Compliance, IT Atlas

Overview

Compliance work is evidence work: mapping obligations to controls, operating those controls consistently, and producing artefacts that show they ran. Mapping one control set to several frameworks avoids duplicated effort.

Compliance is not security, but the disciplines it forces, inventory, access review, logging, change records, training, overlap heavily with the things that actually reduce risk.

Security considerations

Automate evidence collection where possible; manual screenshot gathering does not scale or stay current.
Track control ownership and test frequency, not just the annual audit date.

Related topics

IT Governance

Establishing direction, decision rights, accountability and oversight so technology serves organisational objectives.

Risk Management

Identifying, analysing, treating and monitoring technology risk so decisions are explicit rather than accidental.

Logging

Recording events from systems and applications, centralised and retained so they can support diagnosis, detection and audit.

Identity Governance

The lifecycle and oversight side of identity: joiner mover leaver automation, entitlement management, access reviews and separation of duties.

Data Loss Prevention

Detecting and controlling sensitive data in email, endpoints, cloud storage and SaaS based on classification and policy.

Shared Responsibility Model

The division of security duties between cloud provider and customer, which shifts with each service model.

Cloud Governance

Guardrails that keep cloud usage consistent, compliant and affordable: policy as code, landing zones, tagging and permission boundaries.

Security Baselines

Pre defined, vetted configuration sets that establish a known good hardened state for an operating system or application.

CRM & ERP

Systems of record for customer relationships and for core business operations such as finance, supply chain and manufacturing.

Vendor Management

Managing suppliers, contracts, support entitlements and third party risk across the technology estate.

Data Governance

Defining ownership, classification, quality, retention and permitted use of organisational data.

Access Governance

Ensuring that access rights are justified, approved, reviewed and removed across every system.

Microsoft Purview

Microsoft's data governance and compliance platform: classification, labelling, DLP, retention, eDiscovery, audit and insider risk.