1
00:00:00,080 --> 00:00:02,600
There's a question that makes
most companies go quiet, and
2
00:00:02,600 --> 00:00:05,599
it's the one about whether they
are actually compliant.
3
00:00:05,599 --> 00:00:08,480
Compliance manager lives inside
Microsoft purview, and it takes
4
00:00:08,480 --> 00:00:11,080
that messy question and turns it
into a single number.
5
00:00:11,080 --> 00:00:12,240
You can watch move.
6
00:00:12,240 --> 00:00:13,400
You might think a tool like this
7
00:00:13,400 --> 00:00:14,519
is only for compliance officers
8
00:00:14,519 --> 00:00:15,640
with law degrees, but it's built
9
00:00:15,640 --> 00:00:16,920
for the people who do the actual
10
00:00:16,920 --> 00:00:17,239
work.
11
00:00:17,239 --> 00:00:18,280
And there's one thing about that
12
00:00:18,280 --> 00:00:19,600
score that almost everyone gets
13
00:00:19,600 --> 00:00:20,120
wrong.
14
00:00:20,120 --> 00:00:23,359
Welcome to the M365 FM podcast,
where we explore the people,
15
00:00:23,359 --> 00:00:25,960
ideas and technologies shaping
the future of work.
16
00:00:25,960 --> 00:00:27,579
What Compliance Manager is
17
00:00:27,579 --> 00:00:29,039
compliance is one of those words
18
00:00:29,039 --> 00:00:30,399
that makes people's eyes glaze
19
00:00:30,399 --> 00:00:30,760
over.
20
00:00:30,760 --> 00:00:33,200
And the reason is simple it
never lives in one place.
21
00:00:33,200 --> 00:00:34,520
In most companies, it hides in a
22
00:00:34,520 --> 00:00:36,000
dozen spreadsheets, a few email
23
00:00:36,000 --> 00:00:37,560
threads nobody can locate, and a
24
00:00:37,560 --> 00:00:38,640
couple of audits that happen
25
00:00:38,640 --> 00:00:40,240
once a year and then get quietly
26
00:00:40,240 --> 00:00:40,960
forgotten.
27
00:00:40,960 --> 00:00:43,200
So when a leader asks whether
the company is actually
28
00:00:43,200 --> 00:00:45,920
compliant, the honest answer is
usually a shrug.
29
00:00:45,920 --> 00:00:47,280
Microsoft Purview Compliance
30
00:00:47,280 --> 00:00:48,960
Manager exists to fix that exact
31
00:00:48,960 --> 00:00:49,399
problem.
32
00:00:49,399 --> 00:00:50,719
It's a tool inside Microsoft
33
00:00:50,719 --> 00:00:52,000
Purview, which is Microsoft's
34
00:00:52,000 --> 00:00:53,840
home for security data and
35
00:00:53,840 --> 00:00:55,560
compliance work, and it helps an
36
00:00:55,560 --> 00:00:57,359
organization assess and manage
37
00:00:57,359 --> 00:00:58,920
compliance across its cloud
38
00:00:58,920 --> 00:01:00,119
services.
39
00:01:00,119 --> 00:01:01,359
The tool follows the whole
40
00:01:01,359 --> 00:01:03,020
journey rather than one slice of
41
00:01:03,020 --> 00:01:03,420
it.
42
00:01:03,420 --> 00:01:06,159
It helps you take inventory of
your data protection risks,
43
00:01:06,159 --> 00:01:08,620
implement the controls that
reduce them, stay current with
44
00:01:08,620 --> 00:01:11,620
regulations and certifications,
and report back to auditors when
45
00:01:11,620 --> 00:01:12,579
they come knocking.
46
00:01:12,579 --> 00:01:13,780
That range is the point, because
47
00:01:13,780 --> 00:01:15,060
a compliance program that only
48
00:01:15,060 --> 00:01:16,340
handles one of those jobs still
49
00:01:16,340 --> 00:01:17,459
leaves you exposed on the
50
00:01:17,459 --> 00:01:17,980
others.
51
00:01:17,980 --> 00:01:20,299
And it isn't only for big
enterprises with dedicated
52
00:01:20,299 --> 00:01:23,579
compliance teams, because the
same structure scales down to a
53
00:01:23,579 --> 00:01:25,939
small business where one person
wears five hats.
54
00:01:25,939 --> 00:01:26,900
Here's the part that matters
55
00:01:26,900 --> 00:01:28,219
most for a beginner, because it
56
00:01:28,219 --> 00:01:29,819
turns a scary topic into a
57
00:01:29,819 --> 00:01:30,659
manageable one.
58
00:01:30,659 --> 00:01:32,379
The whole tool runs on three
moving parts.
59
00:01:32,379 --> 00:01:33,579
There are assessments which work
60
00:01:33,579 --> 00:01:34,859
like report cards for a single
61
00:01:34,859 --> 00:01:35,459
rule.
62
00:01:35,459 --> 00:01:37,739
There are improvement actions,
which are the to do items that
63
00:01:37,739 --> 00:01:39,500
move those report cards forward.
64
00:01:39,500 --> 00:01:40,819
And there's the compliance
65
00:01:40,819 --> 00:01:42,099
score, which is the single
66
00:01:42,099 --> 00:01:43,079
number that ties everything
67
00:01:43,079 --> 00:01:43,459
together.
68
00:01:43,459 --> 00:01:46,019
Understand those three and the
rest of the interface stops
69
00:01:46,019 --> 00:01:47,099
feeling like a maze.
70
00:01:47,099 --> 00:01:49,620
You can click around without the
sinking feeling that you're
71
00:01:49,620 --> 00:01:51,140
about to break something.
72
00:01:51,140 --> 00:01:54,060
Each action also comes with step
by step guidance written for
73
00:01:54,060 --> 00:01:55,299
people who aren't lawyers.
74
00:01:55,299 --> 00:01:56,900
So the next move is always
obvious.
75
00:01:56,900 --> 00:01:59,459
One more idea before we go
deeper, because it explains why
76
00:01:59,459 --> 00:02:01,140
the tool looks the way it does.
77
00:02:01,140 --> 00:02:04,629
Compliance manager runs on a
shared responsibility model.
78
00:02:04,629 --> 00:02:07,189
Microsoft already implements
part of the work for its own
79
00:02:07,189 --> 00:02:10,110
cloud services, and your
organization handles the rest.
80
00:02:10,110 --> 00:02:12,509
The tool tracks both sides and
gives you credit for the half
81
00:02:12,509 --> 00:02:14,110
Microsoft does on your behalf.
82
00:02:14,110 --> 00:02:15,270
You might assume every ounce of
83
00:02:15,270 --> 00:02:16,870
pressure lands on your team, but
84
00:02:16,870 --> 00:02:18,069
a surprising amount of it was
85
00:02:18,069 --> 00:02:19,110
never yours to carry in the
86
00:02:19,110 --> 00:02:19,949
first place.
87
00:02:19,949 --> 00:02:22,490
That split explains why a
healthy score can show up even
88
00:02:22,490 --> 00:02:25,150
on a quiet week, and why you
should never read it as a full
89
00:02:25,150 --> 00:02:26,229
picture of your own effort.
90
00:02:26,229 --> 00:02:27,469
Keep that in mind because it
91
00:02:27,469 --> 00:02:28,710
explains the number you're about
92
00:02:28,710 --> 00:02:29,550
to meet.
93
00:02:29,550 --> 00:02:30,909
The compliance score.
94
00:02:30,909 --> 00:02:33,229
The compliance score is the
first thing you'll see, and it's
95
00:02:33,229 --> 00:02:35,310
also the thing people
misunderstand the most.
96
00:02:35,310 --> 00:02:36,830
At its core, it's a percentage
97
00:02:36,830 --> 00:02:37,830
and you build it by earning
98
00:02:37,830 --> 00:02:38,469
points.
99
00:02:38,469 --> 00:02:41,110
You earn those points by
completing improvement actions,
100
00:02:41,110 --> 00:02:43,509
and each action carries a set
number of points.
101
00:02:43,509 --> 00:02:45,710
Points from the actions
Microsoft handles count toward
102
00:02:45,710 --> 00:02:46,590
the score two.
103
00:02:46,590 --> 00:02:49,229
So the number reflects the whole
picture rather than just your
104
00:02:49,229 --> 00:02:50,349
side of the work.
105
00:02:50,349 --> 00:02:51,729
That single figure is the tool's
106
00:02:51,729 --> 00:02:52,830
way of answering a question that
107
00:02:52,830 --> 00:02:54,389
used to take weeks of meetings,
108
00:02:54,389 --> 00:02:55,830
and it updates as your
109
00:02:55,830 --> 00:02:56,830
environment changes.
110
00:02:56,830 --> 00:02:59,069
The very first score you see
deserves a closer look because
111
00:02:59,069 --> 00:03:00,389
you haven't done anything yet.
112
00:03:00,389 --> 00:03:01,909
There's already a number on the
screen.
113
00:03:01,909 --> 00:03:03,270
That number comes from a default
114
00:03:03,270 --> 00:03:04,349
assessment called the Data
115
00:03:04,349 --> 00:03:05,900
Protection Baseline, and it's
116
00:03:05,900 --> 00:03:07,129
available at every subscription
117
00:03:07,129 --> 00:03:07,490
level.
118
00:03:07,490 --> 00:03:10,210
It's a set of controls pulled
from standards and rules you'd
119
00:03:10,210 --> 00:03:15,009
recognize by name, including
NIST, ISO, FedRAMP, and GDPR.
120
00:03:15,009 --> 00:03:16,409
Compliance manager reads your
121
00:03:16,409 --> 00:03:17,889
existing Microsoft three hundred
122
00:03:17,889 --> 00:03:19,250
sixty five settings and gives
123
00:03:19,250 --> 00:03:20,530
you a starting point based on
124
00:03:20,530 --> 00:03:22,050
how they look today before
125
00:03:22,050 --> 00:03:23,250
you've configured a single
126
00:03:23,250 --> 00:03:23,729
thing.
127
00:03:23,729 --> 00:03:24,930
Now, not every action carries
128
00:03:24,930 --> 00:03:26,090
the same weight, and that's on
129
00:03:26,090 --> 00:03:26,530
purpose.
130
00:03:26,530 --> 00:03:29,530
The tool weights each action by
the risk it represents, which is
131
00:03:29,530 --> 00:03:32,289
a quiet way of telling you where
your attention pays off most.
132
00:03:32,289 --> 00:03:33,650
A preventative action that stops
133
00:03:33,650 --> 00:03:34,930
a problem before it starts and
134
00:03:34,930 --> 00:03:36,650
that can't be bypassed is worth
135
00:03:36,650 --> 00:03:37,330
the most.
136
00:03:37,330 --> 00:03:38,650
A detective action that only
137
00:03:38,650 --> 00:03:40,030
watches for problems is worth
138
00:03:40,030 --> 00:03:40,770
far less.
139
00:03:40,770 --> 00:03:41,370
In practice.
140
00:03:41,370 --> 00:03:42,530
The highest value action comes
141
00:03:42,530 --> 00:03:43,930
in at twenty seven points, and
142
00:03:43,930 --> 00:03:45,250
the lowest value one lands at a
143
00:03:45,250 --> 00:03:45,969
single point.
144
00:03:45,969 --> 00:03:47,289
That gap between them is the
145
00:03:47,289 --> 00:03:48,810
tool ranking your priorities for
146
00:03:48,810 --> 00:03:50,090
you, so a number you barely
147
00:03:50,090 --> 00:03:51,370
understand still points you in a
148
00:03:51,370 --> 00:03:52,289
useful direction.
149
00:03:52,289 --> 00:03:53,810
Here's a detail that trips
people up.
150
00:03:53,810 --> 00:03:55,530
So let's slow down for a second.
151
00:03:55,530 --> 00:03:57,289
Points are awarded per action
per assessment.
152
00:03:57,289 --> 00:03:59,490
If an action carries ten points
and it shows up in two
153
00:03:59,490 --> 00:04:02,409
assessments, it's worth twenty
points to your overall score.
154
00:04:02,409 --> 00:04:04,849
There's a small exception for
technical actions scoped to your
155
00:04:04,849 --> 00:04:07,639
whole tenant, but the main
takeaway is simple your overall
156
00:04:07,639 --> 00:04:10,629
score isn't just the average of
your assessment scores, because
157
00:04:10,629 --> 00:04:12,629
the same good work can count
more than once.
158
00:04:12,629 --> 00:04:13,310
That's good news.
159
00:04:13,310 --> 00:04:14,669
And it's also why two companies
160
00:04:14,669 --> 00:04:16,430
with identical settings can show
161
00:04:16,430 --> 00:04:17,910
different scores if they track
162
00:04:17,910 --> 00:04:18,709
different numbers of
163
00:04:18,709 --> 00:04:19,509
assessments.
164
00:04:19,509 --> 00:04:20,449
There's one last thing about
165
00:04:20,449 --> 00:04:21,589
timing because it manages
166
00:04:21,589 --> 00:04:22,310
expectations.
167
00:04:22,310 --> 00:04:24,509
The score isn't a live, second
by second readout.
168
00:04:24,509 --> 00:04:25,829
When you change something, your
169
00:04:25,829 --> 00:04:27,110
action status updates on the
170
00:04:27,110 --> 00:04:28,329
dashboard within about twenty
171
00:04:28,329 --> 00:04:29,149
four hours.
172
00:04:29,149 --> 00:04:30,629
So this is a number that moves
173
00:04:30,629 --> 00:04:31,670
in the background while you
174
00:04:31,670 --> 00:04:31,870
work.
175
00:04:31,870 --> 00:04:34,350
And it isn't a slot machine that
lights up the moment you click.
176
00:04:34,350 --> 00:04:35,910
Give it a day before you judge
177
00:04:35,910 --> 00:04:37,110
whether a change actually
178
00:04:37,110 --> 00:04:37,709
landed.
179
00:04:37,709 --> 00:04:39,550
And that brings us to the part
people get wrong.
180
00:04:39,550 --> 00:04:40,709
It isn't the math, it's what
181
00:04:40,709 --> 00:04:41,870
they think the number actually
182
00:04:41,870 --> 00:04:42,670
means.
183
00:04:42,670 --> 00:04:45,430
Hold that thought because we're
coming back to it at the end.
184
00:04:45,430 --> 00:04:46,189
Assessments.
185
00:04:46,189 --> 00:04:47,389
If the score is the headline
186
00:04:47,389 --> 00:04:48,589
assessments are the report cards
187
00:04:48,589 --> 00:04:49,230
behind it.
188
00:04:49,230 --> 00:04:51,550
An assessment gathers the
controls from one specific
189
00:04:51,550 --> 00:04:53,829
regulation standard or policy.
190
00:04:53,829 --> 00:04:56,629
Think of a rule you've heard of
like a data protection law, and
191
00:04:56,629 --> 00:04:59,990
an assessment is the tool's
version of it translated into
192
00:04:59,990 --> 00:05:01,509
checks you can actually act on.
193
00:05:01,509 --> 00:05:04,230
Complete the actions inside an
assessment and you're working
194
00:05:04,230 --> 00:05:05,470
toward meeting that rule.
195
00:05:05,470 --> 00:05:07,670
Each assessment holds a few
things worth knowing.
196
00:05:07,670 --> 00:05:10,399
It lists the services it covers,
which shows whether you're
197
00:05:10,399 --> 00:05:13,240
measuring just Microsoft three
hundred sixty five or a wider
198
00:05:13,240 --> 00:05:15,920
set of cloud services, it
separates the controls Microsoft
199
00:05:15,920 --> 00:05:18,720
manages from the controls you
manage, and it flags the ones
200
00:05:18,720 --> 00:05:21,360
you share, and it carries its
own score, so you can see how
201
00:05:21,360 --> 00:05:24,519
you're doing on that single rule
without squinting at the overall
202
00:05:24,519 --> 00:05:25,920
number at the top of the page.
203
00:05:25,920 --> 00:05:28,879
If one regulation is dragging
you down, that per assessment
204
00:05:28,879 --> 00:05:31,240
score tells you exactly where
the problem lives.
205
00:05:31,240 --> 00:05:32,519
Assessments live inside groups
206
00:05:32,519 --> 00:05:33,399
and groups are really just
207
00:05:33,399 --> 00:05:34,120
folders.
208
00:05:34,120 --> 00:05:36,800
They exist so you can organize
your work in whatever way makes
209
00:05:36,800 --> 00:05:39,839
sense to you, whether that's by
year, by regulation or by team.
210
00:05:39,839 --> 00:05:41,839
A group has to hold at least one
assessment.
211
00:05:41,839 --> 00:05:45,160
Group names have to be unique
and groups can't be deleted.
212
00:05:45,160 --> 00:05:46,439
That last rule is the tool
213
00:05:46,439 --> 00:05:47,439
nudging you to think about
214
00:05:47,439 --> 00:05:48,480
structure before you start
215
00:05:48,480 --> 00:05:49,120
clicking.
216
00:05:49,120 --> 00:05:51,959
And it's the kind of thing
you're glad to know on day one.
217
00:05:51,959 --> 00:05:54,360
Once you add an assessment to a
group, you can't move it.
218
00:05:54,360 --> 00:05:55,720
So pick a simple grouping scheme
219
00:05:55,720 --> 00:05:57,000
early and save yourself the
220
00:05:57,000 --> 00:05:57,600
headache.
221
00:05:57,600 --> 00:06:00,360
Here's where assessments get
really clever and it's the part
222
00:06:00,360 --> 00:06:02,759
that saves actual hours.
223
00:06:02,759 --> 00:06:05,800
One improvement action can serve
several assessments at once.
224
00:06:05,800 --> 00:06:08,600
A technical action, one you
complete by changing a setting
225
00:06:08,600 --> 00:06:12,100
syncs across all your groups, so
doing it once counts everywhere.
226
00:06:12,100 --> 00:06:15,300
A non-technical action, such as
a new policy you draft sinks
227
00:06:15,300 --> 00:06:16,540
within its own group.
228
00:06:16,540 --> 00:06:19,060
You might expect to do the same
work five times for five
229
00:06:19,060 --> 00:06:22,180
different rules, but the tool is
built so that one good decision
230
00:06:22,180 --> 00:06:25,139
can satisfy several requirements
at the same time.
231
00:06:25,139 --> 00:06:27,980
Every assessment also carries a
status, so its place in the
232
00:06:27,980 --> 00:06:29,259
process is never a mystery.
233
00:06:29,259 --> 00:06:30,500
It can read as complete or
234
00:06:30,500 --> 00:06:32,199
incomplete in progress or not
235
00:06:32,199 --> 00:06:33,019
yet started.
236
00:06:33,019 --> 00:06:35,579
And when someone asks for proof,
you can export the whole
237
00:06:35,579 --> 00:06:37,019
assessment as a spreadsheet.
238
00:06:37,019 --> 00:06:38,620
That export is a snapshot of
239
00:06:38,620 --> 00:06:39,939
exactly where things stood on
240
00:06:39,939 --> 00:06:41,139
the day you sent it, which is
241
00:06:41,139 --> 00:06:42,579
precisely what an auditor wants
242
00:06:42,579 --> 00:06:42,899
to see.
243
00:06:42,899 --> 00:06:45,220
It's the difference between
saying you're compliant and
244
00:06:45,220 --> 00:06:47,060
showing the evidence.
245
00:06:47,060 --> 00:06:48,660
Regulations and templates.
246
00:06:48,660 --> 00:06:50,860
Assessments have to come from
somewhere and you don't build
247
00:06:50,860 --> 00:06:52,139
them from a blank page.
248
00:06:52,139 --> 00:06:53,139
That's the whole point.
249
00:06:53,139 --> 00:06:55,740
Compliance manager gives you
regulatory templates, and the
250
00:06:55,740 --> 00:06:57,899
template is a ready made
blueprint for a rule.
251
00:06:57,899 --> 00:06:59,300
It already contains the controls
252
00:06:59,300 --> 00:07:00,579
and the improvement actions
253
00:07:00,579 --> 00:07:01,660
you'd need to satisfy that
254
00:07:01,660 --> 00:07:02,459
regulation.
255
00:07:02,459 --> 00:07:05,339
So you skip the painful work of
mapping a law by hand.
256
00:07:05,339 --> 00:07:06,420
For anyone who has ever tried to
257
00:07:06,420 --> 00:07:07,939
read a regulation called that
258
00:07:07,939 --> 00:07:09,060
alone is worth the price of
259
00:07:09,060 --> 00:07:09,819
admission.
260
00:07:09,819 --> 00:07:13,040
The scale here is worth pausing
on Microsoft ships more than
261
00:07:13,040 --> 00:07:16,160
three hundred and sixty of these
templates covering regulations,
262
00:07:16,160 --> 00:07:18,279
standards, and certifications
from around the world.
263
00:07:18,279 --> 00:07:19,680
If your company operates in
264
00:07:19,680 --> 00:07:20,800
several countries or serves
265
00:07:20,800 --> 00:07:21,959
customers in a regulated
266
00:07:21,959 --> 00:07:23,399
industry, there's a decent
267
00:07:23,399 --> 00:07:24,800
chance the rule that applies to
268
00:07:24,800 --> 00:07:26,000
you already has a template
269
00:07:26,000 --> 00:07:26,600
waiting.
270
00:07:26,600 --> 00:07:27,839
You're choosing from a library,
271
00:07:27,839 --> 00:07:29,160
not writing from scratch, and it
272
00:07:29,160 --> 00:07:30,279
does the mapping work that used
273
00:07:30,279 --> 00:07:31,439
to eat up weeks of someone's
274
00:07:31,439 --> 00:07:32,079
calendar.
275
00:07:32,079 --> 00:07:33,839
Now, not all of them are free.
276
00:07:33,839 --> 00:07:35,399
And this is where honesty helps.
277
00:07:35,399 --> 00:07:36,879
The templates come in two
buckets.
278
00:07:36,879 --> 00:07:39,480
One is the baseline template,
the data protection baseline,
279
00:07:39,480 --> 00:07:42,040
which comes included at every
subscription level so everyone
280
00:07:42,040 --> 00:07:43,240
gets a starting point.
281
00:07:43,240 --> 00:07:46,000
The other bucket holds premium
templates, the global, regional
282
00:07:46,000 --> 00:07:48,240
and industry rules that need a
license to unlock.
283
00:07:48,240 --> 00:07:50,720
Depending on your agreement,
your organization might be able
284
00:07:50,720 --> 00:07:53,480
to use a few premium templates
at no extra cost, and premium
285
00:07:53,480 --> 00:07:56,079
licenses generally last about a
year before they renew.
286
00:07:56,079 --> 00:07:57,720
If your situation is unusual,
287
00:07:57,720 --> 00:07:59,000
you can also build a custom
288
00:07:59,000 --> 00:08:00,259
template from scratch, though
289
00:08:00,259 --> 00:08:01,600
most organizations never need
290
00:08:01,600 --> 00:08:02,160
to.
291
00:08:02,160 --> 00:08:04,600
The practical takeaway is this
you start with a library.
292
00:08:04,600 --> 00:08:07,000
You pick the rule that matters
to you, and the structure is
293
00:08:07,000 --> 00:08:07,959
already built for you.
294
00:08:07,959 --> 00:08:11,040
You're not staring at an empty
spreadsheet trying to remember
295
00:08:11,040 --> 00:08:14,040
what a regulation even requires,
and that changes how quickly you
296
00:08:14,040 --> 00:08:15,170
can get moving.
297
00:08:15,170 --> 00:08:18,089
The hard part shifts from
figuring out the rule to simply
298
00:08:18,089 --> 00:08:20,370
doing the work it asks for.
299
00:08:20,370 --> 00:08:21,649
Improvement actions.
300
00:08:21,649 --> 00:08:24,610
A template gives you the list,
but a list doesn't do the work.
301
00:08:24,610 --> 00:08:27,009
That's where improvement actions
come in, and they're the engine
302
00:08:27,009 --> 00:08:28,089
of the whole tool.
303
00:08:28,089 --> 00:08:29,329
An improvement action is a
304
00:08:29,329 --> 00:08:31,129
single recommended task written
305
00:08:31,129 --> 00:08:32,809
in plain guidance that moves
306
00:08:32,809 --> 00:08:33,250
your score.
307
00:08:33,250 --> 00:08:34,129
When you complete it.
308
00:08:34,129 --> 00:08:36,330
Each one tells you what to do,
points you toward the right
309
00:08:36,330 --> 00:08:38,970
place to do it, and tracks
whether it's done in a field
310
00:08:38,970 --> 00:08:40,250
full of vague advice.
311
00:08:40,250 --> 00:08:42,570
That specificity is what makes
the work possible.
312
00:08:42,570 --> 00:08:43,870
Every action can be assigned to
313
00:08:43,870 --> 00:08:45,529
a person in your organization,
314
00:08:45,529 --> 00:08:46,809
which is what turns a compliance
315
00:08:46,809 --> 00:08:48,049
program into actual work with
316
00:08:48,049 --> 00:08:48,970
names attached.
317
00:08:48,970 --> 00:08:51,590
Once assigned, the owner gets a
notification and a direct link
318
00:08:51,590 --> 00:08:52,450
to the task.
319
00:08:52,450 --> 00:08:54,970
The action itself becomes a
little container for everything
320
00:08:54,970 --> 00:08:56,049
related to that job.
321
00:08:56,049 --> 00:08:57,690
You can store notes, upload
322
00:08:57,690 --> 00:08:58,769
evidence like documents and
323
00:08:58,769 --> 00:09:00,090
screenshots, and record status
324
00:09:00,090 --> 00:09:01,649
updates all in one place so the
325
00:09:01,649 --> 00:09:02,649
proof doesn't get lost in
326
00:09:02,649 --> 00:09:03,929
somebody's inbox.
327
00:09:03,929 --> 00:09:05,250
Improvement actions come in two
328
00:09:05,250 --> 00:09:06,370
flavors, and the difference
329
00:09:06,370 --> 00:09:07,049
matters.
330
00:09:07,049 --> 00:09:08,490
Technical actions are things you
331
00:09:08,490 --> 00:09:10,090
do by changing a setting inside
332
00:09:10,090 --> 00:09:11,570
a tool, like turning on a
333
00:09:11,570 --> 00:09:12,769
security feature.
334
00:09:12,769 --> 00:09:14,210
Non-Technical actions happen
335
00:09:14,210 --> 00:09:15,850
outside the technology and they
336
00:09:15,850 --> 00:09:17,350
split again into documentation
337
00:09:17,350 --> 00:09:18,889
like writing a policy and
338
00:09:18,889 --> 00:09:20,190
operational work, like training
339
00:09:20,190 --> 00:09:20,669
your staff.
340
00:09:20,669 --> 00:09:23,389
You might think compliance is
all paperwork and red tape, but
341
00:09:23,389 --> 00:09:25,909
a large share of these actions
are real technical changes you
342
00:09:25,909 --> 00:09:27,389
can make in an afternoon.
343
00:09:27,389 --> 00:09:28,950
The tool doesn't care who you
are.
344
00:09:28,950 --> 00:09:31,669
It only cares whether the action
is done and tested.
345
00:09:31,669 --> 00:09:34,350
Then there's the question of
testing, which is how the tool
346
00:09:34,350 --> 00:09:36,350
knows an action actually worked.
347
00:09:36,350 --> 00:09:39,509
Some actions you test by hand,
you do the work, record the date
348
00:09:39,509 --> 00:09:40,870
and mark the result.
349
00:09:40,870 --> 00:09:43,470
Many other actions test
themselves because compliance
350
00:09:43,470 --> 00:09:45,710
manager reads signals straight
from your environment.
351
00:09:45,710 --> 00:09:47,629
It pulls those signals from
several sources.
352
00:09:47,629 --> 00:09:49,549
It reads built in signals from
353
00:09:49,549 --> 00:09:50,669
other Microsoft security and
354
00:09:50,669 --> 00:09:51,429
compliance tools.
355
00:09:51,429 --> 00:09:53,710
It checks Microsoft Secure
Score, and it reaches into
356
00:09:53,710 --> 00:09:54,789
defender for cloud to watch.
357
00:09:54,789 --> 00:09:57,149
Azure, Amazon Web Services, and
Google Cloud.
358
00:09:57,149 --> 00:10:00,070
Automatic testing is switched on
by default, and it takes about a
359
00:10:00,070 --> 00:10:01,549
week to fully gather its data.
360
00:10:01,549 --> 00:10:03,590
You don't have to trust your
memory about whether a setting
361
00:10:03,590 --> 00:10:06,110
is still on, because the tool
keeps checking for you.
362
00:10:06,110 --> 00:10:08,789
There's a trade off here, and
it's worth saying out loud.
363
00:10:08,789 --> 00:10:11,710
Automatic testing removes the
pile of repetitive busywork, but
364
00:10:11,710 --> 00:10:12,629
it comes with a catch.
365
00:10:12,629 --> 00:10:15,549
You can't hand edit the status
or the notes on an action that
366
00:10:15,549 --> 00:10:18,960
tests itself because the tool
owns that field, so the choice
367
00:10:18,960 --> 00:10:21,600
between manual and automatic is
really a choice about control.
368
00:10:21,600 --> 00:10:22,879
You trade a little manual effort
369
00:10:22,879 --> 00:10:24,360
for a little more oversight, or
370
00:10:24,360 --> 00:10:25,360
you trade oversight for
371
00:10:25,360 --> 00:10:26,399
convenience.
372
00:10:26,399 --> 00:10:27,279
Who does what.
373
00:10:27,279 --> 00:10:29,759
All of that work needs owners
and owners need permissions.
374
00:10:29,759 --> 00:10:31,639
So let's talk about who gets to
do what.
375
00:10:31,639 --> 00:10:34,460
Compliance manager uses role
based access, which is a fancy
376
00:10:34,460 --> 00:10:37,720
way of saying that only people
you invite can get in, and the
377
00:10:37,720 --> 00:10:40,559
role you give them decides what
they're allowed to touch.
378
00:10:40,559 --> 00:10:41,720
Nothing happens by accident
379
00:10:41,720 --> 00:10:43,080
because access is granted on
380
00:10:43,080 --> 00:10:43,799
purpose.
381
00:10:43,799 --> 00:10:46,639
There are four roles and each
one is easy to picture.
382
00:10:46,639 --> 00:10:47,879
A reader can look at everything
383
00:10:47,879 --> 00:10:49,399
and change nothing, which is
384
00:10:49,399 --> 00:10:50,559
perfect for someone who just
385
00:10:50,559 --> 00:10:51,679
needs visibility.
386
00:10:51,679 --> 00:10:54,480
A contributor can edit data and
create new assessments.
387
00:10:54,480 --> 00:10:56,360
So this is your hands on
builder.
388
00:10:56,360 --> 00:10:59,320
An assessor can also edit data
but can't create assessments
389
00:10:59,320 --> 00:11:02,200
because their job is to check
the work rather than design it.
390
00:11:02,200 --> 00:11:03,360
And an administrator runs the
391
00:11:03,360 --> 00:11:04,480
whole thing managing
392
00:11:04,480 --> 00:11:05,799
assessments, templates, and the
393
00:11:05,799 --> 00:11:06,759
people involved.
394
00:11:06,759 --> 00:11:09,679
Most beginners only ever need to
see the reader view, and that's
395
00:11:09,679 --> 00:11:11,279
a perfectly good place to start.
396
00:11:11,279 --> 00:11:12,159
Here's the part that makes
397
00:11:12,159 --> 00:11:13,240
adoption easier than you'd
398
00:11:13,240 --> 00:11:13,960
expect.
399
00:11:13,960 --> 00:11:16,320
These roles line up with
Microsoft admin roles you may
400
00:11:16,320 --> 00:11:18,740
already have assigned, so the
person who manages your tenant
401
00:11:18,740 --> 00:11:22,019
often slots straight in without
a new identity to remember, and
402
00:11:22,019 --> 00:11:23,220
there's a neat extra layer.
403
00:11:23,220 --> 00:11:24,539
You can give someone a role on
404
00:11:24,539 --> 00:11:25,740
one single assessment so an
405
00:11:25,740 --> 00:11:27,379
outside auditor can see exactly
406
00:11:27,379 --> 00:11:28,539
the report card they need, and
407
00:11:28,539 --> 00:11:29,580
nothing else that keeps
408
00:11:29,580 --> 00:11:30,820
sensitive compliance work in the
409
00:11:30,820 --> 00:11:31,500
right hands.
410
00:11:31,500 --> 00:11:33,259
There's one plain rule to keep
in mind.
411
00:11:33,259 --> 00:11:34,379
A person holds one role at a
412
00:11:34,379 --> 00:11:36,100
time, and changing that role
413
00:11:36,100 --> 00:11:37,899
replaces the old one that keeps
414
00:11:37,899 --> 00:11:38,700
permissions clean.
415
00:11:38,700 --> 00:11:40,100
And it means access is always
416
00:11:40,100 --> 00:11:40,980
deliberate rather than
417
00:11:40,980 --> 00:11:41,779
accidental.
418
00:11:41,779 --> 00:11:44,580
If someone's role changes, their
old abilities disappear at the
419
00:11:44,580 --> 00:11:47,220
same moment, which is exactly
what you want in a tool that
420
00:11:47,220 --> 00:11:48,700
touches sensitive data.
421
00:11:49,740 --> 00:11:51,259
The workflow end to end.
422
00:11:51,259 --> 00:11:52,460
Let's pull all of it together
423
00:11:52,460 --> 00:11:53,580
now, because the pieces make
424
00:11:53,580 --> 00:11:54,940
more sense as one continuous
425
00:11:54,940 --> 00:11:55,419
flow.
426
00:11:55,419 --> 00:11:56,659
Imagine you've just been handed
427
00:11:56,659 --> 00:11:58,179
the keys to Compliance Manager,
428
00:11:58,179 --> 00:11:59,299
and you're logging in for the
429
00:11:59,299 --> 00:12:00,220
first time.
430
00:12:00,220 --> 00:12:02,460
You sign into the Microsoft
Purview Portal and Open
431
00:12:02,460 --> 00:12:05,220
Compliance Manager, and you land
on a dashboard that already
432
00:12:05,220 --> 00:12:06,059
shows a score.
433
00:12:06,059 --> 00:12:07,139
You didn't build anything yet.
434
00:12:07,139 --> 00:12:09,940
And that's fine, because the
baseline assessment has been
435
00:12:09,940 --> 00:12:12,059
quietly reading your Microsoft
three hundred sixty five
436
00:12:12,059 --> 00:12:13,379
settings the whole time.
437
00:12:13,379 --> 00:12:16,440
Your first job is simply to look
at what's already there, and to
438
00:12:16,440 --> 00:12:19,059
notice that the tool has been
working before you arrived.
439
00:12:19,059 --> 00:12:21,679
Next, you pick the regulation
that actually matters to your
440
00:12:21,679 --> 00:12:24,519
organization and spin up an
assessment from a template.
441
00:12:24,519 --> 00:12:26,720
The tool asks you a few
questions like which services
442
00:12:26,720 --> 00:12:29,919
you want to cover, and then it
builds the report card for you.
443
00:12:29,919 --> 00:12:31,440
Now you can see the full list of
444
00:12:31,440 --> 00:12:33,120
actions standing between you and
445
00:12:33,120 --> 00:12:33,720
that rule.
446
00:12:33,720 --> 00:12:34,799
From there, you read through the
447
00:12:34,799 --> 00:12:36,200
improvement actions and assign
448
00:12:36,200 --> 00:12:36,840
owners.
449
00:12:36,840 --> 00:12:38,539
Some tasks belong to it, some to
450
00:12:38,539 --> 00:12:39,879
legal and some to whoever writes
451
00:12:39,879 --> 00:12:40,960
your policies.
452
00:12:40,960 --> 00:12:43,600
The tool sends each owner a link
so nobody has to guess what
453
00:12:43,600 --> 00:12:44,919
they're responsible for.
454
00:12:44,919 --> 00:12:45,759
Then the work begins.
455
00:12:45,759 --> 00:12:47,200
People complete actions, upload
456
00:12:47,200 --> 00:12:48,639
evidence, and mark their status
457
00:12:48,639 --> 00:12:49,600
and the actions that test
458
00:12:49,600 --> 00:12:50,120
themselves.
459
00:12:50,120 --> 00:12:51,840
Credit your score automatically.
460
00:12:51,840 --> 00:12:54,720
As things get done, you move
them from plan to implemented
461
00:12:54,720 --> 00:12:56,799
and from untested to tested.
462
00:12:56,799 --> 00:12:58,179
The score climbs slowly and
463
00:12:58,179 --> 00:12:59,679
honestly, one verified action at
464
00:12:59,679 --> 00:13:00,240
a time.
465
00:13:00,240 --> 00:13:02,600
This is also the moment to set
up alerts if your score ever
466
00:13:02,600 --> 00:13:05,360
drops or an action flips its
status, you hear about it.
467
00:13:05,360 --> 00:13:07,759
Instead of finding out the hard
way during an audit.
468
00:13:07,759 --> 00:13:10,899
Over time, that habit turns
compliance from a yearly panic
469
00:13:10,899 --> 00:13:12,799
into a steady routine.
470
00:13:12,799 --> 00:13:15,600
When leadership or an auditor
wants proof, you export a report
471
00:13:15,600 --> 00:13:16,679
and hand it over.
472
00:13:16,679 --> 00:13:19,279
Then the cycle repeats because
regulations change and your
473
00:13:19,279 --> 00:13:20,720
environment keeps moving.
474
00:13:20,720 --> 00:13:22,120
And through all of it, Microsoft
475
00:13:22,120 --> 00:13:23,690
is quietly completing its own
476
00:13:23,690 --> 00:13:24,570
half of the work in the
477
00:13:24,570 --> 00:13:25,809
background, which is why your
478
00:13:25,809 --> 00:13:27,129
score reflects more than your
479
00:13:27,129 --> 00:13:27,889
team alone.
480
00:13:27,889 --> 00:13:29,090
Your job is the part that's
481
00:13:29,090 --> 00:13:30,529
genuinely yours, and the
482
00:13:30,529 --> 00:13:31,850
dashboard makes sure you can see
483
00:13:31,850 --> 00:13:32,690
it clearly.
484
00:13:32,690 --> 00:13:34,610
There's still that one thing
about the score, though, and
485
00:13:34,610 --> 00:13:36,610
it's time to settle it.
486
00:13:36,610 --> 00:13:38,889
A quick recap and one open
question.
487
00:13:38,889 --> 00:13:40,370
Let's bring it back to the three
parts.
488
00:13:40,370 --> 00:13:41,370
Quick and clean.
489
00:13:41,370 --> 00:13:44,090
The compliance score is your
progress in a single number.
490
00:13:44,090 --> 00:13:45,529
Assessments are the report cards
491
00:13:45,529 --> 00:13:47,049
for each rule, and improvement
492
00:13:47,049 --> 00:13:48,769
actions are the to do list that
493
00:13:48,769 --> 00:13:50,289
moves everything forward with
494
00:13:50,289 --> 00:13:51,330
roles keeping it all under
495
00:13:51,330 --> 00:13:52,049
control.
496
00:13:52,049 --> 00:13:53,490
That's the whole machine and
497
00:13:53,490 --> 00:13:54,610
it's smaller than it looks from
498
00:13:54,610 --> 00:13:55,370
the outside.
499
00:13:55,370 --> 00:13:56,370
Now let's talk about the one
500
00:13:56,370 --> 00:13:57,490
thing people get wrong about
501
00:13:57,490 --> 00:13:58,330
that score.
502
00:13:58,330 --> 00:14:00,809
It isn't a certificate of
compliance, and Microsoft says
503
00:14:00,809 --> 00:14:03,529
so directly the score tracks
your progress on recommended
504
00:14:03,529 --> 00:14:06,370
actions, and it never replaces
your own judgment about whether
505
00:14:06,370 --> 00:14:07,929
a control actually works.
506
00:14:07,929 --> 00:14:10,009
Treat it as a fitness tracker,
not a finish line.
507
00:14:10,009 --> 00:14:12,649
If this made compliance feel a
little less intimidating,
508
00:14:12,649 --> 00:14:16,769
subscribe to M365 FM, where we
master the tools and the mindset
509
00:14:16,769 --> 00:14:18,129
shaping the future of work.
510
00:14:18,129 --> 00:14:19,570
So let me leave you with one
question.
511
00:14:19,570 --> 00:14:21,970
When you picture your own
dashboard, which regulation
512
00:14:21,970 --> 00:14:24,649
shows up first and which single
improvement action would you
513
00:14:24,649 --> 00:14:25,850
start tomorrow morning?
00:00:00,080 --> 00:00:02,600
There's a question that makes
most companies go quiet, and
2
00:00:02,600 --> 00:00:05,599
it's the one about whether they
are actually compliant.
3
00:00:05,599 --> 00:00:08,480
Compliance manager lives inside
Microsoft purview, and it takes
4
00:00:08,480 --> 00:00:11,080
that messy question and turns it
into a single number.
5
00:00:11,080 --> 00:00:12,240
You can watch move.
6
00:00:12,240 --> 00:00:13,400
You might think a tool like this
7
00:00:13,400 --> 00:00:14,519
is only for compliance officers
8
00:00:14,519 --> 00:00:15,640
with law degrees, but it's built
9
00:00:15,640 --> 00:00:16,920
for the people who do the actual
10
00:00:16,920 --> 00:00:17,239
work.
11
00:00:17,239 --> 00:00:18,280
And there's one thing about that
12
00:00:18,280 --> 00:00:19,600
score that almost everyone gets
13
00:00:19,600 --> 00:00:20,120
wrong.
14
00:00:20,120 --> 00:00:23,359
Welcome to the M365 FM podcast,
where we explore the people,
15
00:00:23,359 --> 00:00:25,960
ideas and technologies shaping
the future of work.
16
00:00:25,960 --> 00:00:27,579
What Compliance Manager is
17
00:00:27,579 --> 00:00:29,039
compliance is one of those words
18
00:00:29,039 --> 00:00:30,399
that makes people's eyes glaze
19
00:00:30,399 --> 00:00:30,760
over.
20
00:00:30,760 --> 00:00:33,200
And the reason is simple it
never lives in one place.
21
00:00:33,200 --> 00:00:34,520
In most companies, it hides in a
22
00:00:34,520 --> 00:00:36,000
dozen spreadsheets, a few email
23
00:00:36,000 --> 00:00:37,560
threads nobody can locate, and a
24
00:00:37,560 --> 00:00:38,640
couple of audits that happen
25
00:00:38,640 --> 00:00:40,240
once a year and then get quietly
26
00:00:40,240 --> 00:00:40,960
forgotten.
27
00:00:40,960 --> 00:00:43,200
So when a leader asks whether
the company is actually
28
00:00:43,200 --> 00:00:45,920
compliant, the honest answer is
usually a shrug.
29
00:00:45,920 --> 00:00:47,280
Microsoft Purview Compliance
30
00:00:47,280 --> 00:00:48,960
Manager exists to fix that exact
31
00:00:48,960 --> 00:00:49,399
problem.
32
00:00:49,399 --> 00:00:50,719
It's a tool inside Microsoft
33
00:00:50,719 --> 00:00:52,000
Purview, which is Microsoft's
34
00:00:52,000 --> 00:00:53,840
home for security data and
35
00:00:53,840 --> 00:00:55,560
compliance work, and it helps an
36
00:00:55,560 --> 00:00:57,359
organization assess and manage
37
00:00:57,359 --> 00:00:58,920
compliance across its cloud
38
00:00:58,920 --> 00:01:00,119
services.
39
00:01:00,119 --> 00:01:01,359
The tool follows the whole
40
00:01:01,359 --> 00:01:03,020
journey rather than one slice of
41
00:01:03,020 --> 00:01:03,420
it.
42
00:01:03,420 --> 00:01:06,159
It helps you take inventory of
your data protection risks,
43
00:01:06,159 --> 00:01:08,620
implement the controls that
reduce them, stay current with
44
00:01:08,620 --> 00:01:11,620
regulations and certifications,
and report back to auditors when
45
00:01:11,620 --> 00:01:12,579
they come knocking.
46
00:01:12,579 --> 00:01:13,780
That range is the point, because
47
00:01:13,780 --> 00:01:15,060
a compliance program that only
48
00:01:15,060 --> 00:01:16,340
handles one of those jobs still
49
00:01:16,340 --> 00:01:17,459
leaves you exposed on the
50
00:01:17,459 --> 00:01:17,980
others.
51
00:01:17,980 --> 00:01:20,299
And it isn't only for big
enterprises with dedicated
52
00:01:20,299 --> 00:01:23,579
compliance teams, because the
same structure scales down to a
53
00:01:23,579 --> 00:01:25,939
small business where one person
wears five hats.
54
00:01:25,939 --> 00:01:26,900
Here's the part that matters
55
00:01:26,900 --> 00:01:28,219
most for a beginner, because it
56
00:01:28,219 --> 00:01:29,819
turns a scary topic into a
57
00:01:29,819 --> 00:01:30,659
manageable one.
58
00:01:30,659 --> 00:01:32,379
The whole tool runs on three
moving parts.
59
00:01:32,379 --> 00:01:33,579
There are assessments which work
60
00:01:33,579 --> 00:01:34,859
like report cards for a single
61
00:01:34,859 --> 00:01:35,459
rule.
62
00:01:35,459 --> 00:01:37,739
There are improvement actions,
which are the to do items that
63
00:01:37,739 --> 00:01:39,500
move those report cards forward.
64
00:01:39,500 --> 00:01:40,819
And there's the compliance
65
00:01:40,819 --> 00:01:42,099
score, which is the single
66
00:01:42,099 --> 00:01:43,079
number that ties everything
67
00:01:43,079 --> 00:01:43,459
together.
68
00:01:43,459 --> 00:01:46,019
Understand those three and the
rest of the interface stops
69
00:01:46,019 --> 00:01:47,099
feeling like a maze.
70
00:01:47,099 --> 00:01:49,620
You can click around without the
sinking feeling that you're
71
00:01:49,620 --> 00:01:51,140
about to break something.
72
00:01:51,140 --> 00:01:54,060
Each action also comes with step
by step guidance written for
73
00:01:54,060 --> 00:01:55,299
people who aren't lawyers.
74
00:01:55,299 --> 00:01:56,900
So the next move is always
obvious.
75
00:01:56,900 --> 00:01:59,459
One more idea before we go
deeper, because it explains why
76
00:01:59,459 --> 00:02:01,140
the tool looks the way it does.
77
00:02:01,140 --> 00:02:04,629
Compliance manager runs on a
shared responsibility model.
78
00:02:04,629 --> 00:02:07,189
Microsoft already implements
part of the work for its own
79
00:02:07,189 --> 00:02:10,110
cloud services, and your
organization handles the rest.
80
00:02:10,110 --> 00:02:12,509
The tool tracks both sides and
gives you credit for the half
81
00:02:12,509 --> 00:02:14,110
Microsoft does on your behalf.
82
00:02:14,110 --> 00:02:15,270
You might assume every ounce of
83
00:02:15,270 --> 00:02:16,870
pressure lands on your team, but
84
00:02:16,870 --> 00:02:18,069
a surprising amount of it was
85
00:02:18,069 --> 00:02:19,110
never yours to carry in the
86
00:02:19,110 --> 00:02:19,949
first place.
87
00:02:19,949 --> 00:02:22,490
That split explains why a
healthy score can show up even
88
00:02:22,490 --> 00:02:25,150
on a quiet week, and why you
should never read it as a full
89
00:02:25,150 --> 00:02:26,229
picture of your own effort.
90
00:02:26,229 --> 00:02:27,469
Keep that in mind because it
91
00:02:27,469 --> 00:02:28,710
explains the number you're about
92
00:02:28,710 --> 00:02:29,550
to meet.
93
00:02:29,550 --> 00:02:30,909
The compliance score.
94
00:02:30,909 --> 00:02:33,229
The compliance score is the
first thing you'll see, and it's
95
00:02:33,229 --> 00:02:35,310
also the thing people
misunderstand the most.
96
00:02:35,310 --> 00:02:36,830
At its core, it's a percentage
97
00:02:36,830 --> 00:02:37,830
and you build it by earning
98
00:02:37,830 --> 00:02:38,469
points.
99
00:02:38,469 --> 00:02:41,110
You earn those points by
completing improvement actions,
100
00:02:41,110 --> 00:02:43,509
and each action carries a set
number of points.
101
00:02:43,509 --> 00:02:45,710
Points from the actions
Microsoft handles count toward
102
00:02:45,710 --> 00:02:46,590
the score two.
103
00:02:46,590 --> 00:02:49,229
So the number reflects the whole
picture rather than just your
104
00:02:49,229 --> 00:02:50,349
side of the work.
105
00:02:50,349 --> 00:02:51,729
That single figure is the tool's
106
00:02:51,729 --> 00:02:52,830
way of answering a question that
107
00:02:52,830 --> 00:02:54,389
used to take weeks of meetings,
108
00:02:54,389 --> 00:02:55,830
and it updates as your
109
00:02:55,830 --> 00:02:56,830
environment changes.
110
00:02:56,830 --> 00:02:59,069
The very first score you see
deserves a closer look because
111
00:02:59,069 --> 00:03:00,389
you haven't done anything yet.
112
00:03:00,389 --> 00:03:01,909
There's already a number on the
screen.
113
00:03:01,909 --> 00:03:03,270
That number comes from a default
114
00:03:03,270 --> 00:03:04,349
assessment called the Data
115
00:03:04,349 --> 00:03:05,900
Protection Baseline, and it's
116
00:03:05,900 --> 00:03:07,129
available at every subscription
117
00:03:07,129 --> 00:03:07,490
level.
118
00:03:07,490 --> 00:03:10,210
It's a set of controls pulled
from standards and rules you'd
119
00:03:10,210 --> 00:03:15,009
recognize by name, including
NIST, ISO, FedRAMP, and GDPR.
120
00:03:15,009 --> 00:03:16,409
Compliance manager reads your
121
00:03:16,409 --> 00:03:17,889
existing Microsoft three hundred
122
00:03:17,889 --> 00:03:19,250
sixty five settings and gives
123
00:03:19,250 --> 00:03:20,530
you a starting point based on
124
00:03:20,530 --> 00:03:22,050
how they look today before
125
00:03:22,050 --> 00:03:23,250
you've configured a single
126
00:03:23,250 --> 00:03:23,729
thing.
127
00:03:23,729 --> 00:03:24,930
Now, not every action carries
128
00:03:24,930 --> 00:03:26,090
the same weight, and that's on
129
00:03:26,090 --> 00:03:26,530
purpose.
130
00:03:26,530 --> 00:03:29,530
The tool weights each action by
the risk it represents, which is
131
00:03:29,530 --> 00:03:32,289
a quiet way of telling you where
your attention pays off most.
132
00:03:32,289 --> 00:03:33,650
A preventative action that stops
133
00:03:33,650 --> 00:03:34,930
a problem before it starts and
134
00:03:34,930 --> 00:03:36,650
that can't be bypassed is worth
135
00:03:36,650 --> 00:03:37,330
the most.
136
00:03:37,330 --> 00:03:38,650
A detective action that only
137
00:03:38,650 --> 00:03:40,030
watches for problems is worth
138
00:03:40,030 --> 00:03:40,770
far less.
139
00:03:40,770 --> 00:03:41,370
In practice.
140
00:03:41,370 --> 00:03:42,530
The highest value action comes
141
00:03:42,530 --> 00:03:43,930
in at twenty seven points, and
142
00:03:43,930 --> 00:03:45,250
the lowest value one lands at a
143
00:03:45,250 --> 00:03:45,969
single point.
144
00:03:45,969 --> 00:03:47,289
That gap between them is the
145
00:03:47,289 --> 00:03:48,810
tool ranking your priorities for
146
00:03:48,810 --> 00:03:50,090
you, so a number you barely
147
00:03:50,090 --> 00:03:51,370
understand still points you in a
148
00:03:51,370 --> 00:03:52,289
useful direction.
149
00:03:52,289 --> 00:03:53,810
Here's a detail that trips
people up.
150
00:03:53,810 --> 00:03:55,530
So let's slow down for a second.
151
00:03:55,530 --> 00:03:57,289
Points are awarded per action
per assessment.
152
00:03:57,289 --> 00:03:59,490
If an action carries ten points
and it shows up in two
153
00:03:59,490 --> 00:04:02,409
assessments, it's worth twenty
points to your overall score.
154
00:04:02,409 --> 00:04:04,849
There's a small exception for
technical actions scoped to your
155
00:04:04,849 --> 00:04:07,639
whole tenant, but the main
takeaway is simple your overall
156
00:04:07,639 --> 00:04:10,629
score isn't just the average of
your assessment scores, because
157
00:04:10,629 --> 00:04:12,629
the same good work can count
more than once.
158
00:04:12,629 --> 00:04:13,310
That's good news.
159
00:04:13,310 --> 00:04:14,669
And it's also why two companies
160
00:04:14,669 --> 00:04:16,430
with identical settings can show
161
00:04:16,430 --> 00:04:17,910
different scores if they track
162
00:04:17,910 --> 00:04:18,709
different numbers of
163
00:04:18,709 --> 00:04:19,509
assessments.
164
00:04:19,509 --> 00:04:20,449
There's one last thing about
165
00:04:20,449 --> 00:04:21,589
timing because it manages
166
00:04:21,589 --> 00:04:22,310
expectations.
167
00:04:22,310 --> 00:04:24,509
The score isn't a live, second
by second readout.
168
00:04:24,509 --> 00:04:25,829
When you change something, your
169
00:04:25,829 --> 00:04:27,110
action status updates on the
170
00:04:27,110 --> 00:04:28,329
dashboard within about twenty
171
00:04:28,329 --> 00:04:29,149
four hours.
172
00:04:29,149 --> 00:04:30,629
So this is a number that moves
173
00:04:30,629 --> 00:04:31,670
in the background while you
174
00:04:31,670 --> 00:04:31,870
work.
175
00:04:31,870 --> 00:04:34,350
And it isn't a slot machine that
lights up the moment you click.
176
00:04:34,350 --> 00:04:35,910
Give it a day before you judge
177
00:04:35,910 --> 00:04:37,110
whether a change actually
178
00:04:37,110 --> 00:04:37,709
landed.
179
00:04:37,709 --> 00:04:39,550
And that brings us to the part
people get wrong.
180
00:04:39,550 --> 00:04:40,709
It isn't the math, it's what
181
00:04:40,709 --> 00:04:41,870
they think the number actually
182
00:04:41,870 --> 00:04:42,670
means.
183
00:04:42,670 --> 00:04:45,430
Hold that thought because we're
coming back to it at the end.
184
00:04:45,430 --> 00:04:46,189
Assessments.
185
00:04:46,189 --> 00:04:47,389
If the score is the headline
186
00:04:47,389 --> 00:04:48,589
assessments are the report cards
187
00:04:48,589 --> 00:04:49,230
behind it.
188
00:04:49,230 --> 00:04:51,550
An assessment gathers the
controls from one specific
189
00:04:51,550 --> 00:04:53,829
regulation standard or policy.
190
00:04:53,829 --> 00:04:56,629
Think of a rule you've heard of
like a data protection law, and
191
00:04:56,629 --> 00:04:59,990
an assessment is the tool's
version of it translated into
192
00:04:59,990 --> 00:05:01,509
checks you can actually act on.
193
00:05:01,509 --> 00:05:04,230
Complete the actions inside an
assessment and you're working
194
00:05:04,230 --> 00:05:05,470
toward meeting that rule.
195
00:05:05,470 --> 00:05:07,670
Each assessment holds a few
things worth knowing.
196
00:05:07,670 --> 00:05:10,399
It lists the services it covers,
which shows whether you're
197
00:05:10,399 --> 00:05:13,240
measuring just Microsoft three
hundred sixty five or a wider
198
00:05:13,240 --> 00:05:15,920
set of cloud services, it
separates the controls Microsoft
199
00:05:15,920 --> 00:05:18,720
manages from the controls you
manage, and it flags the ones
200
00:05:18,720 --> 00:05:21,360
you share, and it carries its
own score, so you can see how
201
00:05:21,360 --> 00:05:24,519
you're doing on that single rule
without squinting at the overall
202
00:05:24,519 --> 00:05:25,920
number at the top of the page.
203
00:05:25,920 --> 00:05:28,879
If one regulation is dragging
you down, that per assessment
204
00:05:28,879 --> 00:05:31,240
score tells you exactly where
the problem lives.
205
00:05:31,240 --> 00:05:32,519
Assessments live inside groups
206
00:05:32,519 --> 00:05:33,399
and groups are really just
207
00:05:33,399 --> 00:05:34,120
folders.
208
00:05:34,120 --> 00:05:36,800
They exist so you can organize
your work in whatever way makes
209
00:05:36,800 --> 00:05:39,839
sense to you, whether that's by
year, by regulation or by team.
210
00:05:39,839 --> 00:05:41,839
A group has to hold at least one
assessment.
211
00:05:41,839 --> 00:05:45,160
Group names have to be unique
and groups can't be deleted.
212
00:05:45,160 --> 00:05:46,439
That last rule is the tool
213
00:05:46,439 --> 00:05:47,439
nudging you to think about
214
00:05:47,439 --> 00:05:48,480
structure before you start
215
00:05:48,480 --> 00:05:49,120
clicking.
216
00:05:49,120 --> 00:05:51,959
And it's the kind of thing
you're glad to know on day one.
217
00:05:51,959 --> 00:05:54,360
Once you add an assessment to a
group, you can't move it.
218
00:05:54,360 --> 00:05:55,720
So pick a simple grouping scheme
219
00:05:55,720 --> 00:05:57,000
early and save yourself the
220
00:05:57,000 --> 00:05:57,600
headache.
221
00:05:57,600 --> 00:06:00,360
Here's where assessments get
really clever and it's the part
222
00:06:00,360 --> 00:06:02,759
that saves actual hours.
223
00:06:02,759 --> 00:06:05,800
One improvement action can serve
several assessments at once.
224
00:06:05,800 --> 00:06:08,600
A technical action, one you
complete by changing a setting
225
00:06:08,600 --> 00:06:12,100
syncs across all your groups, so
doing it once counts everywhere.
226
00:06:12,100 --> 00:06:15,300
A non-technical action, such as
a new policy you draft sinks
227
00:06:15,300 --> 00:06:16,540
within its own group.
228
00:06:16,540 --> 00:06:19,060
You might expect to do the same
work five times for five
229
00:06:19,060 --> 00:06:22,180
different rules, but the tool is
built so that one good decision
230
00:06:22,180 --> 00:06:25,139
can satisfy several requirements
at the same time.
231
00:06:25,139 --> 00:06:27,980
Every assessment also carries a
status, so its place in the
232
00:06:27,980 --> 00:06:29,259
process is never a mystery.
233
00:06:29,259 --> 00:06:30,500
It can read as complete or
234
00:06:30,500 --> 00:06:32,199
incomplete in progress or not
235
00:06:32,199 --> 00:06:33,019
yet started.
236
00:06:33,019 --> 00:06:35,579
And when someone asks for proof,
you can export the whole
237
00:06:35,579 --> 00:06:37,019
assessment as a spreadsheet.
238
00:06:37,019 --> 00:06:38,620
That export is a snapshot of
239
00:06:38,620 --> 00:06:39,939
exactly where things stood on
240
00:06:39,939 --> 00:06:41,139
the day you sent it, which is
241
00:06:41,139 --> 00:06:42,579
precisely what an auditor wants
242
00:06:42,579 --> 00:06:42,899
to see.
243
00:06:42,899 --> 00:06:45,220
It's the difference between
saying you're compliant and
244
00:06:45,220 --> 00:06:47,060
showing the evidence.
245
00:06:47,060 --> 00:06:48,660
Regulations and templates.
246
00:06:48,660 --> 00:06:50,860
Assessments have to come from
somewhere and you don't build
247
00:06:50,860 --> 00:06:52,139
them from a blank page.
248
00:06:52,139 --> 00:06:53,139
That's the whole point.
249
00:06:53,139 --> 00:06:55,740
Compliance manager gives you
regulatory templates, and the
250
00:06:55,740 --> 00:06:57,899
template is a ready made
blueprint for a rule.
251
00:06:57,899 --> 00:06:59,300
It already contains the controls
252
00:06:59,300 --> 00:07:00,579
and the improvement actions
253
00:07:00,579 --> 00:07:01,660
you'd need to satisfy that
254
00:07:01,660 --> 00:07:02,459
regulation.
255
00:07:02,459 --> 00:07:05,339
So you skip the painful work of
mapping a law by hand.
256
00:07:05,339 --> 00:07:06,420
For anyone who has ever tried to
257
00:07:06,420 --> 00:07:07,939
read a regulation called that
258
00:07:07,939 --> 00:07:09,060
alone is worth the price of
259
00:07:09,060 --> 00:07:09,819
admission.
260
00:07:09,819 --> 00:07:13,040
The scale here is worth pausing
on Microsoft ships more than
261
00:07:13,040 --> 00:07:16,160
three hundred and sixty of these
templates covering regulations,
262
00:07:16,160 --> 00:07:18,279
standards, and certifications
from around the world.
263
00:07:18,279 --> 00:07:19,680
If your company operates in
264
00:07:19,680 --> 00:07:20,800
several countries or serves
265
00:07:20,800 --> 00:07:21,959
customers in a regulated
266
00:07:21,959 --> 00:07:23,399
industry, there's a decent
267
00:07:23,399 --> 00:07:24,800
chance the rule that applies to
268
00:07:24,800 --> 00:07:26,000
you already has a template
269
00:07:26,000 --> 00:07:26,600
waiting.
270
00:07:26,600 --> 00:07:27,839
You're choosing from a library,
271
00:07:27,839 --> 00:07:29,160
not writing from scratch, and it
272
00:07:29,160 --> 00:07:30,279
does the mapping work that used
273
00:07:30,279 --> 00:07:31,439
to eat up weeks of someone's
274
00:07:31,439 --> 00:07:32,079
calendar.
275
00:07:32,079 --> 00:07:33,839
Now, not all of them are free.
276
00:07:33,839 --> 00:07:35,399
And this is where honesty helps.
277
00:07:35,399 --> 00:07:36,879
The templates come in two
buckets.
278
00:07:36,879 --> 00:07:39,480
One is the baseline template,
the data protection baseline,
279
00:07:39,480 --> 00:07:42,040
which comes included at every
subscription level so everyone
280
00:07:42,040 --> 00:07:43,240
gets a starting point.
281
00:07:43,240 --> 00:07:46,000
The other bucket holds premium
templates, the global, regional
282
00:07:46,000 --> 00:07:48,240
and industry rules that need a
license to unlock.
283
00:07:48,240 --> 00:07:50,720
Depending on your agreement,
your organization might be able
284
00:07:50,720 --> 00:07:53,480
to use a few premium templates
at no extra cost, and premium
285
00:07:53,480 --> 00:07:56,079
licenses generally last about a
year before they renew.
286
00:07:56,079 --> 00:07:57,720
If your situation is unusual,
287
00:07:57,720 --> 00:07:59,000
you can also build a custom
288
00:07:59,000 --> 00:08:00,259
template from scratch, though
289
00:08:00,259 --> 00:08:01,600
most organizations never need
290
00:08:01,600 --> 00:08:02,160
to.
291
00:08:02,160 --> 00:08:04,600
The practical takeaway is this
you start with a library.
292
00:08:04,600 --> 00:08:07,000
You pick the rule that matters
to you, and the structure is
293
00:08:07,000 --> 00:08:07,959
already built for you.
294
00:08:07,959 --> 00:08:11,040
You're not staring at an empty
spreadsheet trying to remember
295
00:08:11,040 --> 00:08:14,040
what a regulation even requires,
and that changes how quickly you
296
00:08:14,040 --> 00:08:15,170
can get moving.
297
00:08:15,170 --> 00:08:18,089
The hard part shifts from
figuring out the rule to simply
298
00:08:18,089 --> 00:08:20,370
doing the work it asks for.
299
00:08:20,370 --> 00:08:21,649
Improvement actions.
300
00:08:21,649 --> 00:08:24,610
A template gives you the list,
but a list doesn't do the work.
301
00:08:24,610 --> 00:08:27,009
That's where improvement actions
come in, and they're the engine
302
00:08:27,009 --> 00:08:28,089
of the whole tool.
303
00:08:28,089 --> 00:08:29,329
An improvement action is a
304
00:08:29,329 --> 00:08:31,129
single recommended task written
305
00:08:31,129 --> 00:08:32,809
in plain guidance that moves
306
00:08:32,809 --> 00:08:33,250
your score.
307
00:08:33,250 --> 00:08:34,129
When you complete it.
308
00:08:34,129 --> 00:08:36,330
Each one tells you what to do,
points you toward the right
309
00:08:36,330 --> 00:08:38,970
place to do it, and tracks
whether it's done in a field
310
00:08:38,970 --> 00:08:40,250
full of vague advice.
311
00:08:40,250 --> 00:08:42,570
That specificity is what makes
the work possible.
312
00:08:42,570 --> 00:08:43,870
Every action can be assigned to
313
00:08:43,870 --> 00:08:45,529
a person in your organization,
314
00:08:45,529 --> 00:08:46,809
which is what turns a compliance
315
00:08:46,809 --> 00:08:48,049
program into actual work with
316
00:08:48,049 --> 00:08:48,970
names attached.
317
00:08:48,970 --> 00:08:51,590
Once assigned, the owner gets a
notification and a direct link
318
00:08:51,590 --> 00:08:52,450
to the task.
319
00:08:52,450 --> 00:08:54,970
The action itself becomes a
little container for everything
320
00:08:54,970 --> 00:08:56,049
related to that job.
321
00:08:56,049 --> 00:08:57,690
You can store notes, upload
322
00:08:57,690 --> 00:08:58,769
evidence like documents and
323
00:08:58,769 --> 00:09:00,090
screenshots, and record status
324
00:09:00,090 --> 00:09:01,649
updates all in one place so the
325
00:09:01,649 --> 00:09:02,649
proof doesn't get lost in
326
00:09:02,649 --> 00:09:03,929
somebody's inbox.
327
00:09:03,929 --> 00:09:05,250
Improvement actions come in two
328
00:09:05,250 --> 00:09:06,370
flavors, and the difference
329
00:09:06,370 --> 00:09:07,049
matters.
330
00:09:07,049 --> 00:09:08,490
Technical actions are things you
331
00:09:08,490 --> 00:09:10,090
do by changing a setting inside
332
00:09:10,090 --> 00:09:11,570
a tool, like turning on a
333
00:09:11,570 --> 00:09:12,769
security feature.
334
00:09:12,769 --> 00:09:14,210
Non-Technical actions happen
335
00:09:14,210 --> 00:09:15,850
outside the technology and they
336
00:09:15,850 --> 00:09:17,350
split again into documentation
337
00:09:17,350 --> 00:09:18,889
like writing a policy and
338
00:09:18,889 --> 00:09:20,190
operational work, like training
339
00:09:20,190 --> 00:09:20,669
your staff.
340
00:09:20,669 --> 00:09:23,389
You might think compliance is
all paperwork and red tape, but
341
00:09:23,389 --> 00:09:25,909
a large share of these actions
are real technical changes you
342
00:09:25,909 --> 00:09:27,389
can make in an afternoon.
343
00:09:27,389 --> 00:09:28,950
The tool doesn't care who you
are.
344
00:09:28,950 --> 00:09:31,669
It only cares whether the action
is done and tested.
345
00:09:31,669 --> 00:09:34,350
Then there's the question of
testing, which is how the tool
346
00:09:34,350 --> 00:09:36,350
knows an action actually worked.
347
00:09:36,350 --> 00:09:39,509
Some actions you test by hand,
you do the work, record the date
348
00:09:39,509 --> 00:09:40,870
and mark the result.
349
00:09:40,870 --> 00:09:43,470
Many other actions test
themselves because compliance
350
00:09:43,470 --> 00:09:45,710
manager reads signals straight
from your environment.
351
00:09:45,710 --> 00:09:47,629
It pulls those signals from
several sources.
352
00:09:47,629 --> 00:09:49,549
It reads built in signals from
353
00:09:49,549 --> 00:09:50,669
other Microsoft security and
354
00:09:50,669 --> 00:09:51,429
compliance tools.
355
00:09:51,429 --> 00:09:53,710
It checks Microsoft Secure
Score, and it reaches into
356
00:09:53,710 --> 00:09:54,789
defender for cloud to watch.
357
00:09:54,789 --> 00:09:57,149
Azure, Amazon Web Services, and
Google Cloud.
358
00:09:57,149 --> 00:10:00,070
Automatic testing is switched on
by default, and it takes about a
359
00:10:00,070 --> 00:10:01,549
week to fully gather its data.
360
00:10:01,549 --> 00:10:03,590
You don't have to trust your
memory about whether a setting
361
00:10:03,590 --> 00:10:06,110
is still on, because the tool
keeps checking for you.
362
00:10:06,110 --> 00:10:08,789
There's a trade off here, and
it's worth saying out loud.
363
00:10:08,789 --> 00:10:11,710
Automatic testing removes the
pile of repetitive busywork, but
364
00:10:11,710 --> 00:10:12,629
it comes with a catch.
365
00:10:12,629 --> 00:10:15,549
You can't hand edit the status
or the notes on an action that
366
00:10:15,549 --> 00:10:18,960
tests itself because the tool
owns that field, so the choice
367
00:10:18,960 --> 00:10:21,600
between manual and automatic is
really a choice about control.
368
00:10:21,600 --> 00:10:22,879
You trade a little manual effort
369
00:10:22,879 --> 00:10:24,360
for a little more oversight, or
370
00:10:24,360 --> 00:10:25,360
you trade oversight for
371
00:10:25,360 --> 00:10:26,399
convenience.
372
00:10:26,399 --> 00:10:27,279
Who does what.
373
00:10:27,279 --> 00:10:29,759
All of that work needs owners
and owners need permissions.
374
00:10:29,759 --> 00:10:31,639
So let's talk about who gets to
do what.
375
00:10:31,639 --> 00:10:34,460
Compliance manager uses role
based access, which is a fancy
376
00:10:34,460 --> 00:10:37,720
way of saying that only people
you invite can get in, and the
377
00:10:37,720 --> 00:10:40,559
role you give them decides what
they're allowed to touch.
378
00:10:40,559 --> 00:10:41,720
Nothing happens by accident
379
00:10:41,720 --> 00:10:43,080
because access is granted on
380
00:10:43,080 --> 00:10:43,799
purpose.
381
00:10:43,799 --> 00:10:46,639
There are four roles and each
one is easy to picture.
382
00:10:46,639 --> 00:10:47,879
A reader can look at everything
383
00:10:47,879 --> 00:10:49,399
and change nothing, which is
384
00:10:49,399 --> 00:10:50,559
perfect for someone who just
385
00:10:50,559 --> 00:10:51,679
needs visibility.
386
00:10:51,679 --> 00:10:54,480
A contributor can edit data and
create new assessments.
387
00:10:54,480 --> 00:10:56,360
So this is your hands on
builder.
388
00:10:56,360 --> 00:10:59,320
An assessor can also edit data
but can't create assessments
389
00:10:59,320 --> 00:11:02,200
because their job is to check
the work rather than design it.
390
00:11:02,200 --> 00:11:03,360
And an administrator runs the
391
00:11:03,360 --> 00:11:04,480
whole thing managing
392
00:11:04,480 --> 00:11:05,799
assessments, templates, and the
393
00:11:05,799 --> 00:11:06,759
people involved.
394
00:11:06,759 --> 00:11:09,679
Most beginners only ever need to
see the reader view, and that's
395
00:11:09,679 --> 00:11:11,279
a perfectly good place to start.
396
00:11:11,279 --> 00:11:12,159
Here's the part that makes
397
00:11:12,159 --> 00:11:13,240
adoption easier than you'd
398
00:11:13,240 --> 00:11:13,960
expect.
399
00:11:13,960 --> 00:11:16,320
These roles line up with
Microsoft admin roles you may
400
00:11:16,320 --> 00:11:18,740
already have assigned, so the
person who manages your tenant
401
00:11:18,740 --> 00:11:22,019
often slots straight in without
a new identity to remember, and
402
00:11:22,019 --> 00:11:23,220
there's a neat extra layer.
403
00:11:23,220 --> 00:11:24,539
You can give someone a role on
404
00:11:24,539 --> 00:11:25,740
one single assessment so an
405
00:11:25,740 --> 00:11:27,379
outside auditor can see exactly
406
00:11:27,379 --> 00:11:28,539
the report card they need, and
407
00:11:28,539 --> 00:11:29,580
nothing else that keeps
408
00:11:29,580 --> 00:11:30,820
sensitive compliance work in the
409
00:11:30,820 --> 00:11:31,500
right hands.
410
00:11:31,500 --> 00:11:33,259
There's one plain rule to keep
in mind.
411
00:11:33,259 --> 00:11:34,379
A person holds one role at a
412
00:11:34,379 --> 00:11:36,100
time, and changing that role
413
00:11:36,100 --> 00:11:37,899
replaces the old one that keeps
414
00:11:37,899 --> 00:11:38,700
permissions clean.
415
00:11:38,700 --> 00:11:40,100
And it means access is always
416
00:11:40,100 --> 00:11:40,980
deliberate rather than
417
00:11:40,980 --> 00:11:41,779
accidental.
418
00:11:41,779 --> 00:11:44,580
If someone's role changes, their
old abilities disappear at the
419
00:11:44,580 --> 00:11:47,220
same moment, which is exactly
what you want in a tool that
420
00:11:47,220 --> 00:11:48,700
touches sensitive data.
421
00:11:49,740 --> 00:11:51,259
The workflow end to end.
422
00:11:51,259 --> 00:11:52,460
Let's pull all of it together
423
00:11:52,460 --> 00:11:53,580
now, because the pieces make
424
00:11:53,580 --> 00:11:54,940
more sense as one continuous
425
00:11:54,940 --> 00:11:55,419
flow.
426
00:11:55,419 --> 00:11:56,659
Imagine you've just been handed
427
00:11:56,659 --> 00:11:58,179
the keys to Compliance Manager,
428
00:11:58,179 --> 00:11:59,299
and you're logging in for the
429
00:11:59,299 --> 00:12:00,220
first time.
430
00:12:00,220 --> 00:12:02,460
You sign into the Microsoft
Purview Portal and Open
431
00:12:02,460 --> 00:12:05,220
Compliance Manager, and you land
on a dashboard that already
432
00:12:05,220 --> 00:12:06,059
shows a score.
433
00:12:06,059 --> 00:12:07,139
You didn't build anything yet.
434
00:12:07,139 --> 00:12:09,940
And that's fine, because the
baseline assessment has been
435
00:12:09,940 --> 00:12:12,059
quietly reading your Microsoft
three hundred sixty five
436
00:12:12,059 --> 00:12:13,379
settings the whole time.
437
00:12:13,379 --> 00:12:16,440
Your first job is simply to look
at what's already there, and to
438
00:12:16,440 --> 00:12:19,059
notice that the tool has been
working before you arrived.
439
00:12:19,059 --> 00:12:21,679
Next, you pick the regulation
that actually matters to your
440
00:12:21,679 --> 00:12:24,519
organization and spin up an
assessment from a template.
441
00:12:24,519 --> 00:12:26,720
The tool asks you a few
questions like which services
442
00:12:26,720 --> 00:12:29,919
you want to cover, and then it
builds the report card for you.
443
00:12:29,919 --> 00:12:31,440
Now you can see the full list of
444
00:12:31,440 --> 00:12:33,120
actions standing between you and
445
00:12:33,120 --> 00:12:33,720
that rule.
446
00:12:33,720 --> 00:12:34,799
From there, you read through the
447
00:12:34,799 --> 00:12:36,200
improvement actions and assign
448
00:12:36,200 --> 00:12:36,840
owners.
449
00:12:36,840 --> 00:12:38,539
Some tasks belong to it, some to
450
00:12:38,539 --> 00:12:39,879
legal and some to whoever writes
451
00:12:39,879 --> 00:12:40,960
your policies.
452
00:12:40,960 --> 00:12:43,600
The tool sends each owner a link
so nobody has to guess what
453
00:12:43,600 --> 00:12:44,919
they're responsible for.
454
00:12:44,919 --> 00:12:45,759
Then the work begins.
455
00:12:45,759 --> 00:12:47,200
People complete actions, upload
456
00:12:47,200 --> 00:12:48,639
evidence, and mark their status
457
00:12:48,639 --> 00:12:49,600
and the actions that test
458
00:12:49,600 --> 00:12:50,120
themselves.
459
00:12:50,120 --> 00:12:51,840
Credit your score automatically.
460
00:12:51,840 --> 00:12:54,720
As things get done, you move
them from plan to implemented
461
00:12:54,720 --> 00:12:56,799
and from untested to tested.
462
00:12:56,799 --> 00:12:58,179
The score climbs slowly and
463
00:12:58,179 --> 00:12:59,679
honestly, one verified action at
464
00:12:59,679 --> 00:13:00,240
a time.
465
00:13:00,240 --> 00:13:02,600
This is also the moment to set
up alerts if your score ever
466
00:13:02,600 --> 00:13:05,360
drops or an action flips its
status, you hear about it.
467
00:13:05,360 --> 00:13:07,759
Instead of finding out the hard
way during an audit.
468
00:13:07,759 --> 00:13:10,899
Over time, that habit turns
compliance from a yearly panic
469
00:13:10,899 --> 00:13:12,799
into a steady routine.
470
00:13:12,799 --> 00:13:15,600
When leadership or an auditor
wants proof, you export a report
471
00:13:15,600 --> 00:13:16,679
and hand it over.
472
00:13:16,679 --> 00:13:19,279
Then the cycle repeats because
regulations change and your
473
00:13:19,279 --> 00:13:20,720
environment keeps moving.
474
00:13:20,720 --> 00:13:22,120
And through all of it, Microsoft
475
00:13:22,120 --> 00:13:23,690
is quietly completing its own
476
00:13:23,690 --> 00:13:24,570
half of the work in the
477
00:13:24,570 --> 00:13:25,809
background, which is why your
478
00:13:25,809 --> 00:13:27,129
score reflects more than your
479
00:13:27,129 --> 00:13:27,889
team alone.
480
00:13:27,889 --> 00:13:29,090
Your job is the part that's
481
00:13:29,090 --> 00:13:30,529
genuinely yours, and the
482
00:13:30,529 --> 00:13:31,850
dashboard makes sure you can see
483
00:13:31,850 --> 00:13:32,690
it clearly.
484
00:13:32,690 --> 00:13:34,610
There's still that one thing
about the score, though, and
485
00:13:34,610 --> 00:13:36,610
it's time to settle it.
486
00:13:36,610 --> 00:13:38,889
A quick recap and one open
question.
487
00:13:38,889 --> 00:13:40,370
Let's bring it back to the three
parts.
488
00:13:40,370 --> 00:13:41,370
Quick and clean.
489
00:13:41,370 --> 00:13:44,090
The compliance score is your
progress in a single number.
490
00:13:44,090 --> 00:13:45,529
Assessments are the report cards
491
00:13:45,529 --> 00:13:47,049
for each rule, and improvement
492
00:13:47,049 --> 00:13:48,769
actions are the to do list that
493
00:13:48,769 --> 00:13:50,289
moves everything forward with
494
00:13:50,289 --> 00:13:51,330
roles keeping it all under
495
00:13:51,330 --> 00:13:52,049
control.
496
00:13:52,049 --> 00:13:53,490
That's the whole machine and
497
00:13:53,490 --> 00:13:54,610
it's smaller than it looks from
498
00:13:54,610 --> 00:13:55,370
the outside.
499
00:13:55,370 --> 00:13:56,370
Now let's talk about the one
500
00:13:56,370 --> 00:13:57,490
thing people get wrong about
501
00:13:57,490 --> 00:13:58,330
that score.
502
00:13:58,330 --> 00:14:00,809
It isn't a certificate of
compliance, and Microsoft says
503
00:14:00,809 --> 00:14:03,529
so directly the score tracks
your progress on recommended
504
00:14:03,529 --> 00:14:06,370
actions, and it never replaces
your own judgment about whether
505
00:14:06,370 --> 00:14:07,929
a control actually works.
506
00:14:07,929 --> 00:14:10,009
Treat it as a fitness tracker,
not a finish line.
507
00:14:10,009 --> 00:14:12,649
If this made compliance feel a
little less intimidating,
508
00:14:12,649 --> 00:14:16,769
subscribe to M365 FM, where we
master the tools and the mindset
509
00:14:16,769 --> 00:14:18,129
shaping the future of work.
510
00:14:18,129 --> 00:14:19,570
So let me leave you with one
question.
511
00:14:19,570 --> 00:14:21,970
When you picture your own
dashboard, which regulation
512
00:14:21,970 --> 00:14:24,649
shows up first and which single
improvement action would you
513
00:14:24,649 --> 00:14:25,850
start tomorrow morning?
