L18. Regulatory Compliance and Governance
Visual workflow edition
Worked example, diagrams and a question with time to think. Synthetic American-English narration; examples are fictional. Reviewed October 2026.
Read the video transcript
Your compliance dashboard looks healthy. Does that mean the organization is certified? No. Automated assessments cover particular technical conditions. A compliance conclusion also depends on scope, evidence, processes, and the relevant assessment requirements. This lesson turns a dashboard finding into an evidence-backed improvement instead of an unsupported claim.
A standard organizes requirements. A control describes an expected safeguard or outcome. An automated assessment checks a particular condition that may support that control. These layers are related, but they are not interchangeable. Review the mapping and applicability. A passing technical check does not automatically satisfy every organizational requirement associated with the control.
In our fictional example, a control has an unhealthy technical assessment for one resource. Identify the resource and the recommendation behind the result. Confirm whether the control applies to the environment. Assign the right owner and decide what evidence will show improvement. Avoid collecting large amounts of irrelevant data simply to make the evidence folder look complete.
Record the original condition, the authorized remediation, and the verified result. Include scope and timing so another reviewer can understand what was tested. Some requirements need procedural or other evidence outside an automated dashboard. Keep those responsibilities visible. A technical result should support the assessment, not silently replace the parts it cannot measure.
State which resources and requirements were assessed, which exceptions remain, and what is outside the available evidence. A missing assessment is different from a passing assessment. Discuss results with the responsible governance or audit team. Avoid describing a dashboard score as a legal guarantee or an independent certification of the organization.
One mapped technical assessment changes from unhealthy to healthy after a verified fix. What can you safely claim? Pause and choose the narrowest statement supported by the evidence.
You can claim that the specific assessed condition passed within the verified scope and time. You cannot infer that the entire organization is certified or risk free. Across this course, the same habit applies: understand the signal, check the boundary, take an authorized action, and verify the result. Continue with the linked lessons and current Microsoft study guide.
Course outlineLesson 18 of 18
Defender for Cloud maps security controls to regulatory frameworks and provides governance tools for tracking remediation progress. This lesson covers compliance standards, regulatory compliance dashboard, governance rules, and export capabilities for the SC-200 exam.
Regulatory Compliance Dashboard
The regulatory compliance dashboard in Defender for Cloud shows how your environment maps to industry standards and regulations. Each standard is broken into control families, and each control maps to specific security recommendations.
The dashboard displays:
- Compliance score: Percentage of passing controls per standard
- Control status: Passed, Failed, or Manual assessment needed
- Resource compliance: Per-resource compliance for each control
- Audit evidence: Exportable compliance reports
Available Compliance Standards
Defender for Cloud supports numerous standards:
| Standard | Scope |
|---|---|
| Microsoft Cloud Security Benchmark | Default for all subscriptions |
| NIST 800-53 | US federal government baseline |
| PCI DSS v4.0 | Payment card industry |
| ISO 27001 | International security management |
| SOC 2 Type 2 | Service organization controls |
| CIS Azure/AWS/GCP Benchmarks | Platform-specific hardening |
| HIPAA HITRUST | Healthcare data protection |
| FedRAMP | US government cloud services |
Manual Attestation
Some regulatory controls cannot be assessed automatically (e.g., "Do you have an incident response plan?"). These require manual attestation:
- Navigate to the control in the compliance dashboard
- Click the control requiring manual assessment
- Select the attestation state: Compliant, Non-compliant, or Not applicable
- Add evidence (documents, links, descriptions)
- Set a review date
Manual attestations are tracked alongside automated assessments in the dashboard.
Governance Rules
Governance rules assign ownership and deadlines for recommendation remediation:
- Owner: Email address of the person responsible for remediation
- Deadline: Date by which the recommendation must be resolved
- Grace period: Time after which overdue items are flagged
- Email notifications: Automatic reminders sent to owners
Configure governance rules to apply to:
- Specific recommendations or recommendation categories
- Specific resource types
- Specific subscriptions or management groups
Continuous Export
Export Defender for Cloud data for integration with external systems: Export destinations:
- Log Analytics workspace: Query data with KQL, create Sentinel analytics rules
- Event Hub: Stream to third-party SIEMs or custom applications
- CSV/PDF: Manual compliance report exports
- Security recommendations and their status
- Secure Score changes over time
- Security alerts
- Regulatory compliance assessment results
Azure Policy Integration
Defender for Cloud recommendations are driven by Azure Policy:
- Each recommendation maps to one or more policy definitions
- Policies are grouped into initiatives (the compliance standards)
- Custom policies can be created and added to custom initiatives
- Policy enforcement modes: Audit (detect only) or Deny (prevent non-compliant deployment)
Multi-Cloud Compliance
Regulatory compliance assessments extend to AWS and GCP:
- Standards are applied at the connector level
- AWS and GCP resources are assessed using equivalent controls
- A single dashboard shows cross-cloud compliance posture
- Custom standards can include cross-cloud controls
This enables organizations to demonstrate compliance across their entire cloud estate from a single interface.
- ✓Adding a compliance standard maps existing recommendations to its controls; it does not create new assessments.
- ✓Controls without automated assessments require manual attestation with evidence and review dates.
- ✓Governance rules assign remediation owners and deadlines but do not enforce remediation.
- ✓Continuous export to Log Analytics enables Sentinel analytics rules based on Defender for Cloud data.
- ✓The Azure Policy Deny effect prevents deployment of non-compliant resources at the ARM layer.
- ✓Multi-cloud compliance shows Azure, AWS, and GCP posture in a single dashboard.
1. An organization adds the PCI DSS v4.0 standard to Defender for Cloud. What happens immediately?
2. A regulatory control requires verification that an incident response plan exists. This cannot be assessed automatically. What should the compliance team do?
3. An organization wants to create Sentinel analytics rules that trigger when the Defender for Cloud Secure Score drops. Which feature enables this?
Review what you learned
Use the knowledge check above to test your understanding. You can browse every lesson without signing in; opening another lesson does not mark this one complete.
Try the SC-200 practice exam →