TISAX, NIS2 and ISO 27001: Technical Evidence in Microsoft 365
An audit requires solid technical evidence.
An audit date is set, but technical controls and documentation do not match yet. I support your IT team with the agreed technical implementation and evidence for TISAX, ISO 27001 or requirements in the NIS2 context.
What does technical implementation for an audit mean?
Standards such as ISO 27001, the TISAX questionnaire or NIS2 describe requirements, not configuration. Technical implementation means mapping each requirement to a concrete setting in Microsoft 365, such as MFA, logging, device encryption or access reviews, implementing it and proving it with configuration and test results.
What I often find before audits
- MFA counts as rolled out, but exceptions are not documented and nobody reviews them regularly.
- Devices are encrypted, but there is no report proving it for all devices.
- The audit log is running; retention and review are not defined.
- Permissions are never reviewed, although the standard requires regular reviews.
- The policy lives in a Word document; the actual configuration differs from it.
- There is an emergency plan, but the procedure has never been tested.
What I take on
- Mapping of the given requirements to the agreed M365 areas.
- Work on technical measures and documented deviations.
- Compilation of configurations, decisions and test results.
- Handover of the documents and a list of open items.
Process and duration
For the full scope usually about eight weeks. If the audit date is earlier, work is prioritised by risk and the rest is documented as open items.
Week 1: mapping
The relevant requirements are mapped to concrete Microsoft 365 settings; target state and gaps are recorded.
Week 2–6: implementation in waves
Identity, Conditional Access, devices, logging. Each wave is tested and documented.
Week 7–8: audit preparation
Compiling evidence, walking through the audit questions with your IT team, list of open items.
Limit
Technical implementation does not guarantee certification or legal compliance.
What your IT team receives
You receive technical documentation with a visible status of work. Implemented measures and remaining gaps are presented in a traceable way. Certification or legal compliance is not guaranteed by this.
Completed engagement
A previous engagement covered technical work in an Intune and modern workplace project with TISAX and ISO 27001 requirements. Project and engagement ended in July 2026; there is no ongoing support.
Credentials
- Microsoft Certified: Information Security Administrator Associate (SC-401)
- Microsoft Certified: Cybersecurity Architect Expert
- 21+ years of IT experience, 50+ Microsoft 365 projects
All certifications can be verified publicly in the Microsoft Learn profile.
Frequently asked questions
Does technical implementation guarantee certification?
No. The certification body decides on certification, your legal or compliance function on legal obligations. Technical implementation provides the configuration and the evidence the audit relies on.
Does NIS2 apply to us?
Whether a company falls under NIS2 depends on sector, size and activity and belongs in the legal assessment. I implement the technical requirements in Microsoft 365 once that classification is clear.
How long does technical audit preparation take?
For the full scope usually about eight weeks: one week of mapping, five weeks of implementation in waves, two weeks of audit preparation. If the audit date is earlier, work is prioritised by risk.
More about me: Profile Philipp Schmidt · easym365.de