Security checks and framework mapping

TenantVigil's control catalogue holds 90+ security checks across the Microsoft 365 services an MSP commonly protects. Findings map to 7 framework families: CIS Microsoft 365 Benchmark, CISA SCuBA, SOC 2, ISO 27001, HIPAA, NIS2, GDPR.

A mapping is not a certification. It helps you remediate one control and see the overlapping framework references at the same time.

A TenantVigil score is a normalized health index, not a raw control count. Pass, fail, warning, and non-applicable states are treated differently so the score reflects the weighted condition of the tenant rather than just the number of controls in the library.

The Core Security Posture Score is the severity weight a tenant earns divided by the weight it could earn. A pass earns full weight, a warning earns half, and a failure earns nothing. Checks TenantVigil could not read, or that must be checked by hand, earn nothing and are listed as not checked: they are left out of the score instead of counting as passes or warnings. When no check could be read, the score is shown as Not scored, never as a number.

This means the total controls scanned and the weighted score are related but not identical metrics. The purpose of the control pages and history views is to let technical users inspect the specific evidence behind those higher-level report values.

TenantVigil curates controls around current Microsoft 365 threat areas such as privileged access, phishing resistance, collaboration exposure, device hygiene, data protection, and audit readiness.

Controls are benchmark-driven but also described in plain operational language so teams can connect the technical check to a modern attack or governance failure mode.