Compliance / By country / Cyber Essentials
Cyber Essentials and Cyber Essentials Plus and Microsoft 365
The UK government-backed baseline certification, common in public-sector and supply-chain contracts. Siemserva by Senserva maps 382+ Microsoft 365 and Entra ID checks to the areas Cyber Essentials emphasizes, so a scan of your tenant doubles as evidence.
What Cyber Essentials is
Cyber Essentials is the UK government-backed baseline certification, and a common requirement in public-sector and supply-chain contracts. Its five controls include multi-factor authentication, secure configuration, and access control, which map directly to Microsoft 365 and Entra ID settings.
How Siemserva maps to Cyber Essentials
Cyber Essentials asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:
Multi-factor authentication (42 checks)
Auth User Not MFA RegisteredAuth Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Password Authentication Method In Use But Not Allowed By Senserva Security ManagerAuth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Require Passwordless But Its Not Used By UserAuth Software Oath Authentication Method In Use But Not Allowed By UserConditional Access (60 checks)
Identity and access management (60 checks)
Device compliance (220 checks)
See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.
Cyber Essentials and Microsoft 365: common questions
Does Cyber Essentials apply to Microsoft 365?
Cyber Essentials and Cyber Essentials Plus does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.
How does Siemserva map to Cyber Essentials?
Siemserva runs 382+ Microsoft 365 and Entra ID checks across the areas Cyber Essentials emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.
Is this an official Cyber Essentials certification?
No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.
More: the frameworks crosswalk, Microsoft 365 compliance by country, and the audit evidence guide.