Start with where you are
ISO 27001 often comes up when a customer asks for it, a tender requires it or a business decides to take information security more seriously. The first question is usually: what do we need to do to become compliant?
That is hard to answer without knowing what is already in place. One organisation has sound technical settings but no record that anyone reviews them. Another has well-written policies that do not match how its systems actually work.
If you use Microsoft 365, Microsoft Purview Compliance Manager can help bring those two pictures together.
What Compliance Manager does
Compliance Manager assesses your organisation against regulations and standards using assessment templates. Each assessment breaks requirements into controls and improvement actions. You can assign owners, record progress and store evidence and notes against each action.
It also shows who is responsible for each control: Microsoft, your organisation, or both. That distinction matters. Microsoft looks after its data centres; you decide who can open your files.
Check licensing before you plan around it. Microsoft lists ISO/IEC 27001:2022 as a premium template. Every subscription includes Microsoft's Data Protection Baseline, and E5, A5 and G5 organisations can choose three premium templates at no extra cost. Others may need to purchase the template.
A setting is not a process
A technical setting can support a control. A repeatable, recorded process is what demonstrates it.
Suppose you need to show that staff access is controlled. Microsoft 365 can show that multifactor authentication is enforced and that administrator rights are limited. Then someone leaves, and different questions follow. Our Microsoft 365 offboarding guide covers the handover side of them.
- Who asks for their account to be disabled, and when?
- Who approves access to their mailbox and files?
- Where is the removal recorded?
- Does anyone check that it actually happened?
Build the assessment around your scope
Begin with the standard and scope that matter to your business. For ISO 27001, that means agreeing what your information security management system covers before choosing which assessment to run.
Then work through the controls and actions. Some are Microsoft 365 settings. Others are policies, training records, supplier arrangements and access reviews that no tenant setting can show.
Give each relevant action an owner and keep its evidence current. A screenshot from last year, or a policy nobody follows, tells an auditor very little.
A score is not a certificate
Compliance Manager's score measures your progress through improvement actions. It is useful for tracking work, but it is not an audit. Nobody independent has checked your processes, and the score covers only what the assessment includes.
ISO 27001 certification is awarded by a certification body after auditing your whole management system: its scope, risk assessment, policies, records and continual improvement. Microsoft 365 is one important part of that, not all of it.
Used this way, an assessment often shows that the biggest gaps are ownership, regular review and evidence rather than missing technology. When it does reveal a technical gap, you can address it knowing exactly why it matters.