ISO 27001 in M365: what you really need (and what you don't)

What is ISO 27001 about?

ISO 27001:2022 describes a management system for information security (ISMS). It does not require specific tools but defines 93 controls (Annex A) to be implemented based on a risk analysis.

Which M365 licence is enough?

Microsoft 365 Business Premium

Sufficient for most SMEs up to ~300 employees:

• Entra ID Premium P1 (MFA, conditional access)
• Intune (device management)
• Defender for Business (endpoint protection)
• Purview Information Protection (classification)

Microsoft 365 E5 or add-ons

Only needed when:

• Advanced protection against phishing/malware (Defender for Office 365 Plan 2)
• Insider risk management is required
• Privileged identity management is needed
• Advanced compliance features (eDiscovery Premium)

What an ISMS in M365 really needs

1. Risk management

• Capture, assess, treat, monitor risks
• SharePoint list with scoring logic or dedicated module

2. Statement of Applicability (SoA)

• Table of all 93 controls with status (applicable / excluded / implemented)
• Living document reviewed annually

3. Asset inventory

• Hardware (via Intune)
• Software (via Defender)
• Data (via Purview classifications)
• Suppliers / processors (separate list)

4. Access management

• Joiner-mover-leaver process (e.g. via Entra ID lifecycle workflows)
• Regular access reviews
• Privileged access management

5. Incident management

• Reporting channels for security incidents
• Documentation of each incident
• Lessons learned

6. Audits & management review

• Internal audits against the 93 controls
• Management review at least annually

What you probably do NOT need

• Separate SIEM for an SME with < 100 employees – Defender + Sentinel Light usually suffices
• External ISMS tools with annual licence fees > 20,000 CHF
• Countless compliance add-ons that are only needed once a year for the audit

ISO 9001 + ISO 27001 as integrated management system

Those who implement both standards should build an integrated management system (IMS) instead of two parallel systems. Risks, document control, audit processes, management review – all shareable. This is exactly what modular IMS solutions like Power IMS are designed for: a QMS module, an audit module, a risk module – all in the same M365 environment.