What it covers
Six areas that decide your security posture
Identity & access
MFA, admin protection and Conditional Access.
Devices & endpoints
Managed devices, EDR and patching.
Email & payment fraud
Phishing, impersonation and invoice fraud.
Data & compliance
Data loss prevention and UK GDPR.
Backup & continuity
Independent backup and tested recovery.
Governance & people
Monitoring, incident plans and training.
This is an indicative self-assessment to help you understand your Microsoft 365 security posture — it is not a formal audit or a security certification. For UK businesses, consider Cyber Essentials certification and check what your cyber insurance policy requires.