COMPLIANCE365
CHECKPOINT

The compliance console that lives in your tenant.

Posture scanning via Microsoft Graph, a linked risk and actions register, a living Statement of Applicability, and one-click audit reports. Every record is stored as SharePoint lists inside your own Microsoft 365 tenant.

Sign-in only requests read-only Graph access for posture checks. Two further permissions are requested separately, only when first needed: SharePoint list access, the moment your registers are first loaded/created; email-send access, only if you use the "Email status update" button. An administrator must consent to each on first use.

Data residencyCheckpoint has no backend and no database. Your registers live in your SharePoint; posture checks are read at scan time and never leave the browser.
Working…
CHECKPOINT SETUP

Let's get your tenant set up.

Checkpoint scans your Microsoft 365 tenant's security posture, keeps a linked risk and actions register, and builds a living Statement of Applicability — every record stored as SharePoint lists inside your own tenant.

Data residencyCheckpoint has no backend and no database. Nothing is copied anywhere else — posture checks are read at scan time straight from Microsoft Graph and never leave your browser. Setup takes about five minutes.

Before you sign in

Exactly what Checkpoint asks Microsoft for at sign-in, and why — every one of these is read-only. Nothing here can change your tenant.

Two more permissions are requested later, only when actually needed: access to create your SharePoint registers, the moment setup provisions them (next in this wizard); and email-send access, only if you ever use the "Email status update" button. Your Microsoft 365 admin approves each the first time it's needed — never all at once.

Checking what your tenant can tell us

A quick, read-only check using the permissions you just granted — nothing is written yet.

Activate this tenant

Paste or upload the activation file Compliance365 issued for this tenant. It's verified entirely in this browser (Ed25519 signature, tenant match, expiry) — nothing is sent anywhere to check it, and nothing is provisioned until it verifies.

Where should your records live?

Checkpoint creates a handful of SharePoint lists to hold your risk register, controls, evidence and more. They hold audit findings and management review minutes, so where they live decides who can read them.

Which frameworks do you need now?

ISO 27001 is included as the baseline. Every other framework shown here is one your activation licenses — turn on whichever you need now; every control set provisions either way, so switching one on later needs no reconfiguration.

Enable the AI assistant?

Your activation includes the AI assistant add-on — a drafting aid grounded in your own registers, running against your own Azure OpenAI resource in your own tenant. You can set this up now, or skip it and configure it later from the AI assistant view. See AI-SETUP.md for provisioning the resource first.

Azure OpenAI endpoint
Deployment name

Setting up your tenant

Starting…

Setup complete

Here's where things stand from your first scan.

Who can use Checkpoint?

Optional, and entirely your call — the whole team can use the Practitioner experience by default, or you can set up two SharePoint groups for tighter control.

Two roles, set up once per tenant

Checkpoint Practitioners — full edit access, everything in this app. Create a SharePoint group with exactly this name and grant it Edit (or Contribute) on every Checkpoint * list and the Checkpoint Documents library. Add yourself and anyone who'll be doing the day-to-day work.
Checkpoint Viewers — read-only. Create a second group with exactly this name and grant it Read on the same lists/library. Add stakeholders you want to give direct Dashboard/Board-view/report access to, instead of emailing status updates.

Group names must match exactly — Checkpoint looks up your membership by display name. If neither group exists, everyone gets the full Practitioner experience (a deliberate, safe default) — nothing here changes who can actually write to SharePoint; that's always enforced by the permissions above, regardless of what this app's UI shows.

Dashboard

Live assurance position for this tenant. Every figure below is computed from the registers — nothing is typed into a slide the night before an audit.

Certification journey

Continuous monitoring — drift since last scan

Assurance pulse

26 weeks of compliance activity — scans, evidence, attestations, reviews and audits. Click a week to filter the Activity feed below.

Residual risk

Posture score trend

Governance

Activity

    Board view

    A live, presentation-ready summary — pull this up instead of screen-sharing the full console. Nothing here is editable; it always reflects the current data.

    Certification roadmap

    Top risks

    Upcoming milestones

    Control Constellation

    Every applicable — and not-yet-applicable — control across your entitled frameworks, arranged one arc per framework and grouped by theme. Curved lines are the registry's own cross-framework mappings: implement one control, and everything it also satisfies lights up. Hover a control to see its whole mapped cluster; click to pin it and open full detail.

    Size by evidence

    Implemented
    In progress
    Not started
    Not applicable
    Cross-framework mapping
    Connected to hovered / selected control

    Posture scan

    Reads Conditional Access, directory roles, PIM, Identity Protection, Intune, OAuth app grants and Secure Score via Microsoft Graph — read-only, inside the tenant — across Identity, Devices, Apps & Data, Monitoring, Continuity, Supplier and Governance. Failed and review-grade checks become proposed risks and actions for your approval; checks with no automatable signal show Manual — verify rather than a false pass. Nothing enters the client register without a practitioner's sign-off.

    Tenant posture

    /100
    No scan yet this session

    Checks

    Coverage

    What Checkpoint can check automatically in this tenant, based on the Microsoft 365 licensing and access actually in place — not every tenant has every premium licence, and the checks that need one show as Manual rather than a guess when it's missing.

    Risk register

    Inherent and residual scoring, linked controls and treatment actions. Residual scores recalculate automatically as linked actions complete.

    Residual risk heatmap

    Every open risk plotted by likelihood × impact — where the register is actually concentrated, at a glance.

    IDRiskCategorySourceInherentResidualOwnerStatus

    Financial risk analysis

    Every open risk's likelihood/impact score, translated into a simulated annual loss distribution — 10,000-trial Monte Carlo, re-run automatically whenever the risk register changes. Loss frequency and magnitude ranges are derived directly from each risk's own residual score (documented, editable assumptions below) — no separate data entry required. Treat this as a defensible order-of-magnitude view, not a measured figure: refine a risk's own numbers by hand wherever real loss history or insurance/actuarial data exists.

    Loss exceedance curve

    The probability that this tenant's total annual loss from open risks exceeds a given amount — read any point as "there's a Y% chance losses exceed $X this year."

    Assumptions

    The illustrative loss-magnitude and event-frequency ranges each residual score maps to — the only inputs this simulation runs on.

    Risk ranking by simulated exposure

    The same open risks as the Risk register, re-ordered by simulated financial exposure (P90 annual loss) rather than ordinal L×I — the two rankings don't always agree.

    IDRiskResidual bandMean annual lossP90 annual lossP99 annual loss

    Actions register

    Every action traces to a risk and a control. Completing an action prompts evidence capture and updates the linked risk's residual score — the audit trail builds itself. Also the home for non-conformities and observations raised during internal or external audits.

    Due runway

    Every open action by how far past — or short of — its due date. Where the pressure actually is on the calendar.

    Status by priority

    Not "how many actions are open" — whether the ones that matter most are actually moving.

    IDActionTypeRiskControlPriorityOwnerDueStatusEvidence

    Vendor risk

    Third-party suppliers with access to systems or data, reviewed on a cadence proportional to their criticality. Linked to the supplier-related controls (A.5.19–A.5.23, CC9.2, DISP.26) and to the risk register — an overdue review here is a live gap in the Statement of Applicability, not a separate spreadsheet.

    Review status by criticality

    A Critical or High vendor still sitting at Not started is the row that matters most — not just how many vendors exist.

    IDVendorCriticalityReview statusNext reviewCertificationsOwnerQuestionnaire

    AI systems

    Every AI system in use, its impact assessment status, and the ISO 42001 controls it evidences — the register ISO 42001 certification is actually built on, not a slide deck assembled the week before audit. EU AI Act risk tiers (Prohibited/High/Limited/Minimal) drive how much scrutiny each system gets.

    Impact assessment status by risk tier

    A Prohibited or High-tier system with no impact assessment started is the one an assessor asks about first.

    IDSystemRisk tierImpact assessmentVendorOwnerLast reviewed

    Frameworks

    Every framework Compliance365 delivers is available in Checkpoint. ISO 27001 is included as the baseline; every additional framework is unlocked by a Compliance365-issued, signed entitlement file — not a self-service toggle. Enabling a framework makes its control set appear in the Statement of Applicability immediately; nothing is deleted when a framework is switched off.

    Licence

    Upload or paste the entitlement file Compliance365 issued for this tenant. It's verified in this browser (Ed25519 signature, tenant match, expiry) before anything changes — nothing is sent anywhere to check it.

    What Checkpoint currently holds
    Framework targets

    Per-framework configuration — the maturity level or reporting shape each framework is being worked towards. Only the frameworks entitled on this tenant appear.

    Settings

    How Checkpoint behaves for this tenant — reporting and branding, the automation cadences, posture thresholds, optional features, and the organisation profile generated documents fill themselves in from. Framework licensing and per-framework targets live in the Frameworks view.

    Reporting & branding

    What generated reports and policy documents carry — the client's own name, logo, accent colour and classification marking.

    Organisation profile

    The facts ISO 27001 expects this organisation to be specific about — its scope boundaries (Clause 4.3), its interested parties and their requirements (Clause 4.2). Answered once here, then filled into every generated document that needs them, instead of being retyped into each one. Left blank, documents generate with generic wording exactly as before.

    Automation & cadence

    How often Checkpoint expects work to happen, and who it tells when it hasn't. The scheduled monitor (SETUP.md § Continuous monitoring) acts on these unattended once deployed.

    Scan thresholds

    Posture-scan pass/review/fail thresholds, tunable per client. Each falls back to the default shown if left blank.

    Features

    Optional dashboard and workflow additions — switch any of these off per client without losing data. Turning one back on picks up exactly where it left off.

    Setup

    Re-run setup

    Step back through the tenant capability check, site selection and framework picks, then re-provision and re-scan. Safe to run again — nothing already in your registers is deleted.

    Data export

    Every register can also be exported as a flat CSV file from its own view — see the "Export CSV" button at the top of Risks, Actions (plus its own progress-log export), the Statement of Applicability, Vendor risk, Internal audits, Management review, the Compliance calendar and the Audit log. The client's data always stays in their own SharePoint lists regardless — this is a portable copy alongside it, for offboarding, an offline backup, or handing a snapshot to an auditor who wants a spreadsheet.

    Export all registers (ZIP)

    Every register's CSV in one download, built entirely in this browser — nothing is uploaded anywhere to produce it.

    Statement of Applicability

    One control set per purchased framework, cross-mapped to the others so shared evidence is never duplicated. Essential Eight is assessed by maturity level (ML1-ML3) per strategy against your target level, set in Frameworks — every other framework's full published control set ships ready to use.

    Status by theme

    Implementation mix across this framework's own theme/category grouping — bar length reflects how many controls sit in each theme.

    Implementation
    ControlTitleApplicableStatusAlso satisfiesOwnerVerifiedEvidence

    Shared evidence

    One artefact often satisfies the same real-world control in every purchased framework at once. Pick a control below to see everywhere its evidence applies — across ALL entitled frameworks, following the cross-mappings already shown as "Also satisfies" on the Statement of Applicability — then attach it once instead of clicking "Link evidence" separately on each row.

    Start from a control

    Documents

    Real evidence storage in this tenant's SharePoint — the ISMS manual, policies, risk treatment plan, training records. Upload here, or upload directly in SharePoint and paste the link when linking evidence to a control or action. Files over 4 MB: upload in SharePoint directly, then paste the link.

    Interpret evidence with AI

    Paste the text of an assurance artefact you already hold — a supplier's SOC 2 report, a penetration test summary, an access review sign-off, a backup job report — and get a draft of which of your controls it evidences, the period it covers, and, just as usefully, what it does not cover. Nothing is linked to a control until you say so.

    Policy template library

    Starter policies and management-system documents, written for a Microsoft 365 environment and grouped by the frameworks this tenant is licensed for. Personalise, generate a print-ready document, and save a copy straight into Policies & Procedures below — registered as DRAFT with its owner and review date until a practitioner approves it.

    Upload a document

    Document control register

    ISO 27001 clause 7.5.2/7.5.3 — every controlled document carries an owner, a version, an approval and a next-review date. These are real SharePoint columns on the library, so the same register is visible natively in SharePoint too.

    DocumentOwnerVersionStatusNext review

    Policy attestation

    ISO 27001 A.5.1 requires policies to be communicated to — and acknowledged by — relevant personnel, and A.6.3 expects the same of awareness material. An auditor samples individuals, so this records one row per person per policy version, with the date they acknowledged it. Employees see only their own outstanding items.

    My attestations

    Campaigns

    CampaignPolicyLaunchedProgressOutstanding

    All attestation records

    PersonPolicyVersionAssignedAcknowledgedStatus

    Training

    ISO 27001 A.6.3 and clause 7.2/7.3 expect awareness and competence to be delivered and demonstrated, not just offered — and an auditor samples individuals. Each course ends in a short comprehension check, and completion is recorded per person against that course version. Phishing simulation is deliberately not duplicated here; Microsoft Defender's Attack Simulation Training does that job.

    My training

    Course catalogue

    Filtered to the frameworks this tenant is licensed for. Anyone can read a course at any time — completion is only recorded against an assignment.

    Training campaigns

    CampaignCourseAssignedCompletionOutstanding

    All training records

    PersonCourseVersionAssignedCompletedScoreStatus

    Internal audits

    ISO 27001 clause 9.2 requires the organisation to run its own internal audit programme, independent of any external certification audit. Schedule audits per framework, record the outcome, and raise findings straight from an audit — each becomes a non-conformity or observation in the Actions register, linked back to the audit, with nonconformities flowing into the corrective-action (Clause 10.1) loop.

    IDFrameworkScopeAuditorPlannedStatus

    Incident register

    ISO 27001 clauses A.5.24–A.5.28 require a planned, documented approach to information security incidents — not just the ones Microsoft Defender can see. Log anything from a phishing click to a laptop left on a train here; a Defender-detected incident can be logged too (set "Discovered via" to Defender alert) so this register is the single record an auditor is shown. Incidents involving personal information are flagged for a privacy-breach assessment, tracked against a 30-day default clock in line with the Privacy Act 1988 Notifiable Data Breaches scheme — check your own jurisdiction's actual deadline; this is a sane default, not legal advice.

    IDTitleCategorySeverityDetectedStatusPrivacy assessment

    Management review

    ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. Recording a review here captures its inputs structured against the seven clause 9.3.2 sub-clauses (a–g) — the measurable ones (performance, risk status, prior actions) pre-filled from live data, the rest prompted for — alongside attendees and the decisions agreed. A minuted record an auditor can inspect.

    IDDateAttendeesNext due

    Compliance calendar

    Every recurring ISMS activity in one place — access control reviews, BCP/DR and backup restore tests, supplier reviews, awareness training, the external surveillance audit cycle and certificate expiry. Complete an item and, if it recurs, its next due date rolls forward automatically.

    IDActivityCategoryFrequencyOwnerNext dueLast completed

    Audit log

    An append-only, read-only record of who changed what and when — control status changes, evidence links, verifications, risk approvals, action/audit/review/calendar activity and framework toggles. Evidence for ISO 27001 A.8.15 (logging) and SOC 2 CC7.2, distinct from the plain-English Activity feed on the Dashboard.

    WhenActorActionTargetBeforeAfter

    Audit reports

    Generated from the live registers, in Compliance365 brand. What used to be a fortnight of assembly is a button.

    Auditor-facing

    Statement of Applicability

    Full SoA with applicability justifications, implementation status and evidence references. The document your certification auditor opens first.

    Auditor-facing

    Risk register snapshot

    Complete register with heatmap summary, treatment decisions, movement since the last snapshot and Monte Carlo financial analysis.

    Auditor-facing · ISO 27001 6.1.3

    Risk treatment plan

    Every risk mapped to its treatment decision, the controls and actions treating it, its residual score and documented owner acceptance — the artifact an auditor cross-checks against the SoA.

    Board & management

    Audit readiness report

    Per-framework readiness: control implementation, open critical risks, overdue actions, evidence coverage — and what the auditor will ask about.

    ISO 27001 · Clause 9.3

    Management review pack

    Quarterly KPI trends, top risks, action throughput and recommendations — satisfies the management review requirement directly.

    Board & C-suite

    Executive summary

    One page: score with trend arrow, implementation %, high/critical risk count, next milestone, top 3 risks. Built for a five-minute board update.

    Self-test

    Pure-logic regression checks — registry integrity, scoring math, residual calculation, entitlement verification, the six report charts, and CSV escaping. Demo-mode-only diagnostics: this is not a substitute for the manual acceptance pass in ACCEPTANCE.md, which is the only thing that ever touches a real tenant.

    ResultGroupCheckDetail

    Trust Center

    A public, read-only page — certifications held, high-level posture, Statement of Applicability summary and (optionally) your sub-processor list. Generated as a single self-contained HTML file into this tenant's own Documents library. Publishing it is a normal SharePoint sharing action you take yourself — Checkpoint generates the file and never makes anything public on its own.

    What's shown

    Company name shown on the page
    Contact email shown on the page (optional)

    Sub-processors listed publicly

    Only appears on the page if "Sub-processor list" above is switched on. Choose which vendors from the Vendor risk register are named.

    Auditor pack

    Assembles the current Statement of Applicability, an evidence index, a recent audit log excerpt and the latest management review record into one file an external auditor can open via a SharePoint sharing link — no Checkpoint licence needed. Time-boxing and access control are enforced by SharePoint's own sharing-link expiry when you create that link, not by Checkpoint.

    Framework
    Intended validity
    Scope note (optional, shown on the cover page)

    AI assistant

    A drafting aid grounded in your own compliance registers — policy language, evidence descriptions, risk treatment notes, report commentary. Runs against your own Azure OpenAI resource in your own tenant (see AI-SETUP.md) — nothing is sent to Compliance365 or any third party, and the assistant can only read what you choose to include below and only ever returns text for you to review. It never writes to any register, and every response carries a visible "AI-assisted draft — review before use" label.

    Azure OpenAI endpoint (your own resource — e.g. https://your-resource.openai.azure.com)
    Deployment name
    Enable the AI assistant

    Questionnaire assistant

    Paste a security/compliance questionnaire (one question per line) and get a draft answer for each, grounded in your Statement of Applicability and latest scan — with a confidence level and what to verify before sending. Every answer is a draft; review each one before it leaves this app.

    Mock auditor

    Generates 10 interview questions an external auditor might ask, targeting your CURRENT gaps — unevidenced implemented controls, failing posture checks, overdue actions — with an honest model answer for each, including where the honest answer is "we have a gap". A rehearsal tool, not a substitute for the real audit.

    Evidence request simulator

    Generates a realistic evidence request list — the artefacts an external auditor would ask to see for your Implemented controls — and flags which ones you already have evidence for versus which are missing. Ready/Missing is read directly from your own register, never guessed by the model. A rehearsal tool, not a substitute for the real audit.