CollabDays Bletchley Park 2024 - Compliance Manager

Did you know that with your Microsoft 365 enterprise license, you get a complete Information Security Management System or ISMS? Yes, you do and it's known as Microsoft Purview Compliance Manager.

But the Compliance Manager goes beyond this. As an ISMS you are able to use the Compliance Manager to track your compliance enhancements in your Microsoft 365 environment. This allows you to report on your progress, to external auditors (for example).

The Compliance Manager also offers you insight into standards and regulations, using pre-built assessments. Examples include the GDPR and ISO27001. But the list of assessment templates is huge and (depending on your licensing) you can use them all. Or you can add your own assessment template, to be used in your environment.

The assessment templates and assessments offer you insights into improvement actions, and also the steps Microsoft took to comply. A compliance score shows you directly what to expect from your environment.

In this session, Albert will do a run-through of the Compliance manager. We will look at the built-in assessment templates, create an assessment, and the compliance score. We will also be looking into the creation of your own assessment templates.

1. A hidden gem: Microsoft Purview Compliance Manager Albert Hoitingh

2. Thank you to our sponsors!

3. Albert Hoitingh Principal Consultant Data Security & Compliance @ InSpark The Hague – The Netherlands @alberthoitingh https://alberthoitingh.com https://www.linkedin.com/in/appieh/

4. Microsoft Purview Compliance Manager

5. Microsoft Purview Compliance Manager Take inventory Implement controls and report Multi-cloud Stay current with regulation

6. Licensing All subscriptions: Data Protection Baseline Microsoft 365 E5: Three premium regulations free Premium regulations https://learn.microsoft.com/en-us/purview/compliance-manager-templates-list

7. Permission levels Azure/Entra ID Read only Global Reader | Security Reader Edit data only Compliance Administrator Edit data and create assessments Compliance Administrator Manage all Compliance Administrator Compliance Data Administrator Security Administrator

8. Permission levels Microsoft Purview Read only Compliance Manager Reader Edit data only Compliance Manager Assessor Edit data and create assessments Compliance Manager Contribution Manage all Compliance Manager Administrator Compliance Administrator Specific permissions, per regulation for example

9. Key elements Controls Assessments Regulations Improvement actions Technical Operational Documentation

10. Copilot…. Oh wait….

11. Shared Responsibility

12. Compliance Score Improvement actions Mandatory Discretionary Preventive | Detective | Corrective

13. S coring Preventive Detective Corrective Mandatory Discretionary Points +27 Points +9 Points +1 Points +3 Points +1 Points +3

14. Testing Manual | Automatic Automatic based on settings in Purview (Compliance Administrator) – based on assessment and activated (Defender) services – takes 24 hours Turn on/off per improvement (Compliance Manager Administrator) Modify an improvement action -> automatic testing is turned off

15. Testing

16. Run through DEMO

17. Microsoft Defender for Cloud

18. Multicloud support - regulations Microsoft Azure CIS Microsoft Azure Foundations Benchmark v1.1.0 CIS Microsoft Azure Foundations Benchmark v1.3.0 CIS Microsoft Azure Foundations Benchmark v1.4.0 FedRAMP High FedRAMP Moderate ISO 27001 NIST SP 800-171 Rev.2 NIST SP 800-53 Rev.4 NIST SP 800 53 Rev.5 PCI DSS v4.0 SOC 2 Type 2 SWIFT CSP-CDCF v2022 AWS AWS Foundational Security Best Practices CIS 1.2.0 NIST SP 800 53 Rev.5 PCI DSS 3.2.1 GCP CIS 1.1.0 CIS 1.2.0 ISO 27001 NIST SP 800 53 Rev.5 PCI DSS 3.2.1

19. Multicloud support - connectors https://learn.microsoft.com/en-us/purview/compliance-manager-cloud-settings

20. Run through DEMO

21. Some thoughts To end this session Some regional regulations are not (yet) supported Custom assessments are coming back Automatic testing will take some time Some improvement actions will increase your score, but not your compliance stance

22. Enter the raffle to win prizes! Visit each sponsor Decrypt the Morse code! Provide feedback through the Run.Events app!

23. Thank you to our sponsors!

24. Thank you! Albert Hoitingh