compliance-manager

Name: compliance-manager
Author: vinayaklatthe

161stars34forks

How to install compliance-manager?

vinayaklatthe/microsoft-security-skills/compliance-manager

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill compliance-manager

Installs into the current project.

Summary

Guidance for Microsoft Purview Compliance Manager — continuous compliance posture across Microsoft and non-Microsoft assets, mapped to 360+ regulatory templates (ISO 27001/27018/27701, SOC 2, NIST 800-53/171/CSF, PCI DSS, HIPAA, GDPR, FedRAMP, IRAP, Essential Eight, DORA, EU AI A

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Purview Compliance Manager
2
3	Compliance Manager is a posture and evidence platform. It maps Microsoft cloud controls,
4	your tenant configuration, and your manual evidence to regulatory templates (ISO, NIST,
5	SOC 2, PCI, HIPAA, GDPR, FedRAMP, IRAP, Essential Eight, DORA, EU AI Act, and more), gives
6	you a compliance score, and tracks improvement actions with audit-ready evidence
7	collection.
8
9	## When to use
10	- Authoring or maintaining one or more regulatory assessments.
11	- Producing audit evidence packages (SOC 2, ISO 27001 surveillance audits).
12	- Tracking compliance score over time as a leadership metric.
13	- Mapping a custom internal framework into a Compliance Manager assessment.
14
15	Do not use this skill for Defender for Cloud's regulatory dashboard
16	(`defender-for-cloud-hardening`), Records Management (`purview-records-management`), or
17	M365 Secure Score (general security telemetry).
18
19	## Concept map
20
21	\| Concept \| What it is \|
22	\|---\|---\|
23	\| Template \| A regulation/standard (e.g., "ISO/IEC 27001:2022") \|
24	\| Assessment \| An instance of a template scoped to a product/group (e.g., "M365 ISO 27001") \|
25	\| Improvement action \| A discrete control task (Microsoft-managed or customer-managed) \|
26	\| Microsoft-managed action \| Microsoft maintains; you inherit credit — no work needed \|
27	\| Customer-managed action \| You must implement, document, and provide evidence \|
28	\| Evidence \| Files, links, or automated test results attached to an action \|
29	\| Assessment group \| Logical bundle (e.g., all in-scope assessments for a business unit) \|
30	\| Continuous assessment \| Automatic re-test of supported technical actions \|
31
32	## Approach
33
34	1. Map your obligations to templates first. List the regulations the business is
35	accountable for, then match to Compliance Manager templates. Coverage is broad — but
36	not every internal framework is pre-built. Custom templates fill the gap.
37
38	2. Start with one anchor assessment, not ten. Usually ISO 27001 or NIST CSF, scoped to
39	"Microsoft 365" or "Microsoft 365 + Azure." Demonstrate value before expanding.
40
41	3. Walk Microsoft-managed actions first. They auto-credit. The remaining
42	customer-managed actions are the real work.
43
44	4. For each customer-managed action:
45	- Assign an owner with a due date.
46	- Define implementation status (Not implemented → Partial → Implemented).
47	- Attach evidence (policy doc, screenshot, config export, Defender for Cloud
48	compliance report, audit log query).
49	- For technical actions with automated testing supported, configure the test so it
50	re-runs continuously (M365, Entra, Defender for Cloud).
51
52	5. Assessment grouping. Multi-regulation environments get duplicate control work
53	(NIST AC-2 and ISO 27001 A.9.2 are largely the same). Use shared improvement actions
54	across grouped assessments so a single implementation credits everywhere.
55
56	6. Author custom templates for internal frameworks: build the template via the
57	CSV/Excel import (control ID, family, title, description, test procedure, action
58	type). Useful for industry frameworks not yet in Microsoft's catalog and for an
59	internal compliance overlay.
60
61	7. Evidence repository discipline. Centralize evidence storage (SharePoint folder
62	per assessment). Versioned, dated, owner-tagged. Audit time is not the moment to
63	chase a screenshot from 8 months ago.
64
65	8. Reporting.
66	- Compliance score trend per assessment (monthly to leadership).
67	- Open improvement actions by owner and aging.
68	- Evidence freshness (anything older than 12 months flagged).
69	- Export to PDF/Excel for auditors and GRC tools.
70
71	9. Continuous re-assessment. Schedule a quarterly internal review per assessment.
72	Don't wait for the external audit to discover

People who liked this also viewed

6 picks

Type

compliance-manager

161stars34forks

View on GitHub

How to install compliance-manager?

vinayaklatthe/microsoft-security-skills/compliance-manager

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill compliance-manager

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Purview Compliance Manager
2
3	Compliance Manager is a posture and evidence platform. It maps Microsoft cloud controls,
4	your tenant configuration, and your manual evidence to regulatory templates (ISO, NIST,
5	SOC 2, PCI, HIPAA, GDPR, FedRAMP, IRAP, Essential Eight, DORA, EU AI Act, and more), gives
6	you a compliance score, and tracks improvement actions with audit-ready evidence
7	collection.
8
9	## When to use
10	- Authoring or maintaining one or more regulatory assessments.
11	- Producing audit evidence packages (SOC 2, ISO 27001 surveillance audits).
12	- Tracking compliance score over time as a leadership metric.
13	- Mapping a custom internal framework into a Compliance Manager assessment.
14
15	Do not use this skill for Defender for Cloud's regulatory dashboard
16	(`defender-for-cloud-hardening`), Records Management (`purview-records-management`), or
17	M365 Secure Score (general security telemetry).
18
19	## Concept map
20
21	\| Concept \| What it is \|
22	\|---\|---\|
23	\| Template \| A regulation/standard (e.g., "ISO/IEC 27001:2022") \|
24	\| Assessment \| An instance of a template scoped to a product/group (e.g., "M365 ISO 27001") \|
25	\| Improvement action \| A discrete control task (Microsoft-managed or customer-managed) \|
26	\| Microsoft-managed action \| Microsoft maintains; you inherit credit — no work needed \|
27	\| Customer-managed action \| You must implement, document, and provide evidence \|
28	\| Evidence \| Files, links, or automated test results attached to an action \|
29	\| Assessment group \| Logical bundle (e.g., all in-scope assessments for a business unit) \|
30	\| Continuous assessment \| Automatic re-test of supported technical actions \|
31
32	## Approach
33
34	1. Map your obligations to templates first. List the regulations the business is
35	accountable for, then match to Compliance Manager templates. Coverage is broad — but
36	not every internal framework is pre-built. Custom templates fill the gap.
37
38	2. Start with one anchor assessment, not ten. Usually ISO 27001 or NIST CSF, scoped to
39	"Microsoft 365" or "Microsoft 365 + Azure." Demonstrate value before expanding.
40
41	3. Walk Microsoft-managed actions first. They auto-credit. The remaining
42	customer-managed actions are the real work.
43
44	4. For each customer-managed action:
45	- Assign an owner with a due date.
46	- Define implementation status (Not implemented → Partial → Implemented).
47	- Attach evidence (policy doc, screenshot, config export, Defender for Cloud
48	compliance report, audit log query).
49	- For technical actions with automated testing supported, configure the test so it
50	re-runs continuously (M365, Entra, Defender for Cloud).
51
52	5. Assessment grouping. Multi-regulation environments get duplicate control work
53	(NIST AC-2 and ISO 27001 A.9.2 are largely the same). Use shared improvement actions
54	across grouped assessments so a single implementation credits everywhere.
55
56	6. Author custom templates for internal frameworks: build the template via the
57	CSV/Excel import (control ID, family, title, description, test procedure, action
58	type). Useful for industry frameworks not yet in Microsoft's catalog and for an
59	internal compliance overlay.
60
61	7. Evidence repository discipline. Centralize evidence storage (SharePoint folder
62	per assessment). Versioned, dated, owner-tagged. Audit time is not the moment to
63	chase a screenshot from 8 months ago.
64
65	8. Reporting.
66	- Compliance score trend per assessment (monthly to leadership).
67	- Open improvement actions by owner and aging.
68	- Evidence freshness (anything older than 12 months flagged).
69	- Export to PDF/Excel for auditors and GRC tools.
70
71	9. Continuous re-assessment. Schedule a quarterly internal review per assessment.
72	Don't wait for the external audit to discover

People who liked this also viewed

6 picks

Type