ITS-M365 0.1.0-draft · 38-check draft subset
Microsoft 365 Security
Scorecard
Connect Microsoft 365 read-only and we verify your real tenant configuration - or self-assess in five minutes. 38 risk-weighted controls, with a directional crosswalk to DORA, NIS2, GDPR and NIST CSF 2.0.
12 of 38 controls auto-verify from your tenant and DNS · the rest are self-attested. Your answers stay in your browser.
Identity & Access7Email Security6Endpoint & Device6Data Protection6Admin & Audit8Backup & Resilience5
Why this scorecard exists
“If your security posture rests on ‘we're too small to be a target,’ we don't have a conversation to have.”
Verified checks read your tenant via read-only Microsoft Graph; self-assessed controls rely on your answers. Both are directional - a full security assessment still requires a practitioner review against the full ITSailor Microsoft 365 Security Baseline manifest.