Microsoft 365 security posture against Zero Trust, DISA STIG and CISA baselines.

Secure Score counts how many of Microsoft's own recommendations you have completed. It is one input, not a framework. EtherInsights reads every Secure Score control with its action plan and history, then shows the tenant against Microsoft's Zero Trust Assessment, DISA STIG, CISA ScubaGear, NSA and NIST guidance, tracks changes between reviews and turns each gap into an owner-assigned action with evidence attached.

EtherInsights runs more than a hundred checks from Microsoft's open-source Zero Trust Assessment against your tenant through Microsoft Graph, and scores the pass rate across four pillars: Identity, Devices, Network and Data. It does not assess the Apps or Infrastructure pillars. Results keep a history and export to PDF.

Yes, for Microsoft 365. EtherInsights checks 29 DISA STIG rules. The Entra ID rules, such as admin MFA, blocking legacy authentication, account lockout and session timeout, are checked setting by setting, with the DISA rule ID where DISA publishes one. For Windows 11, Edge and Microsoft 365 Apps, it checks that a security baseline is in place in Intune; it does not read STIG settings on each device. It reports conformity and does not apply STIG settings.

CISA's Secure Cloud Business Applications (SCuBA) project publishes minimum secure configuration baselines for Microsoft 365, checked by its ScubaGear tool. They were built for US federal agencies but are published openly and widely used as a reference. EtherInsights scores your tenant against them alongside DISA STIG, NSA and NIST guidance and Microsoft's own baselines.

Yes. Conformity reporting is built for repeat use across a customer base, producing the same baseline, overlay, and drift evidence per tenant rather than a one-off assessment format that has to be rebuilt manually for every review.

Baselines and overlays do not change often, but tenant configuration does, through new licences, changed conditional access policies, app registrations, and admin changes. A monthly or quarterly reassessment catches drift before it becomes an audit finding; EtherInsights tracks drift continuously between formal review cycles rather than only at the point of a scheduled report.