.
However, when we select this control in the template, we see that it does not have any improvement actions associated with it. This is a problem, as the security requirements in Article 21 should clearly be reflected in the template.
At this point, we have two options. We can either define the security requirements as new controls and then associate relevant improvement actions with each control, or we can add improvement actions directly under the existing control. The latter approach is simpler, so let’s focus on that.
The first requirement in Article 21 is point (a): policies on risk analysis and information system security. If you are familiar with information security management systems, you will recognize this as a requirement for top-level policies that define principles for information security and risk assessment.
We can attempt to reuse existing improvement actions by selecting Import actions and searching for «policy». While several policy-related actions are available, none of them fully address the specific requirement in Article 21. Therefore, we create a new improvement action.
We assign this action 27 points, as it represents a mandatory preventive control. The new improvement action is now part of the customized template. Existing customer-managed actions can be edited or deleted, but Microsoft-implemented actions cannot be modified.
Once we are finished customizing the template, we publish it. Only then can we create an assessment based on it, and that is the point where the improvement actions are instantiated and start contributing to the Compliance Score. Expect the score to drop at that moment, since the newly added improvement actions now have to be implemented and tested.
What you give up
There is a trade-off that is easy to miss until it bites.
When Microsoft updates one of its own templates, assessments built on that template receive the update, and you choose whether to accept it. If you extended a Microsoft template, your assessment inherits those updates too, and keeps the attributes you added.
Custom templates do not work that way. An assessment built on a template you created from scratch receives no template updates from Microsoft. Improvement action updates still arrive, but changes to control mapping do not. In other words, a template you built from a PDF is a snapshot. When the regulation changes, nothing tells you.
A final word of caution
While customizable regulatory templates are a powerful feature, they also introduce a degree of risk if used without sufficient discipline. It can be tempting to simply add new improvement actions to cover perceived gaps, without first reviewing the actions that already exist in the template.
In practice, this often leads to overlapping or duplicated actions that address the same underlying requirement from slightly different angles. Over time, this can make assessments harder to manage, inflate the number of actions to track, and blur the link between regulatory requirements and actual risk reduction.
Before adding new improvement actions, it is therefore important to carefully review the existing ones, understand their intent, and assess whether the requirement can be addressed by refining or extending what is already there. Customization should be used to clarify and strengthen compliance, not to create unnecessary complexity.
