{
  "id": "CB-M365-DATA-010",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-010",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-010.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-010.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DATA-010",
    "title": "Approve a risk analysis before hosting sensitive data in Microsoft 365",
    "finding": {
      "title": "Sensitive data is hosted in Microsoft 365 without a documented and approved risk analysis",
      "description": "The organization has not formally assessed whether the sensitivity of its data, the threat level and extraterritorial laws allow hosting it in a public commercial cloud."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "governance",
      "risk-analysis",
      "sovereignty",
      "secnumcloud",
      "gdpr",
      "organizational"
    ],
    "description": "Before sensitive information systems or data are hosted in Microsoft 365, the organization\ncarries out a business and legal impact study and a risk analysis, approved and signed by the\nhighest authority of the entity (or its delegate). The analysis covers at least:\n\n- the sensitivity of the data and processing (confidentiality, integrity, availability), and the\n  systems concerned (for example restricted-distribution systems, sensitive systems of operators\n  of vital importance or essential services, health data, personal data);\n- the maximum threat level these systems face;\n- the specific risks of a shared public cloud (internet exposure, shared infrastructure, provider\n  staff access, see CB-M365-DATA-008);\n- the legal risk of extraterritorial laws that can compel the provider to hand over data;\n- the decision: data allowed in Microsoft 365, allowed with additional measures (for example\n  customer-managed encryption keys, double key encryption, sensitivity labels with encryption),\n  or to be hosted on a qualified offer such as SecNumCloud.\n\nThe analysis is reviewed when the data, the threat or the legal context changes, and at least\nevery three years. It also defines a reversibility plan.\n",
    "rationale": "Technical hardening does not answer the question of whether some data should be in a public\ncommercial cloud at all. ANSSI recommends that the decision to move information systems to the\ncloud be taken at the highest level of the entity, informed by an impact study and a risk\nanalysis that weighs data sensitivity, threat and extraterritorial legal exposure. For some\ncategories of systems, regulation or doctrine requires a SecNumCloud-qualified offer.\n",
    "impact": "Takes time from business owners, legal team, DPO and security. Can lead to moving some data out\nof Microsoft 365 or adding encryption with customer-held keys, which limits some features\n(search, Copilot, eDiscovery on encrypted content).\n",
    "notes": "This is an organizational control: the evidence is a document, not a tenant setting. It has no\nequivalent in CIS or SCuBA.\n",
    "audit": {
      "manual": "1. Ask the security officer (RSSI) for the cloud hosting risk analysis covering Microsoft 365.\n2. Check that it covers the four topics of the description (data sensitivity, threat level,\n   public cloud risks, extraterritorial laws) and records a decision per data category.\n3. Check that it is signed by the entity's management or its formal delegate, is less than three\n   years old, and matches the current use of Microsoft 365 (new workloads such as Copilot\n   included).\n4. Sample a few sensitive data categories and check that the measures decided (for example\n   encryption labels, data kept on another platform) are applied.\n5. Fail if no analysis exists, if it is unsigned or outdated, or if sensitive categories are\n   hosted against its decision.\n"
    },
    "remediation": {
      "manual": "1. Inventory the data categories and information systems hosted or planned in Microsoft 365.\n2. With business owners, the legal team and the DPO, run the impact study and risk analysis\n   (for example with the EBIOS Risk Manager method), using the ANSSI cloud hosting\n   recommendations to decide which offer type each category requires.\n3. Define additional measures (encryption with customer-managed keys or double key encryption,\n   labels, Customer Lockbox) or a migration to a qualified offer where required, and a\n   reversibility plan.\n4. Have the decision signed by management and plan its periodic review.\n",
      "rollback": "Not applicable.\n"
    },
    "references": [
      {
        "title": "Recommandations pour l'hébergement dans le cloud des systèmes d'information sensibles",
        "url": "https://cyber.gouv.fr/publications/recommandations-pour-lhebergement-des-si-sensibles-dans-le-cloud",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommandations pour l'hébergement dans le cloud des SI sensibles (PDF)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/20240814_np_anssi_recommandations_hebergement_cloud_si_a5_v1g_fr.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "RA-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SA-9",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DATA-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}