A multinational financial services company must simultaneously demonstrate compliance with PCI DSS, ISO 27001, and a regional data protection regulation across its Microsoft 365 and Azure estate. The Chief Compliance Officer wants a single capability that maps overlapping technical and non-technical controls to each regulation, tracks improvement actions with assigned owners, and produces auditor-ready evidence and a quantified compliance score. Which Microsoft solution should the security architect recommend as the primary tool for this requirement?