# M365 Security Review
# Classification: Confidential
# Date: 2026-06-09
# Reviewer: Claude Code (drafted); pending Founder approval
# Status: Draft

---

## 1. Vendor / Device Overview

| Field | Value |
|---|---|
| **Name** | Microsoft 365 (Microsoft Corporation) |
| **Website** | microsoft.com · trust: servicetrust.microsoft.com |
| **Service / purpose** | Productivity & identity suite — Exchange Online (email), SharePoint/OneDrive (document store), Entra ID (identity), M365 Groups, shared mailboxes |
| **CBB use case** | Primary business platform — **all CBB/ScopeDOPE documentation including the SPEC (Tier 4) lives in OneDrive/SharePoint**; email; Entra ID is the identity backbone for Azure, DocuSeal managed identity, app registrations |
| **Data tier(s) accessed** | **Tier 1–4 (all tiers)** — this is the system of record for Highly Confidential material |
| **Access type** | Entra ID identity; Graph API (app registrations, managed identities); admin portal |
| **Proposed onboarding date** | Already in production — retrospective review |

---

## 2. Data Exposure Assessment

### 2.1 What CBB data will this vendor / device access?

M365 **is** the store, not an external party accessing data — but as the custodian it holds:

- **The SPEC and all Tier-4 trade-secret material** (`OneDrive/ScopeDOPE/04_-_Highly_Confidential/SPEC/`)
- All Confidential (Tier 3) infrastructure, legal, financial, and strategy docs
- Business email (Exchange Online), including IVR voicemail notifications
- Signed legal agreements (DocuSeal → OneDrive)
- Identity data (Entra ID users, groups, app registrations, service principals)

### 2.2 Where will CBB data be stored by this vendor?

On Microsoft's cloud (tenant `d553115d-3f7e-4bb8-8052-946b328cca87`). Encrypted at rest and in transit. Data residency per the tenant's configured geography *(reviewer to confirm region)*.

### 2.3 Is any Highly Confidential data (Tier 4) involved?

- [x] **Yes** — M365 (OneDrive/SharePoint) is the **sole authoritative home of the SPEC and all trade-secret material.** This is the highest-stakes vendor in the estate.
- [ ] No

> **Necessity & mitigations:** Tier-4 storage here is intentional and necessary — it is the controlled, access-managed system of record. Mitigations: Security Defaults (MFA tenant-wide), tier-segmented folder structure (01→04), Entra ID access control, and the planned hardening backlog (Conditional Access, DLP, retention — see §3 / Acquisition Brief gaps). The Tier-4 SPEC folder's access must be the most tightly scoped in the tenant.

---

## 3. Vendor Security Posture (Software vendors only)

### 3.1 Compliance and certifications

| Standard | Certified? | Notes |
|---|---|---|
| SOC 2 Type II | Yes | Microsoft 365 SOC reports via Service Trust Portal |
| ISO 27001 | Yes | M365 ISO/IEC 27001 certified (also 27017, 27018, 27701) |
| GDPR compliant | Yes | Microsoft GDPR commitments; DPA via the Microsoft Products and Services Data Protection Addendum (DPA) |
| CCPA compliant | Yes | Addressed in Microsoft DPA |

> Reviewer can download current M365 SOC 2 / ISO certificates from servicetrust.microsoft.com at approval.

### 3.2 Data processing agreement

- [x] Microsoft DPA (Products and Services Data Protection Addendum) applies to the tenant
- [ ] Not available

### 3.3 Breach history

No M365-platform customer-data breach attributable to CBB's use known at drafting. (Microsoft has disclosed nation-state incidents affecting Microsoft corporate/some customer mail — e.g., 2023 Storm-0558, 2024 Midnight Blizzard. These inform the case for Conditional Access + MFA hardening below.) Reviewer to re-assess at approval.

### 3.4 Security documentation

- [x] Service Trust Portal published (servicetrust.microsoft.com)
- [x] SOC 2 / ISO / FedRAMP reports available
- [x] Microsoft Security Response Center (MSRC) disclosure program

### 3.5 Authentication and access control

- [x] MFA — Security Defaults enforce MFA tenant-wide (`enable_security_defaults.ps1`); primary admin (`jschwefel@`) MFA registered
- [—] **Conditional Access** — **deferred (tier-gated, §7)** — requires Business Premium / Entra ID P1, above the current SKU. At the current tier, MFA via Security Defaults is the in-tier control. Not held open as a condition.
- [x] Scoped app registrations — governed by `Entra_App_Registration_Policy.md` (one app per purpose, minimum scopes)

---

## 4. Hardware Security Assessment

**N/A** — software/SaaS vendor.

---

## 5. Integration Security

### 5.1 Credential management

- [x] Entra ID is the identity provider; app registrations follow the one-app-per-purpose policy with minimum scopes.
- [x] DocuSeal→OneDrive uses a **system-assigned managed identity** (no stored credential, no licensed user account).
- [x] `app-docuseal-sharepoint-prod` registration cert is in `kv-cbb-shared-prod`.
- [x] Admin password + recovery in the CBB credential store; **personal Gmail is recovery-only and never used for CBB services** (CLAUDE.md).
- [ ] **Pending in-tier hardening scripts** (from Acquisition Brief): `harden_eop.ps1`, `sharing_policy.ps1`, `enable_mailbox_audit.ps1`, `configure_alert_policies.ps1`, `enable_ome.ps1`, `exo_auto_replies.ps1` — run order in `M365_Operating_Runbook.md`. (`purview_retention_policy.ps1` is **tier-gated → §7**, not in this in-tier list.)

### 5.2 Network exposure

Cloud SaaS / IdP. Internet-facing by nature (mail, identity, SharePoint). In-tier hardening via EOP and sharing policy (pending scripts above). Conditional Access (location/device) is **deferred — tier-gated, §7**.

### 5.3 Offboarding plan

M365 is the core tenant — offboarding = tenant transfer in an acquisition, not deletion. For a ScopeDOPE-only sale, ScopeDOPE SharePoint/OneDrive content and the SPEC transfer per the deal; CBB Corporate content stays. Entra app registrations and managed identities are re-pointed or revoked per the IP transfer plan.

---

## 6. Risk Summary

Risks are assessed **at the current tier** (`MICROSOFT_365_BUSINESS_STANDARD_NO_TEAMS`, confirmed via Graph `subscribedSkus` 2026-06-09 — no Entra ID P1/P2, no Business Premium). Controls that require a higher tier are **not** treated as open security conditions here; they are recorded in §7 (Deferred) and become live conditions only when CBB moves to the tier that includes them.

| Risk | Likelihood | Impact | Mitigation (in-tier) |
|---|---|---|---|
| Tenant credential compromise → full access to Tier-4 SPEC | L | **H** | Security Defaults enforce MFA tenant-wide; tier-segmented folder access; admin MFA registered. (Conditional Access would further reduce this — deferred, §7.) |
| Over-permissioned app registration | L | M | `Entra_App_Registration_Policy.md`; one-app-per-purpose; managed identities preferred |
| In-tier hardening not yet applied (EOP, sharing policy, mailbox audit, alert policies, OME) | M | M | Run the pending **in-tier** hardening scripts per the Operating Runbook order |
| Vendor (Microsoft) platform incident | L | M | First-party SOC 2/ISO; MFA on |

**Overall risk rating:** **Medium** — driven by Tier-4 SPEC custody under MFA-only (Security Defaults) protection. This is the residual risk **at the current tier**; it is accepted as a deliberate tier decision, with Conditional Access / DLP / retention deferred to a future Business Premium move (§7), not held open as conditions.

**Recommendation:** **Approve with conditions** — pending Founder sign-off. (M365 is necessary and well-certified; the in-tier conditions are CBB-side hardening within the current SKU.)

**Conditions (in-tier — actionable now):**
1. Run the pending **in-tier** hardening scripts per the Operating Runbook order (`harden_eop.ps1`, `sharing_policy.ps1`, `enable_mailbox_audit.ps1`, `configure_alert_policies.ps1`, `enable_ome.ps1`, `exo_auto_replies.ps1`); record completion.
2. Confirm tenant data-residency region.
3. Verify Tier-4 SPEC folder access is the most tightly scoped in the tenant.
4. Add M365 to the "CBB Risk Register" SharePoint List (note the deferred-control acceptances from §7).

---

## 7. Deferred — Pending Tier Move

The following controls require a **higher license tier than the current `MICROSOFT_365_BUSINESS_STANDARD_NO_TEAMS` SKU** and are **deliberately deferred until CBB moves to that tier.** They are documented here for acquisition visibility and as a ready-to-execute backlog — they are **not** open security conditions at the current tier, and their absence is an accepted tier decision.

| Deferred control | Requires | Why it's wanted | Trigger to activate |
|---|---|---|---|
| **Conditional Access** (location/device/risk-based sign-in policies) | Entra ID P1 (in Business Premium); risk-based needs P2 | Stops a phished/replayed credential from reaching the Tier-4 SPEC; biggest single uplift over MFA-only | On Business Premium / Entra ID P1 upgrade |
| **DLP (Purview Data Loss Prevention)** | Business Premium | Prevents accidental exfiltration of confidential/PII content | On Business Premium upgrade |
| **Email retention (Purview Data Lifecycle Mgmt)** | Business Premium (`INFORMATION_PROTECTION_COMPLIANCE` service plan — confirmed absent in current SKU) | 7-year email retention; `purview_retention_policy.ps1` staged and ready | On Business Premium upgrade (run `purview_retention_policy.ps1`) |

> Each item, when triggered, requires its own **cost-impact analysis + Founder approval** before the SKU upgrade (CLAUDE.md). `purview_retention_policy.ps1` is written and waiting; CA and DLP are configured post-upgrade. **Security-Defaults → Conditional-Access migration ordering note:** the two are mutually exclusive — the first CA policy must re-establish the tenant-wide MFA floor before Security Defaults is turned off, or the tenant is briefly weakened.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/M365/M365_Security_Review.md` |
| **Cross-references** | `M365_Architecture_Reference.md`; `M365_Acquisition_Brief.md`; `M365_Operating_Runbook.md`; `Entra_App_Registration_Policy.md`; "CBB Risk Register" SharePoint List |
| **Created** | 2026-06-09 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-09 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-09 | Claude Code | — | — | Initial draft. Posture verified via Microsoft Service Trust Portal (SOC 2, ISO 27001/27017/27018/27701, GDPR DPA). Flags this as the highest-stakes vendor (Tier-4 SPEC custody) and Conditional Access / DLP / retention as priority CBB-side hardening gaps. Recommends Approve with conditions. Version number to be assigned by Founder. |
| DRAFT | 2026-06-09 | Claude Code | — | — | Tier verified via Graph `subscribedSkus` = `MICROSOFT_365_BUSINESS_STANDARD_NO_TEAMS` (no P1/Premium). Reclassified Conditional Access / DLP / Purview retention from open conditions to a new **§7 Deferred — Pending Tier Move** (per Founder rule: higher-tier controls are deferred until the tier move, not held as conditions). Risk summary recomputed in-tier; conditions reduced to in-tier hardening. Added CA↔Security-Defaults migration-ordering note. |
