Multi-Framework Compliance & Kanon Evidence Bridge
Map every Microsoft 365 and Google Workspace posture check directly to CIS Benchmarks, SOC 2 (CC6/CC7), ISO/IEC 27001:2022, NIST CSF 2.0, and NIST SP 800-171, and push signed evidence snapshots into Kanon.
18 Controls
CIS Benchmarks
M365 v3.1 & GWS v1.3
18 Controls
SOC 2 Type II
CC6.1, CC6.2, CC6.3, CC6.6, CC7.2
18 Controls
ISO/IEC 27001:2022
A.5.15, A.8.2, A.8.5, A.8.15
18 Controls
NIST CSF 2.0
PR.AA, PR.DS, DE.CM, GV.SC
18 Controls
NIST SP 800-171
3.1.1, 3.1.5, 3.3.1, 3.5.3
| Check ID | Platform | Control Title | CIS Benchmark | SOC 2 | ISO 27001 | NIST CSF 2.0 |
|---|---|---|---|---|---|---|
| m365-mfa-101 | Microsoft 365 | Require phishing-resistant MFA for all privileged administrator roles | CIS M365 v3.1 5.2.2.1 | CC6.1, CC6.2 | A.8.5, A.5.17 | PR.AA-01, PR.AA-03 |
| m365-mfa-102 | Microsoft 365 | Enforce MFA for 100% of active member and guest users | CIS M365 v3.1 5.2.2.2 | CC6.1 | A.8.5 | PR.AA-03 |
| m365-adm-201 | Microsoft 365 | Keep standing Global Administrators between 2 and 4 accounts | CIS M365 v3.1 1.1.3 | CC6.3 | A.8.2, A.5.15 | PR.AA-05 |
| m365-adm-202 | Microsoft 365 | Ensure Global Administrator accounts are cloud-only (not hybrid synced) | CIS M365 v3.1 1.1.4 | CC6.2, CC6.3 | A.8.2 | PR.AA-05 |
| m365-leg-301 | Microsoft 365 | Block legacy authentication protocols (IMAP, POP3, SMTP Basic, ActiveSync) | CIS M365 v3.1 5.2.2.3 | CC6.1, CC6.6 | A.8.5, A.8.20 | PR.AA-03 |
| m365-mail-401 | Microsoft 365 | Disable automatic external mail forwarding on outbound spam policies and inbox rules | CIS M365 v3.1 2.1.1 | CC6.6, CC6.7 | A.8.12 | PR.DS-05 |
| m365-ext-501 | Microsoft 365 | Restrict SharePoint & OneDrive anonymous "Anyone with the link" sharing | CIS M365 v3.1 7.2.1, CIS M365 v3.1 7.2.3 | CC6.6, CC6.7 | A.5.14, A.8.12 | PR.DS-01, PR.AA-05 |
| m365-ext-502 | Microsoft 365 | Restrict Entra ID guest user invite permissions and directory visibility | CIS M365 v3.1 5.1.6.2 | CC6.1, CC6.3 | A.5.15 | PR.AA-05 |
| m365-oauth-601 | Microsoft 365 | Require administrator consent for third-party OAuth applications requesting high-risk scopes | CIS M365 v3.1 5.1.5.1 | CC6.1, CC6.8 | A.8.26, A.5.23 | PR.AA-05, GV.SC-07 |
| m365-log-701 | Microsoft 365 | Enable Microsoft Purview Unified Audit Log ingestion and mailbox auditing | CIS M365 v3.1 3.1.1, CIS M365 v3.1 6.1.1 | CC7.1, CC7.2 | A.8.15, A.8.16 | DE.CM-01, DE.CM-03 |
| gws-mfa-101 | Google Workspace | Enforce 2-Step Verification (2SV) for all Super Admins with security keys | CIS Google Workspace v1.3 1.1.3 | CC6.1, CC6.2 | A.8.5, A.5.17 | PR.AA-01, PR.AA-03 |
| gws-mfa-102 | Google Workspace | Enforce 2-Step Verification across all organizational units (disallow SMS/Voice) | CIS Google Workspace v1.3 1.1.4, CIS Google Workspace v1.3 1.1.5 | CC6.1 | A.8.5 | PR.AA-03 |
| gws-adm-201 | Google Workspace | Limit Google Workspace Super Admins to between 2 and 4 dedicated accounts | CIS Google Workspace v1.3 1.1.1 | CC6.3 | A.8.2, A.5.15 | PR.AA-05 |
| gws-leg-301 | Google Workspace | Disable Less Secure Apps and restrict IMAP/POP access for end users | CIS Google Workspace v1.3 3.1.1 | CC6.1, CC6.6 | A.8.5 | PR.AA-03 |
| gws-mail-401 | Google Workspace | Disable automatic user-configured external Gmail forwarding | CIS Google Workspace v1.3 3.1.8 | CC6.6, CC6.7 | A.8.12 | PR.DS-05 |
| gws-ext-501 | Google Workspace | Restrict Google Drive default link sharing and disallow public "Anyone with the link" defaults | CIS Google Workspace v1.3 4.1.1, CIS Google Workspace v1.3 4.1.2 | CC6.6, CC6.7 | A.5.14, A.8.12 | PR.DS-01 |
| gws-oauth-601 | Google Workspace | Block unverified third-party OAuth apps from accessing restricted Google Workspace scopes | CIS Google Workspace v1.3 6.1.1 | CC6.1, CC6.8 | A.8.26, A.5.23 | PR.AA-05, GV.SC-07 |
| gws-log-701 | Google Workspace | Enable Google Admin alert rules for Super Admin grants, 2SV changes, and anomalous Drive exports | CIS Google Workspace v1.3 5.1.1, CIS Google Workspace v1.3 5.1.3 | CC7.2, CC7.3 | A.8.15, A.8.16 | DE.AE-02, DE.CM-01 |