Compliance Frameworks

Detailed information about the compliance frameworks supported by Securtea

frameworksCISNISTSOC 2ISO 27001

Compliance Frameworks

Securtea supports multiple industry-standard security frameworks. Each framework provides a structured approach to evaluating your Microsoft 365 security posture.

CIS Microsoft 365 Foundations Benchmark

Overview

The Center for Internet Security (CIS) Microsoft 365 Foundations Benchmark is a consensus-driven security configuration guide developed by security experts worldwide.

Themes

The CIS benchmark organizes controls into themes:

Theme	Focus Area
Account & Authentication	Identity protection, MFA, password policies
Application Permissions	OAuth apps, consent policies, API access
Data Management	DLP policies, information protection
Email Security	Anti-phishing, anti-malware, mail flow
Auditing	Logging, monitoring, alerts

Control Examples

Enable MFA for all privileged accounts
Block legacy authentication protocols
Configure anti-phishing policies
Enable audit log search
Restrict external sharing

Version Support

Securtea aligns with the latest CIS benchmark version and updates controls as new versions are released.

CIS provides two profiles: Level 1 (baseline) and Level 2 (defense in depth). Securtea supports both profiles.

NIST 800-53

Overview

NIST Special Publication 800-53 provides a catalog of security and privacy controls for federal information systems. It's widely adopted beyond government organizations.

Control Families

NIST 800-53 organizes controls into families:

Family	Code	Focus
Access Control	AC	Who can access what
Audit & Accountability	AU	Logging and monitoring
Configuration Management	CM	System configurations
Identification & Authentication	IA	Identity verification
Incident Response	IR	Security incident handling
System Protection	SC	Technical safeguards

M365 Mapping

Not all NIST controls apply to Microsoft 365. Securtea maps applicable controls:

AC-2: Account Management → M365 user lifecycle
AC-3: Access Enforcement → Conditional Access policies
AU-2: Audit Events → Unified audit log
IA-2: Identification → MFA configuration

Impact Levels

NIST defines three impact levels:

Level	Requirements
Low	Basic security controls
Moderate	Enhanced security controls
High	Maximum security controls

Securtea assesses against moderate baseline by default.

SOC 2

Overview

SOC 2 (Service Organization Control 2) is an auditing standard developed by AICPA for service providers storing customer data in the cloud.

Trust Services Criteria

SOC 2 evaluates five trust services criteria:

Criteria	Focus
Security	Protection against unauthorized access
Availability	System uptime and accessibility
Processing Integrity	Accurate and authorized processing
Confidentiality	Protection of confidential information
Privacy	Personal information handling