Approve a risk analysis before hosting sensitive data in Microsoft 365

Description

Before sensitive information systems or data are hosted in Microsoft 365, the organization carries out a business and legal impact study and a risk analysis, approved and signed by the highest authority of the entity (or its delegate). The analysis covers at least:

• the sensitivity of the data and processing (confidentiality, integrity, availability), and the systems concerned (for example restricted-distribution systems, sensitive systems of operators of vital importance or essential services, health data, personal data);
• the maximum threat level these systems face;
• the specific risks of a shared public cloud (internet exposure, shared infrastructure, provider staff access, see CB-M365-DATA-008);
• the legal risk of extraterritorial laws that can compel the provider to hand over data;
• the decision: data allowed in Microsoft 365, allowed with additional measures (for example customer-managed encryption keys, double key encryption, sensitivity labels with encryption), or to be hosted on a qualified offer such as SecNumCloud.

The analysis is reviewed when the data, the threat or the legal context changes, and at least every three years. It also defines a reversibility plan.

This is an organizational control: the evidence is a document, not a tenant setting. It has no equivalent in CIS or SCuBA.

Rationale

Technical hardening does not answer the question of whether some data should be in a public commercial cloud at all. ANSSI recommends that the decision to move information systems to the cloud be taken at the highest level of the entity, informed by an impact study and a risk analysis that weighs data sensitivity, threat and extraterritorial legal exposure. For some categories of systems, regulation or doctrine requires a SecNumCloud-qualified offer.

Impact

Takes time from business owners, legal team, DPO and security. Can lead to moving some data out of Microsoft 365 or adding encryption with customer-held keys, which limits some features (search, Copilot, eDiscovery on encrypted content).

Audit

1. Ask the security officer (RSSI) for the cloud hosting risk analysis covering Microsoft 365.
2. Check that it covers the four topics of the description (data sensitivity, threat level, public cloud risks, extraterritorial laws) and records a decision per data category.
3. Check that it is signed by the entity's management or its formal delegate, is less than three years old, and matches the current use of Microsoft 365 (new workloads such as Copilot included).
4. Sample a few sensitive data categories and check that the measures decided (for example encryption labels, data kept on another platform) are applied.
5. Fail if no analysis exists, if it is unsigned or outdated, or if sensitive categories are hosted against its decision.

Remediation

1. Inventory the data categories and information systems hosted or planned in Microsoft 365.
2. With business owners, the legal team and the DPO, run the impact study and risk analysis (for example with the EBIOS Risk Manager method), using the ANSSI cloud hosting recommendations to decide which offer type each category requires.
3. Define additional measures (encryption with customer-managed keys or double key encryption, labels, Customer Lockbox) or a migration to a qualified offer where required, and a reversibility plan.
4. Have the decision signed by management and plan its periodic review.

Rollback

Not applicable.

References

• Recommandations pour l'hébergement dans le cloud des systèmes d'information sensibles ANSSI, guide, accessed 2026-10-24
• Recommandations pour l'hébergement dans le cloud des SI sensibles (PDF) ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-DATA-008 Enable Customer Lockbox

People and lifecycle