Compliance / Controls

Microsoft 365 compliance controls, mapped to the checks that evidence them

This is a control-by-control reference for Microsoft 365 compliance. A compliance control is a single requirement a framework asks you to meet, for example "restrict privileged access" or "block legacy authentication." This page lists 87 controls, 35 from the Microsoft Cloud Security Benchmark (MCSB) and 52 from the CISA SCuBA baselines, and maps each one to the exact Senserva security checks that prove it is met in your tenant.

Auditors ask "show me the evidence for this control." Frameworks describe controls in the abstract; they do not tell you which Microsoft 365 settings satisfy them. This reference answers it the other way around: pick a control and see the specific checks that evidence it, each with its Severity and remediation. Search or filter the table below, click any control to open it, or jump to a control page for the full list of checks, the plain-language explanation, an AI prompt, and the authoritative source. It is the granular, per-control companion to the frameworks crosswalk (which sizes each framework as a whole) and the checks catalog (which lists all 672 checks).

MCSB and SCuBA are covered today because every Senserva check already carries its exact MCSB control code and SCuBA policy ID. NIST 800-53 and CMMC control pages are next. Senserva is not an auditor and issues no certifications; it provides the configuration evidence, Severity ranking, and remediation that make an audit defensible.

Click any control for its area, example checks, and links.

Looking for a framework overview instead? The compliance frameworks crosswalk sizes every framework next to the checks that evidence it.