What is Compliance Manager? Compliance Manager in Microsoft Purview. A standard such as ISO/IEC 27001 says what to achieve, not how. Compliance Manager turns a regulation into an assessment, where each control points to improvement actions in Microsoft 365. Microsoft actions are implemented by Microsoft, your improvement actions are yours. The compliance score shows progress, weighted by risk: preventive mandatory actions give 27 points. Compliance score is not Secure Score. W COMPLIANCE MANAGER What is Compliance Manager? Ada Admin Eli Employee WHY COMPLIANCE MANAGER Requirements you must meet, and prove Laws and standards your organization must follow set requirements. You have to meet them, and document that you do. But which settings in Microsoft 365 does a requirement take? Someone has to translate the requirement into configuration. Compliance Manager breaks requirements down into improvement actions. FROM REQUIREMENT TO ACTION Take ISO/IEC 27001 as an example THE STANDARD: ISO/IEC 27001:2022 CONTROLS IN COMPLIANCE MANAGER IMPROVEMENT ACTIONS One action can also support controls in other regulations. Related controls shows them all. SHARED RESPONSIBILITY Some improvement actions are done by Microsoft Microsoft actions Improvement actions Microsoft hasimplemented and tested in its own cloud.You can read the results, not change them. Your improvement actions Settings, documents and routines inyour organization. You implement them,and someone verifies. ISO 27001:2022, AN EXAMPLE TENANT Microsoft actions146 of 148 Your improvement actions13 of 110 Microsoft completes its own actions. The 97 open improvement actions are yours. WHAT IT'S USED FOR Three standards, three laws Microsoft Purview Related solutions Data Security InvestigationsData Lifecycle ManagementData Loss Prevention Assessments Free regulation licenses used0/0 Purchased regulation licenses used3/3 + Add assessmentExport actionsUpdate actions5 items AssessmentStatusProgressYour improvement actionsMicrosoft actionsRegulation Overview Compliance Manager measures your progress in completing actions that help reduce risks around data protection and regulatory standards. Overall compliance score Your compliance score: 60% 14070.84/23374 points achieved Your points achieved1,550.84/ 10,761 Microsoft managed points achieved12,520/ 12,613 Rule of thumb: aim for at least 75% Key improvement actions Not completed527 Completed62 Out of scope0 Improvement actionImpactTest statusAction type Improvement actions Improvement actions provide guidance on task completion which can improve your org's compliance score. Action points can take up to 24 hours to update. Export actionsUpdate actionsAccept all updatesAssign to user96 items Regulations: ISO/IEC 27001:2022 × Test Status: Any Testing type: Any Service: Any Improvement actionPointsRegulationsAssessmentsTest status 54 = 27 points in each of 2 assessments 81 = 27 points × 3 assessments, not done TWO WAYS TO WORK One regulation, or all of them PER REGULATION Assessments Open one assessment, for example GDPR.You see its score, its controls and theimprovement actions for that regulation. ACROSS ALL Overview and Improvement actions One overall score and one list ofimprovement actions for every regulationyou have added. Filter when you need to. Work on one regulation in its assessment. Follow up the whole picture in Overview. HOW POINTS ARE SET Risk decides the points MANDATORYDISCRETIONARY Can't be bypassedDepends on users following policy An action that is part of several assessments counts in each of them. Start with what gives the most points: preventive, mandatory actions. COMPLIANCE SCORE OR SECURE SCORE? Two scores, two questions COMPLIANCE SCORESECURE SCORE Some technical actions are tested automatically, with signals from Secure Score among others. Good to know 1/7 COMPLIANCE MANAGER What is Compliance Manager? What Compliance Manager is, how a requirement in a standard becomes an action in Microsoft 365, what it's used for, and what the compliance score actually measures. informasjonsbeskyttelse.no