What an audit package looks like

B-01 Recipient coverage of threat protection policies

Criterion: Every mail-enabled recipient in all accepted domains is covered by the anti-spam, anti-malware and anti-phishing protection defined in the organisation's baseline and, where Microsoft Defender for Office 365 is licensed, by Safe Links and Safe Attachments protection (custom policies, Standard/Strict preset security policies or Built-in protection). Every exclusion of users, groups or domains from a policy or preset is documented, justified and approved, and does not leave the recipient with protection below the baseline.

Procedure: Export all threat protection policies and their rules with scope conditions, exceptions and priorities, together with the full recipient population. Determine by query which effective policy applies to each recipient per protection type, and identify recipients who fall back to weaker settings or have no Safe Links or Safe Attachments coverage. Compare all exclusions with documented justifications.

Evidence:

• Exchange Online PowerShell exports with timestamp and tenant ID: Get-HostedContentFilterPolicy/Rule, Get-MalwareFilterPolicy/Rule, Get-AntiPhishPolicy/Rule, Get-SafeLinksPolicy/Rule, Get-SafeAttachmentPolicy/Rule
• Preset security policy exports: Get-EOPProtectionPolicyRule and Get-ATPProtectionPolicyRule, including the Built-in protection rule and its exceptions
• Recipient population export (Get-EXORecipient) with recipient type and primary SMTP domain, plus membership of groups used in policy scopes
• Accepted domains list (Get-AcceptedDomain)
• Documented justifications and approvals for policy exclusions
• Licence overview confirming whether Defender for Office 365 Plan 1 or Plan 2 is assigned

Test steps:

1. Record the record counts of all exports and confirm they match the counts shown in the Microsoft Defender portal
2. List all policies per protection type with priority, state (enabled/disabled), included users, groups and domains, and exceptions
3. Resolve group-based scopes to members and map every recipient to the policy that applies first by priority, per protection type
4. Identify recipients covered only by default policies and check whether the default policies meet the baseline
5. Where Defender for Office 365 is licensed, identify recipients without Safe Links or Safe Attachments coverage, including exceptions from Built-in protection
6. Check that recipients in every accepted domain are within scope, including domains added during the reference period
7. For each exclusion, verify that a justification and approval exist; list undocumented exclusions as deviations

References (to be verified): ISO/IEC 27001:2022 A.8.7

B-02 Protection level of anti-phishing and anti-spam policies

Criterion: Anti-phishing and inbound anti-spam policies in force meet the defined baseline (or, if none exists, the Microsoft Standard preset level as the documented reference baseline). As a minimum: high-confidence phishing and phishing are quarantined; spoof intelligence is enabled with quarantine or junk action; zero-hour auto purge is enabled for spam and phishing; the bulk complaint level threshold is not weaker than the baseline value; and, where Defender for Office 365 is licensed, user impersonation protection covers executive management and other high-risk accounts, while domain impersonation protection covers all accepted domains and key partner domains.

Procedure: Compare the settings of every enabled anti-phishing and anti-spam policy with the baseline, attribute by attribute. Check that the list of protected users for impersonation protection contains the current executives and high-risk functions. Use the Defender for Office 365 configuration analyzer only as a supporting indicator and confirm each deviation against the exported configuration.

Evidence:

• Get-AntiPhishPolicy export with EnableSpoofIntelligence, AuthenticationFailAction, EnableMailboxIntelligence, TargetedUsersToProtect, TargetedDomainsToProtect, PhishThresholdLevel and impersonation actions
• Get-HostedContentFilterPolicy export with SpamAction, HighConfidenceSpamAction, PhishSpamAction, HighConfidencePhishAction, BulkThreshold, SpamZapEnabled and PhishZapEnabled
• Approved email security baseline or the documented reference baseline
• Current list of executive management and other high-risk accounts (e.g. finance approvers), provided by HR or the CISO
• Configuration analyzer report from the Microsoft Defender portal (supporting only)

Test steps:

1. Obtain the baseline values or document the reference baseline used
2. Tabulate the relevant attributes of each enabled anti-phishing and anti-spam policy against the baseline values
3. Mark every attribute weaker than the baseline, and for each deviation check whether a documented and approved risk acceptance exists
4. Compare the executive and high-risk account list with the users protected by impersonation protection; list missing accounts
5. Check that all accepted domains are included in domain impersonation protection
6. Confirm that high-confidence phishing is never delivered to the inbox or junk folder in any policy
7. Reconcile configuration analyzer findings with the exported values and note discrepancies

B-03 Protection level of anti-malware, Safe Attachments and Safe Links policies

Criterion: Anti-malware policies enable the common attachments filter with a file type list at least as restrictive as the baseline and enable zero-hour auto purge for malware. Where Defender for Office 365 is licensed, Safe Attachments uses the Block or Dynamic Delivery action with redirection or quarantine for detected malware and is not set to Off or Monitor for any user group. Safe Links rewrites URLs in email, performs time-of-click scanning, waits for URL scanning before delivery, does not allow users to click through to the original URL, applies to internal messages, and excludes only URLs that are documented and approved.

Procedure: Compare the anti-malware, Safe Attachments and Safe Links policy settings with the baseline. Review the Safe Links URL exclusion lists (DoNotRewriteUrls) and assess each excluded URL for justification and risk.

Evidence:

• Get-MalwareFilterPolicy export with EnableFileFilter, FileTypes, FileTypeAction, ZapEnabled and QuarantineTag
• Get-SafeAttachmentPolicy export with Enable, Action, Redirect and QuarantineTag
• Get-SafeLinksPolicy export with EnableSafeLinksForEmail, ScanUrls, DeliverMessageAfterScan, EnableForInternalSenders, AllowClickThrough, TrackClicks and DoNotRewriteUrls
• Approved baseline or documented reference baseline
• Justifications and approvals for Safe Links URL exclusions

Test steps:

1. Compare the file type list of each anti-malware policy with the baseline list and list missing high-risk file types (e.g. executables, scripts, macro-enabled Office files according to the baseline)
2. Confirm that zero-hour auto purge for malware is enabled in all anti-malware policies
3. For each Safe Attachments policy, record the action and flag any policy set to Off or Monitor that applies to users
4. For each Safe Links policy, check the attributes named in the criterion and flag deviations
5. List all DoNotRewriteUrls entries and check each for justification and approval; flag broad wildcard entries covering entire domains or third-party file-sharing services
6. Assign each deviation to the affected recipient scope, based on the coverage mapping from the policy coverage test

References (to be verified): ISO/IEC 27001:2022 A.8.7, CIS Controls v8 9.6, CIS Controls v8 9.7