Reduce compliance risk

Audits ask what is true today, not what was true at the last review. TENET builds NIS2 and NIST CSF 2.0 readiness from your live Microsoft 365 and Azure configuration and keeps policies, risks and suppliers alongside it.

Evidence that is out of date

A screenshot taken for last year’s audit says nothing about the configuration today. Controls drift between reviews.

Policies past their review date

Security policies are written once and then forgotten, until an assessor asks when each was last reviewed.

Suppliers nobody re-checks

NIS2 expects you to manage the risk of suppliers with access to your data, yet most supplier lists live in a spreadsheet nobody owns.

Measure readiness continuously

TENET maps Microsoft 365 security controls, Azure security assessments and Azure Policy results to NIS2 articles and NIST CSF 2.0 categories. Each failing control shows its severity, the affected resources and the steps to fix it.

• NIS2 and NIST CSF 2.0 from the same findings
• Affected resources and fix steps per control
• Score changes name the control that moved

Cover the non-technical requirements

Requirements that no configuration can prove open a short questionnaire that explains what good looks like and what an assessor checks. A requirement counts as met only when the answers are complete and backed by a document or an active policy.

• Guided questionnaires for organisational requirements
• Answers saved per tenant and framework
• Met only with supporting evidence

Keep policies and risks current

The Policy Vault holds each security policy with its version, status, NIS2 mapping and review date. The risk register scores each risk by likelihood and impact, records the owner and treatment, and keeps a score history that shows progress to auditors.

• Overdue policy reviews flagged
• Risk scores with owner, treatment and history
• Heat map of every open risk

Review supplier risk

Record each supplier with access to your data, the type of access, its risk classification and its review and contract dates, as NIS2 Article 21 expects. Send structured questionnaires by email and track the answers in TENET.

• Supplier register with review dates
• Pre-built or custom questionnaires by email
• Responses tracked per supplier