Data Resilience
Secure data optimisation & proactive backup
Microsoft 365 ships for usability, not security.
Out-of-the-box M365 defaults leave your organisation exposed. Understanding where those gaps are before an attacker finds them, is what this assessment is built to do.
Your defaults are working against you
Default M365 settings prioritise ease of access over security. Legacy authentication, permissive sharing policies, and broad app consent are enabled out of the box and attackers know exactly where to look.
Your EDR can't see inside M365
Endpoint detection tools protect devices. They cannot see identity-layer compromise, OAuth abuse, or cloud policy misconfigurations happening entirely within the Microsoft 365 platform.
.svg)
Compliance obligations require evidence
Whether you're preparing for a Cyber Essentials Plus audit, demonstrating ISO 27001 compliance, or meeting UK GDPR obligations, auditors expect documented evidence of secure configuration.
AI and Copilot raise the stakes
Rolling out Microsoft Copilot on a misconfigured tenant dramatically increases data exposure risk. Permissions and governance gaps that were tolerable before become critical when AI can traverse them at scale.
Step 1 - Connect
We establish a least-privilege, time-limited connection to your M365 tenant. Nothing is installed and you retain full control to revoke access the moment the assessment is complete.
Step 2 - Assess
Your live tenant is measured against the CIS M365 Foundations Benchmark. An internationally recognised standard covering identity, email security, governance, audit logging, and admin controls.
STEP 3 - REPORT
You receive an executive summary alongside a full risk-prioritised report. This is accompanied by clear remediation guidance that you and your team can act on
.png?width=500&height=500&name=Cyber%20Landing%20Page%20Image%20(1).png)
Why CIS Benchmarks rather than Microsoft Secure Score?
Microsoft Secure Score is a useful tool, but it's Microsoft evaluating Microsoft. The scoring model is influenced by factors that may prioritise feature adoption over genuine security improvement.
The CIS Microsoft 365 Foundations Benchmark is independently developed, vendor-neutral, and explicitly aligned to NIST CSF, ISO 27001, and PCI DSS. It tells you what secure looks like by an objective standard — not what Microsoft's roadmap looks like.
What do we receive at the end?
A full report containing an executive summary for board or leadership review, a technical findings register mapped to specific CIS controls, a risk prioritisation matrix, practical remediation guidance for each finding, and a compliance mapping covering Cyber Essentials, ISO 27001, UK GDPR, and NCSC guidance. Celerity's team is also on hand to walk through the findings and help you think through next steps.
Does our M365 licence tier matter?
Yes, and we account for it. The assessment is tailored to the controls available within your specific licence tier. A Business Standard tenant won't be scored against Defender for Office 365 Plan 2 features it doesn't have. The findings reflect what you can realistically address with what you're licensed for.
How does this support a compliance audit?
The report is structured to be directly useful in audit contexts. Every finding is mapped to relevant controls in Cyber Essentials Plus, ISO 27001, UK GDPR, and NCSC's Cloud Security Principles.
It provides documented, technical evidence of due diligence on your most heavily used cloud platform which is something auditors consistently look for and rarely see presented this clearly.
We already use Microsoft Defender, do we need this?
Yes. Defender is a detection and response tool. This assessment evaluates whether the underlying configuration of your M365 environment is sound whether Defender and other controls are properly deployed, correctly configured, and consistently applied.
Many organisations with Defender licences still have significant configuration gaps that those tools cannot compensate for.
What access do you need and how is it controlled?
We require read-only, least-privilege access to your M365 tenant scoped to what's needed for the assessment and time-limited for the duration of the engagement. No agents are installed, no endpoints are accessed, and no configuration changes are made.
You can revoke access at any point, and we'll confirm when it's been removed at the close of the assessment.