Compliance Frameworks
Regulatory coverage mapping for HIPAA, PCI-DSS, NIST, CMMC, SOC 2
Major frameworks
HIPAA · PCI · NIST · CMMC · more
Higher insurance cost
Without MFA + EDR controls
Avg HIPAA fine
Per breach incident (USD)
SMBs close post-breach
Within 6 months
CIS Controls as the universal compliance foundation
The CIS Controls were designed to be the practitioner's answer to "where do I start?" — and they happen to map directly to the requirements of every major compliance framework. Organisations that implement CIS Controls via Microsoft 365 don't have to start from scratch for HIPAA, PCI-DSS, SOC 2, NIST, or CMMC audits. The controls are already in place.
HIPAA Security Rule
78% CIS overlapUS federal law requiring administrative, physical, and technical safeguards for protected health information (PHI).
Technical Safeguard §164.312(a)(2)(iv)
Encryption of PHI at rest and in transit
Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data....
M365 satisfies via
Technical Safeguard §164.312(d)
Unique user identification and authentication
Use processes and tools to assign and manage authorisation to credentials for user accounts, including admin accounts....
M365 satisfies via
Technical Safeguard §164.312(a)(1)
Access control — minimum necessary access
Use processes and tools to create, assign, manage, and revoke access credentials for user accounts based on least privil...
M365 satisfies via
Technical Safeguard §164.312(b)
Audit controls — hardware, software, and activity logs
Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack....
M365 satisfies via
Technical Safeguard §164.312(e)(1)
Transmission security — protect PHI in transit
Improve protections and detections of threats from email and web vectors — the most common attack delivery mechanisms....
M365 satisfies via
Administrative Safeguard §164.308(a)(5)
Security awareness training for all workforce members
Establish and maintain a security awareness program to influence behaviour among the workforce to be security conscious....
M365 satisfies via
Administrative Safeguard §164.308(a)(6)
Security incident response and reporting procedures
Establish a program to prepare for, detect, contain, and eradicate attacks and recover from them effectively....
M365 satisfies via
The presales message
When a customer says "we need to be HIPAA compliant" or "we're going through a SOC 2 audit," the answer isn't "buy a separate compliance tool." The answer is: "Let's look at which CIS Controls you have implemented in Microsoft 365 — because most of those audit requirements are already covered." Microsoft 365 E5 + Purview Suite addresses 75–89% of the requirements across every major framework shown here.