4 of 26 controls met

ISO/IEC 27001:2022 · 10 not met · 2 partly met · 10 need your evidence · 4 met

19%ready

Tall and orange: not metOrange roof: partly metScaffolding: needs your evidenceLow and pale: met

Annex A controls in scope for a Microsoft 365 estate, plus the management-system clauses an auditor will ask for. Automated requirements are re-assessed on every survey. Attestations need a document or statement from you, are hash-chained into the evidence ledger and expire after 12 months.

Theme	Requirement	Status
Management system	ISMS scope, risk assessment, risk treatment, internal audit and management review (clauses 4-10)	Evidence needed
Management system	Statement of Applicability	Evidence needed
Organizational	Policies for information security	Evidence needed
Organizational	Inventory of information and other associated assets	Evidence needed

4 of 26 controls met

ISO/IEC 27001:2022 · 10 not met · 2 partly met · 10 need your evidence · 4 met

19%ready

Tall and orange: not metOrange roof: partly metScaffolding: needs your evidenceLow and pale: met

Theme	Requirement	Status
Management system	ISMS scope, risk assessment, risk treatment, internal audit and management review (clauses 4-10)	Evidence needed
Management system	Statement of Applicability	Evidence needed
Organizational	Policies for information security	Evidence needed
Organizational	Inventory of information and other associated assets	Evidence needed