Question

A multinational insurer must comply simultaneously with GDPR, PCI DSS, and a new regional data-residency law. The compliance team hands the security architect a list of legal obligations expressed in regulatory language. The architect must design a repeatable process that translates these obligations into concrete, testable technical and administrative controls, tracks implementation status across Microsoft 365 and Azure, and provides evidence for auditors — without manually reinventing control mappings for each overlapping regulation. Which approach best meets this requirement?

Accepted Answer

Use Microsoft Purview Compliance Manager, selecting the prebuilt regulatory assessment templates and leveraging its shared controls so a single implemented control satisfies overlapping requirements across GDPR, PCI DSS, and custom templates for the residency law.

Answer

Assign the built-in regulatory compliance standards in Microsoft Defender for Cloud and rely solely on its recommendations to cover all obligations across Microsoft 365 and Azure.

Answer

Create a set of Azure Policy initiatives that deny non-compliant resource configurations, treating each regulation as an independent initiative with no shared definitions.

Answer

Export Microsoft Purview Audit logs to a SIEM and build custom dashboards that map each regulation's clauses to log queries for auditor evidence.