Organizations that use Microsoft 365 have access to a wide range of security and compliance services that are highly relevant for an ISO 27001-based Information Security Management System (ISMS). Let’s explore how organizations can use Microsoft Purview to implement security controls defined in the standard.
ISO 27001 requirements
ISO/IEC 27001:2022 is an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System. Organizations seeking certification must comply with all requirements in the standard.
One of these is clause 9.1, Monitoring, measurement, analysis and evaluation. Under this requirement, the organization must determine what needs to be monitored and measured in order to analyze and evaluate the performance and effectiveness of the ISMS. This is often implemented through KPIs presented in an ISMS dashboard or measurement register.
A relevant KPI in this context is Compliance Score. You can read more about Compliance Score in a separate article.
One caveat if you use it as a KPI: the score can move without anyone in your organization doing anything. When Microsoft revises a regulatory template, affected assessments show a pending update, and accepting it changes your score. If you report Compliance Score to management or to an auditor, note the date of the reading and whether any template updates were accepted since the last one. A KPI that moves for reasons outside the ISMS is a KPI that needs a footnote.
| ISO 27001:2022 requirement | Relevant Purview solution |
|---|---|
| 9.1 Monitoring, measurement, analysis and evaluation | Compliance Manager — ISO 27001:2022 regulatory template, Compliance Score, improvement actions |
Security controls in ISO 27001 Annex A
Organizations must also assess the 93 security controls listed in Annex A of ISO 27001. The guidance for these controls is provided in ISO 27002. Each organization must evaluate whether a control is relevant, and if so, implement it. The result must be documented in the Statement of Applicability, which is a core part of the ISMS.
Below is an overview of how Microsoft Purview can support selected controls from Annex A. I have expanded this table considerably from the original version of this article, because Purview has grown and because the first pass covered only the obvious classification and labelling controls.
| Annex A control | Relevant Purview solution |
|---|---|
| 5.9 Inventory of information and other associated assets | Information Protection — Content explorer, Data explorer. eDiscovery — search for stale data and for sensitive data. DSPM — Asset explorer, which lists each asset with its owner, access and classification confidence |
| 5.10 Acceptable use of information and other associated assets | Data Loss Prevention — policy tips that teach at the moment of sending rather than blocking. Insider Risk Management — notice templates |
| 5.12 Classification of information | Information Protection — sensitive information types, including custom ones for your own project names and code words |
| 5.13 Labelling of information | Information Protection — sensitivity labels, label policies that make labelling mandatory, and auto-labelling policies that apply labels to content people missed |
| 5.14 Information transfer | Data Loss Prevention — policies for Exchange, SharePoint, OneDrive and Teams covering email and link sharing |
| 5.15 Access control | Information Protection — site labels controlling who gets into a SharePoint site and how content can be shared, combined with authentication contexts and Conditional Access |
| 5.33 Protection of records | Data Lifecycle Management — retention policies that prevent accidental deletion |
| 5.34 Privacy and protection of PII | Information Protection — sensitive information types for personal data. Microsoft Priva — subject rights requests |
| 5.36 Compliance with policies, rules and standards for information security | Compliance Manager — regulatory templates, assessments to document compliance, Compliance Score to demonstrate it |
| 6.8 Information security event reporting | Insider Risk Management — alerts, triage and cases. Audit — the record behind each event |
| 8.1 User endpoint devices | Endpoint DLP — restrictions on copying to USB devices and uploading to cloud services, on onboarded devices |
| 8.3 Information access restriction | Information Protection — sensitivity labels with encryption, so access follows the content rather than its location |
| 8.10 Information deletion | Data Lifecycle Management — retention and deletion policies. eDiscovery — finding stale data and turning the result into a cleanup list |
| 8.12 Data leakage prevention | Data Loss Prevention — policies that prevent sharing internal or confidential information with external recipients |
| 8.15 Logging | Audit — the unified audit log, searchable and exportable, with retention determined by your licence |
| 8.16 Monitoring activities | Activity explorer and Audit for what happened. Insider Risk Management for behaviour patterns over time rather than single events |
| 8.20 Networks security 8.23 Web filtering |
DSPM for AI — the remediation plan for preventing exfiltration to unsanctioned AI apps creates a DLP policy covering browser and network. Note that the network part requires a SASE or SSE integration. Endpoint DLP also restricts uploads to unsanctioned cloud services from onboarded devices |
| 8.24 Use of cryptography | Information Protection — sensitivity labels with access control, which encrypt the content automatically |
A word on 8.20 and 8.23, because they are the controls people least expect Purview to touch. Purview is not a firewall and will not secure your network infrastructure. What it does cover is the data leaving over the network: uploads to unsanctioned services from managed endpoints, and browsing to generative AI sites. For an organization building a Statement of Applicability, that is a partial answer to those controls, not a complete one, and it should be written up that way.
Microsoft 365 E3 licences provide access to core functionality, but to fully leverage Purview, organizations typically need E5 Compliance or full E5. With E5 Compliance, ISO 27001 is available as a premium regulatory template. DSPM and its AI capabilities require E5, A5, E7 or the Purview Suite.
The ISO 27001 template in Compliance Manager
ISO/IEC 27001:2022 is available as a regulatory template in Compliance Manager. Microsoft has analyzed the standard and broken its requirements and controls down into concrete improvement actions.
The template contains 265 improvement actions in total: 110 that you implement yourself and 155 that Microsoft has already implemented, with 4220 achievable points between them. That covers clauses 4 to 10 and the Annex A controls.
Enabling it gives you a structured set of improvement actions mapped to the standard, and a practical overview of what can be configured in Microsoft 365 to support compliance. Two things to keep in mind as you work with it.
First, the template was last updated on 18 October 2023. The standard it maps to was published in 2022, so the mapping is not stale, but it is Microsoft’s interpretation at a point in time rather than a live reading. Check the Last updated date on the regulation’s details page yourself.
Second, the template is not a Statement of Applicability. Compliance Manager tells you what Microsoft 365 can do for a control; the SoA records your decision about whether that control applies to your organization and how you have addressed it, including everything that happens outside the tenant. The template is useful input to the SoA. It does not replace it, and an auditor will ask for the SoA.
You can read more about regulatory templates in a separate article.
