Frameworks and benchmarks

The Compliance tab in the portal shows, for each framework, which of its requirements Mito checks automatically and how those checks did in your latest assessment. This page explains what the numbers mean.

Evidence, not certification

Mito supports your work towards these frameworks by providing evidence from automated checks of your Microsoft 365 settings. It doesn’t make your organisation compliant or certified, and a passing check isn’t an audit result.

Only technical settings are checked automatically. Every framework also needs non-technical controls, such as policies, risk assessment, awareness training, supplier management and incident response, that Mito can’t see. For CIS, some recommendations are manual by design and always need a person to review them.

The frameworks

Framework	Version	What Mito covers today
CIS Microsoft 365 Foundations Benchmark	7.0.0	104 of 160 recommendations have at least one automated Mito check (75 of 115 at Level 1, 29 of 45 at Level 2). 17 recommendations are manual in the benchmark itself.
ISO/IEC 27001:2022 Annex A	2022	41 of 93 controls get technical evidence from Mito checks. Most Annex A controls are organisational, people or physical controls that no configuration check can show.
UAE Information Assurance Regulation (TDRA)	1.1 (March 2020)	40 of 188 controls get technical evidence from Mito checks (37 of the 128 technical controls). The 60 management controls and most physical, supplier and continuity controls need evidence no configuration check can show.

CISA SCuBA and NIST SP 800-53 are used in the background as technical references for individual checks (you’ll see them under Framework controls on a check’s page), but they aren’t shown as frameworks in the portal.

How a check is linked to a requirement

Each link between a Mito check and a requirement was reviewed by hand, with a one-line reason, and is one of two kinds:

• Full match: the check reads the same setting as the requirement and passes under the same condition.
• Partial: the check covers part of the requirement, for example one of several settings, only the default policy, or a slightly different threshold. Every ISO 27001 link is partial: an Annex A control is a management control, and a configuration check can only provide part of the evidence for it.

A check page on this site lists the requirements it provides evidence for under Provides evidence for.

How the status is worked out

CIS is a benchmark of specific settings, so each recommendation is passing or failing. ISO 27001 and UAE IA controls are management controls where every Mito link is partial, so each control shows its evidence strength instead.

CIS: passing or failing

For each recommendation, in one assessment:

Status	Meaning
Failing	At least one of its checks failed.
Passing	None of its checks failed and at least one passed. “Partial evidence” means only checks that cover part of it passed.
Not assessed	It has checks, but they were skipped (for example a licence or connection Mito doesn’t have) or couldn’t finish.
No automated check	Mito doesn’t check it automatically: it’s manual, Mito doesn’t collect the data it needs (for example Microsoft Fabric), or there’s no check for it yet. Review it yourself or with your IT partner.

ISO 27001 and UAE IA: evidence strength

Each control shows how many of the checks linked to it passed (“9 of 12 checks passed”, with a small bar), and a tier from the share of its assessed checks (those that passed or failed) that passed:

Evidence strength	Meaning
Strong	80% or more of its assessed checks passed.
Partial	40% to 79% passed.
Weak	Fewer than 40% passed.
Not assessed	It has checks, but none passed or failed (skipped or couldn’t finish).
No automated check	No Mito check provides evidence for it; most ISO Annex A and UAE IA controls are about policies, people, premises and suppliers.

The framework summary counts controls per tier and shows the share of all linked checks that passed. Evidence strength describes the technical evidence only: a Strong control isn’t necessarily in place, and a Weak one isn’t necessarily missing. The Excel and CSV exports add an evidence strength column with the tier of each control a check is linked to.

Coverage

The coverage number (“104 of 160 recommendations checked automatically”) counts requirements with at least one Mito check in that assessment. Use the Findings tab’s Framework filter (under More filters) to see every check behind a framework or one requirement. The Excel and CSV exports have one column per framework.

The UAE Information Assurance Regulation

The UAE Information Assurance (IA) Regulation v1.1 is published by the Telecommunications and Digital Government Regulatory Authority (TDRA, formerly TRA; March 2020). It replaced the earlier NESA UAE IA Standards. It applies to UAE government entities and to organisations in sectors the UAE considers critical (such as energy, finance, health, telecommunications and transport), and those organisations often ask their suppliers and service providers to show they follow it too.

It has 188 controls in two groups:

• Management controls, M1 to M6 (60): strategy and planning, risk management, awareness and training, human resources security, compliance, and performance evaluation and improvement.
• Technical controls, T1 to T9 (128): asset management, physical and environmental security, operations management, communications, access control, third-party security, systems acquisition and development, incident management, and continuity management.

Priorities. The regulation puts every control in one of four priorities so an organisation can implement it in phases: P1 first (39 controls), then P2 (69), P3 (35) and P4 (45). The portal shows each control’s priority and lets you filter by it, and the summary shows how much evidence Mito has per priority. Thirty-five management controls are always applicable (Annex A of the regulation): they’re required whatever your risk assessment says, and the portal marks them.

What Mito covers. Mito’s checks give technical evidence for 39 controls: mostly access control (T5: user registration, privilege management, credentials and multi-factor authentication, secure log-on, information access restriction, remote and mobile access), operations (T3: malware protection, audit logging and monitoring, secure configuration), communications (T4: electronic messaging and information transfer, network services) and a few others (T1 asset inventory and classification, T7 message integrity, key protection, data leak prevention and vulnerability management, T8 event reporting, and the technical side of M5 records, privacy and misuse monitoring). By priority: 16 of 39 P1 controls, 12 of 69 P2, 5 of 35 P3 and 6 of 45 P4. Every link is partial: a Microsoft 365 setting is technical evidence for part of a control, never the whole control. The other 149 controls (policies, risk assessment, training, HR, physical security, suppliers, incident response, continuity) show No automated check and need evidence from you.

Mito provides evidence towards the UAE IA Regulation; it doesn’t make you compliant, and only TDRA, your sector regulator or an auditor can assess conformity. Control numbers, short titles, priorities and applicability come from the official TDRA publication; the regulation text isn’t reproduced here.

About the CIS catalogue

Recommendation numbers, levels (L1, L2) and licence profiles (E3, E5) come from the CIS Microsoft 365 Foundations Benchmark v7.0.0. Mito shows the recommendation number and a short title written by us; the benchmark text isn’t reproduced. Get the full benchmark free of charge from cisecurity.org.

ISO/IEC 27001 control numbers and titles are © ISO/IEC; the standard is available from ISO or your national standards body.