NIS2 Article 21 → Microsoft 365, complete implementation mapping

You need written policies that document how you identify, assess, and handle cyber risks. It's not enough to say *"we take security seriously"*, you need concrete documents that are updated regularly and approved by leadership.

• •Go to Microsoft 365 Defender → Secure Score and baseline your current score
• •Open Purview Compliance Manager and start a NIS2 assessment (or use IT-grundbeskyttelse as a proxy)
• •Export the Compliance Manager report monthly as documentation
• •Document your own policies (in SharePoint or an external tool)

You need to be able to detect, log, investigate, and report cyber incidents. NIS2 requires an early warning within 24 hours and a formal report within 72 hours for serious incidents. That presupposes you can actually see what's happening in your environment, and that you have a team or partner that responds.

• •Enable Defender for Business (BP) or Defender XDR (E5) as primary detection
• •Configure automated response rules in Defender for known threats
• •Create an incident response playbook (written who-does-what procedure)
• •Test the playbook with tabletop exercises at least every six months
• •Set up 24/7 on-call or an MDR partner if you don't have your own SOC

You need to be able to keep the business running after an incident. That means tested backups, documented recovery times (RTO/RPO), and a crisis response plan. Built-in Microsoft 365 retention is NOT backup, it's versioning. Real backup requires Microsoft 365 Backup (add-on) or a third-party solution.

• •Configure retention policies in Purview for Exchange, SharePoint, and OneDrive
• •Assess whether you need to buy the Microsoft 365 Backup add-on (ransomware rollback)
• •Document RTO/RPO per system
• •Write a crisis response plan with contact list and escalation steps
• •Test recovery at least every six months (tabletop or live)

You need to manage the security of your suppliers, not just keep them on a list. That means contracts with security clauses, periodic assessments, and B2B access management. You're someone else's supplier too, so this documentation will be required FROM you by larger customers.

• •Create CA policies for external guests (require MFA, managed devices only)
• •Implement a supplier onboarding process with a security questionnaire
• •Use Information Barriers to separate data groups if you have competing customers
• •Maintain a supplier register with risk rating
• •Get contract clauses that require NIS2-equivalent security

The most "edge case" control for typical SMBs. If you do NOT develop software, the requirement is mainly patch management and a simple procurement checklist. If you do, it becomes enterprise territory with SAST/DAST, signed code, and secret scanning.

• •Patch management: configure Intune Update Rings for Windows and Office
• •Procurement checklist: simple template, does the supplier require MFA? CMMC? ISO 27001?
• •If you develop: Defender for Cloud DevOps integration + signed commits + Dependabot/Snyk
• •Vulnerability disclosure: publish a security.txt file on your domain with a contact email

You need to regularly assess whether your security measures actually work. It's not enough to have policies, you need to measure. Compliance Manager assessments or an annual security audit covers the requirement. Plus meeting minutes with action items and follow-through.

• •Run an annual Compliance Manager assessment against NIS2 (or IT-grundbeskyttelse)
• •Configure Audit Premium (E5 or Purview Suite) if you have legal retention requirements
• •Hold quarterly security reviews with leadership
• •Get an external audit at least every other year

Employees need regular training, phishing, password hygiene, how to report a suspicious email. Best practice is quarterly simulations and annual formal training. Completion tracking per employee must be available for inspection.

• •Configure Attack Simulator with quarterly phishing campaigns
• •Set up training campaigns for employees who fall for simulations
• •Require annual formal awareness training (internal or external provider)
• •Track completion per employee and document it

Data must be encrypted both in transit and at rest. Microsoft 365 has this by default for cloud services, but endpoints require BitLocker (Windows Enterprise via E3+). Plus key management, for an SMB, Microsoft-managed keys are normally sufficient.

• •Enable BitLocker via Intune device configuration profile
• •Create Sensitivity Labels for classification (Confidential, Internal, Public)
• •Configure auto-labelling for sensitive data (requires E5 or Purview Suite)
• •Enable Message Encryption for external email traffic
• •Write an encryption policy with key management

The entire employee lifecycle: hiring → access → changes → termination. Plus device and data management. Least privilege, joiner-mover-leaver processes, and regular access reviews. Intune gives you visibility into which devices exist and who has them.

• •Document joiner-mover-leaver processes in writing
• •Configure Access Reviews (quarterly for privileged roles, half-yearly for the rest)
• •Use Entitlement Management for access to resource packages
• •Use Intune for central device registration and remote wipe on offboarding
• •Privileged Identity Management (PIM) for admin roles, just-in-time access only

MFA is no longer optional, supervisors ask about it first. Plus encrypted communications (Teams does it by default), and a plan for how you communicate if the primary system is down. Conditional Access provides granular MFA enforcement, for example only from unfamiliar locations or new devices.

• •Require MFA on all accounts, including service accounts where possible
• •Configure CA policies: MFA from unfamiliar locations, block sign-in from high-risk countries, require compliant device for admin portals
• •Turn legacy auth off (Basic Auth in Exchange)
• •Implement passkeys or FIDO2 for privileged accounts
• •Emergency communications: document a backup channel if Teams is down (e.g. Signal, phone tree)