From d0a8ddc352a9d0a4d80c85ef3a0a5c4986a382d5 Mon Sep 17 00:00:00 2001 From: Maxime Date: Fri, 31 Jul 2026 13:33:19 -0700 Subject: [PATCH] docs(cloud-security): add cis-m365 to the shipped framework list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CIS Microsoft 365 Foundations Benchmark is being added to the compliance framework set, and this page carries both a COUNT and an exhaustive list — then points at `GET /compliance/frameworks` as the source of truth, which is what makes a stale list read as authoritative rather than as an omission. Also states what the framework covers, because listing it without that over-promises: it is graded off the Microsoft Entra directory, so the admin centers that are not collected report NOT_ASSESSED rather than PASS, and each control's description carries its own reason. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01G8MaumkdjpNKcNUw3mJNtR --- docs/cloud-security/compliance.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docs/cloud-security/compliance.md b/docs/cloud-security/compliance.md index 71e72712d..f7471722f 100644 --- a/docs/cloud-security/compliance.md +++ b/docs/cloud-security/compliance.md @@ -15,11 +15,16 @@ limacharlie cloudsec compliance report --framework cis-gcp limacharlie cloudsec compliance frameworks ``` -Ten frameworks ship today — `cis-aws`, `cis-azure`, `cis-gcp` (the default), -`soc2`, `pci-dss`, `hipaa`, `iso-27001`, `nist-csf`, `nist-ai-rmf`, and -`owasp-llm`. The last two are AI frameworks: they assess the OpenAI and +Eleven frameworks ship today — `cis-aws`, `cis-azure`, `cis-gcp` (the default), +`cis-m365`, `soc2`, `pci-dss`, `hipaa`, `iso-27001`, `nist-csf`, `nist-ai-rmf`, +and `owasp-llm`. The last two are AI frameworks: they assess the OpenAI and Anthropic estate connected through the -[AI providers](providers.md#ai-security-aispm). The set +[AI providers](providers.md#ai-security-aispm). `cis-m365` is graded off the +Microsoft Entra directory, so it covers the benchmark's Entra chapter and reports +NOT_ASSESSED for the admin centers that are not collected (Defender, Purview, +Exchange, SharePoint, Teams) — read each control's description for what it +assesses and why. It applies to a tenant connected as an `entra` provider, or as +the Entra half of an `azure` one. The set grows over time, so `limacharlie cloudsec compliance frameworks` (`GET /compliance/frameworks`) — which carries each framework's `id`, `name`, `version`, and control counts — is the source of truth for valid