In this module
AD7.8 Mapping Controls to Frameworks
Figure AD7.8 — Your deployed controls map to multiple frameworks simultaneously. One set of controls, one evidence base, multiple framework responses. The mapping table translates your controls into each framework's language.
The universal control mapping table
This table maps your deployed controls to the most common frameworks UK organizations encounter:
| Your Control | Module | ISO 27001 | NIST CSF | GDPR | Regional* |
|---|---|---|---|---|---|
| MFA for all users | AD1 | A.9.4.2 | PR.AC-7 | Art 32(1)(b) | CE: Access Control · E8: MFA |
| Conditional access | AD1 | A.9.4.1 | PR.AC-4 | Art 32(1)(b) | CE: Access Control |
| Break-glass accounts | AD1 | A.9.2.3 | PR.AC-1 | — | — |
| Safe Links / Attachments | AD2 | A.12.2.1 | DE.CM-4 | Art 32(1)(b) | CE: Malware · E8: Email Filter |
| Anti-phishing | AD2 | A.7.2.2 | PR.AT-1 | Art 32(1)(b) | — |
| SPF/DKIM/DMARC | AD2 | A.13.2.3 | PR.DS-2 | — | — |
| Device compliance | AD3 | A.6.2.1 | PR.AC-3 | Art 32(1)(b) | CE: Secure Config |
| BitLocker encryption | AD3 | A.10.1.1 | PR.DS-1 | Art 32(1)(a) | CE: Secure Config |
| Sensitivity labels | AD4 | A.8.2.1 | PR.DS-5 | Art 5(1)(f) | — |
| DLP policies | AD4 | A.18.1.4 | PR.DS-5 | Art 32(1)(b) | — |
| Sharing controls | AD4 | A.13.2.1 | PR.AC-4 | Art 5(1)(f) | — |
| Weekly monitoring | AD5 | A.12.4.1 | DE.CM-1 | Art 32(1)(d) | — |
| IR procedures | AD6 | A.16.1.5 | RS.RP-1 | Art 33 | — |
| Security policies | AD7 | A.5.1.1 | ID.GV-1 | Art 24 | — |
| Quarterly reporting | AD7 | A.18.2.1 | ID.GV-4 | Art 32(1)(d) | — |
*CE = Cyber Essentials (UK), E8 = Essential Eight (AU). Add your regional framework references as applicable.
When you receive a security questionnaire or audit request, use this table to find the framework reference, then point to the evidence from your program summary (AD7.6) and quarterly reports (AD7.5). You don't need to create new evidence — you need to translate existing evidence into the framework's language.
Answering client security questionnaires
The most common audit scenario for SMBs isn't a formal ISO 27001 audit — it's a client sending a security questionnaire with 50-100 questions. These questionnaires ask the same things in different ways. Common questions and your answers:
"Do you use multi-factor authentication?" — "Yes, MFA is required for all users via Microsoft Entra ID conditional access policies (CA001). Approved methods: Microsoft Authenticator app and FIDO2 security keys. Reference: Password and Authentication Policy, Section 3."
"How do you classify and protect sensitive data?" — "We use a four-tier sensitivity label taxonomy (Public, Internal, Confidential, Highly Confidential) implemented through Microsoft Purview sensitivity labels. Confidential and Highly Confidential documents are encrypted and restricted from external sharing. DLP policies detect and block unauthorized sharing of personal and financial data. Reference: Data Classification Policy."
"Do you have an incident response plan?" — "Yes. Our Incident Response Plan defines incident types, severity levels, roles, escalation procedures, and communication obligations. Response procedures are tested quarterly. Reference: Incident Response Plan (AD7.4)."
Each answer references a specific policy or control from your program. A well-documented program turns a 4-hour questionnaire ordeal into a 1-hour exercise of looking up references and pasting answers.
Building a questionnaire response library
After completing 2-3 client questionnaires, you'll notice the same questions repeated. Build a response library: a document containing pre-written answers for the 20 most common questions, each referencing your program documentation.
SECURITY QUESTIONNAIRE RESPONSE LIBRARY
[Organization Name] | Last updated: [Date]
Q: "Do you enforce multi-factor authentication?"
A: "Yes. MFA is required for all users accessing our M365 environment,
enforced through Microsoft Entra ID conditional access policy CA001.
Approved methods: Microsoft Authenticator app and FIDO2 security keys.
Reference: Password and Authentication Policy, Section 3."
Q: "Do you encrypt data at rest?"
A: "Yes. All corporate laptops use BitLocker full-disk encryption,
enforced through Intune compliance policy. Encryption status is
verified before device access to corporate data is granted.
Reference: Security Program Summary, Section 4."
Q: "Do you have an incident response plan?"
A: "Yes. Our Incident Response Plan defines incident types, severity
levels (Critical/High/Medium/Low), roles and responsibilities,
escalation procedures, and communication obligations. Response
procedures are tested quarterly on test accounts. Reference:
Incident Response Plan, Version 1.0."
Q: "How do you protect against phishing?"
A: "Multi-layered email protection through Microsoft Defender for
Office 365: Safe Links (click-time URL scanning), Safe Attachments
(sandboxed attachment analysis), anti-phishing policies (impersonation
protection for VIP users), and SPF/DKIM/DMARC email authentication.
User-reported phishing is triaged weekly. Reference: Security
Program Summary, Section 3."
Q: "Do you conduct security awareness training?"
A: "All employees sign the Acceptable Use Policy which includes
security expectations. Phishing emails reported by users are used
as real-world training opportunities. [If phishing simulation is
deployed]: Regular phishing simulations test user awareness.
Reference: Acceptable Use Policy."Save this as C:\SecurityScripts\QuestionnaireResponses.md. Update it each time you encounter a new question. After 6 months, the library covers 90% of questions you receive — turning a 4-hour questionnaire into a 30-minute copy-paste exercise.
Maintaining the response library over time
After completing each questionnaire, review your answers for reusability. Any answer you wrote from scratch (not from the library) should be added to the library for next time. Tag each response with the framework it was written for — some answers need slight rewording depending on whether the questionnaire uses ISO 27001, NIST CSF, or generic language.
Version the response library alongside your program summary. When you update a control (new CA policy, changed DLP threshold), update the corresponding questionnaire responses. A response that says "we have 3 CA policies" when you now have 4 is a credibility risk if the assessor cross-references your program summary.
Track response metrics: how many questionnaires per year, average completion time, and whether any questionnaire revealed a gap you hadn't documented. After 4 questionnaires, you have enough data to report: "Client security assessments: 4 completed in Q1-Q2, average completion time 75 minutes (down from 4 hours before the response library was established). Zero gaps identified that weren't already documented in the program summary."
ISO 27001 gap analysis — practical approach
If your organization considers ISO 27001 certification, your deployed controls cover approximately 60-70% of Annex A controls. The main gaps for an E3 M365 environment:
A.12.4 — Logging and monitoring. Your AD5 monitoring covers M365 activity but may not cover on-premises systems, network devices, or non-Microsoft applications. ISO 27001 expects comprehensive logging across all systems.
A.12.6 — Technical vulnerability management. Your Intune compliance covers Windows patching, but ISO 27001 expects a formal vulnerability management process covering all systems — including third-party software, servers, network devices, and web applications.
A.14 — System acquisition, development, and maintenance. If your organization develops software, ISO 27001 expects secure development practices, code review, and testing. This is outside the scope of an M365 security program.
A.17 — Business continuity. ISO 27001 expects a business continuity plan covering IT service recovery, backup verification, and disaster recovery testing. Your incident response plan (AD7.4) covers security incidents but not broader business continuity.
For each gap, decide: implement the control (if feasible within your resources), document the gap as a risk acceptance (if the control is disproportionate for your organization size), or defer to a future phase (if ISO 27001 certification is a multi-year goal).
The Ridgeline documentation products at ridgelinecyber.com provide comprehensive ISO 27001 documentation sets — policies, procedures, and evidence templates that extend the four essential policies from this course into a complete ISO 27001-ready governance framework.
Choosing which frameworks to pursue
Not every framework is relevant to your organization. The decision depends on your location, your industry, and your clients' requirements:
ISO 27001 (global): Pursue if clients require it contractually, if you're in a regulated industry, or if you want a comprehensive security management system. Cost: £5,000-15,000+ for certification. Your program covers 60-70% of applicable controls.
Regional baseline certifications: These vary by country but serve the same purpose — demonstrating baseline security. UK: Cyber Essentials (£300-500). AU: Essential Eight maturity assessment (self-assessed or externally validated). US: NIST CSF self-assessment (free) or CMMC certification (for DoD contractors). Your deployed controls address the core requirements of all these frameworks.
GDPR / Privacy compliance: Not a certification but an ongoing obligation for any organization handling personal data of EU/UK residents. Your program addresses key requirements (Article 32 security measures, Article 33 breach notification via the IRP, Article 5 data protection principles via labels and DLP). Equivalent privacy frameworks exist globally: PIPEDA (Canada), Privacy Act (Australia), CCPA (US/California), POPIA (South Africa).
SOC 2: Pursue if you're a SaaS company or service provider whose clients require SOC 2 attestation. Cost: £15,000-40,000+. For most organizations outside the SaaS/service provider space, SOC 2 is unnecessary.
Client questionnaires: The most common assessment for SMBs. Use the questionnaire response library to handle these efficiently. No certification required — demonstrated controls with evidence are usually sufficient.
For most organizations, the practical priority is: regional baseline certification first (low cost, quick to achieve), privacy compliance documentation second (ongoing obligation), and ISO 27001 only if contractually required or strategically advantageous.
A potential client sends a 75-question security questionnaire. Your manager asks you to complete it. You estimate it will take 4 hours. The client expects it back in 5 business days. How do you approach it?
Option A: Answer each question from scratch, researching your configurations for each answer.
Option B: Open the control mapping table and your program summary side-by-side. For each question, identify which control it maps to, find the corresponding section in your program summary, and write a concise answer referencing the policy or control. Most answers can be adapted from the questionnaire response templates above. Target: 60-90 minutes instead of 4 hours — because you're looking up documented answers, not researching configurations.
The correct answer is Option B. The governance documentation you've built (program summary, policies, quarterly reports) is the source material for every questionnaire answer. Without documentation, each questionnaire is a 4-hour research project. With documentation, it's a 60-90 minute lookup exercise. This is one of the tangible ROI benefits of governance documentation — it pays for itself the first time you receive a client questionnaire.
Try it: Complete a practice security questionnaire
Answer these 5 common questionnaire questions using your program documentation:
1. "Do you enforce multi-factor authentication for all users?" (Reference: AD1, CA001) 2. "How do you protect against phishing?" (Reference: AD2, Safe Links/Attachments) 3. "Are devices encrypted?" (Reference: AD3, BitLocker compliance policy) 4. "Do you have a data classification scheme?" (Reference: AD4, sensitivity labels) 5. "Do you have an incident response plan?" (Reference: AD7.4, IRP)
For each answer, write 2-3 sentences referencing the specific control and policy document. Time the exercise — your target is under 15 minutes for all 5. This is the speed you'll achieve with the full 75-question questionnaire once the documentation is in place.
You're reading the free modules of M365 Security: From Admin to Defender
The full course continues with advanced topics, production detection rules, worked investigation scenarios, and deployable artifacts.