Compliance
ISO 27001, Cyber Essentials, NIST and GDPR mapped to the Microsoft controls that actually satisfy them.
A control framework and a product feature list are not the same thing, and most compliance content quietly pretends they are. Buying Microsoft Purview does not make you ISO 27001 certified, and no vendor page will tell you which controls it leaves untouched.
These guides map specific controls to specific Microsoft capabilities, then say which ones you will still be evidencing manually on the day of the audit.
Which Annex A controls Purview genuinely satisfies, which it only partly evidences, and the ones your auditor will still want to see you doing by hand.
Read the guideA UK-specific answer, including what each one actually costs in time rather than in certification fees, and when doing both is the wrong idea.
Read the guideMost GDPR work is documentation, not configuration. The parts that genuinely are technical, and where Microsoft 365 helps rather than hinders.
Read the guideThe framework everyone claims to follow. What each function means in a Microsoft estate, including the one added in 2.0 that most organisations have not addressed.
Read the guideEU financial entities and their critical ICT providers. The obligations that translate into tenant work, and the register that catches people out.
Read the guideThe self-assessment gets you the basic certificate. Plus adds a hands-on technical audit, and the failures are predictable.
Read the guideTenant region, Advanced Data Residency, and the services that process outside your chosen geography regardless. The answer is more nuanced than the sales conversation.
Read the guideThey overlap heavily and they are not interchangeable. Which one to pursue depends almost entirely on where your customers are.
Read the guideThe 200-question spreadsheet from a prospect's procurement team. How to answer honestly, quickly, and in a way that does not commit you to something you cannot do.
Read the guideKeeping everything forever is not caution, it is a liability. What retention actually has to prove, and why deletion is the hard part.
Read the guideIt is not surveillance and it is not a lie detector. What the signals really are, what it catches, and the governance you need before turning it on.
Read the guideNothing here yet that answers your question?
Tell us what you are trying to decide and it moves up the queue. The order these get written in is driven by what people ask for.
Ask for a guide