Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Security standards and frameworks help organizations define security objectives, practices, and requirements. The Microsoft Security Adoption Framework (SAF) helps translate these standards and frameworks into coordinated security work across business, technology, and security roles and connects that work to technology implementation.
This guidance helps organizations understand how established security standards and frameworks relate to SAF and Microsoft security technologies. The framework mappings provide more detailed alignment where available.
Organizations can use this guidance and the mappings to:
- Translate standards and framework objectives into actionable security work. Connect objectives, practices, and requirements to SAF security disciplines, roles, and responsibilities.
- Plan and implement security improvements. Identify relevant security capabilities, technologies, implementation guidance, and Microsoft products that can help address framework objectives and organizational priorities.
- Coordinate work across business, technology, and security teams. Provide shared context for planning, architecture, implementation, operations, and security oversight.
- Assess progress and communicate alignment. Relate security improvements and implemented capabilities back to the objectives and requirements of the standard or framework.
These mappings help organizations apply standards and frameworks using SAF and Microsoft security technologies. They don't replace authoritative standards, frameworks, or requirements, and they don't by themselves demonstrate compliance.
Zero Trust
Zero Trust provides the security principles that underpin SAF. SAF helps organizations apply these principles across business decisions, security practices, technology design, implementation, and operations.
Use these resources to understand Zero Trust and connect it to SAF:
- Zero Trust overview explains the Zero Trust principles and how organizations can apply them across their security strategy.
- Zero Trust frameworks and standards connects Zero Trust guidance to established frameworks, standards, and related implementation guidance.
Framework mappings
Use these mappings to connect objectives from established security frameworks and strategies to SAF guidance, security capabilities, technology implementation, and relevant Microsoft product guidance. This helps organizations align security work with framework objectives and requirements.
CISA Zero Trust Maturity Model
Use the CISA Zero Trust Maturity Model overview to connect CISA Zero Trust capabilities and maturity objectives to SAF guidance, technologies, and related Microsoft implementation guidance.
DoD Zero Trust Strategy
Use the DoD Zero Trust Strategy overview to connect DoD Zero Trust capabilities and activities to SAF guidance, technologies, and related Microsoft implementation guidance.
Use a standard or framework as a SAF starting point
The mappings show how objectives, practices, and requirements from standards and frameworks connect to SAF guidance and technology implementation. You can also use a standard or framework as a practical starting point for security adoption. This approach is useful when your organization already uses a framework, must meet specific requirements, or wants to use an established framework to structure security improvements.
To use a standard or framework as a SAF starting point:
- Identify relevant objectives, practices, or requirements from the standard or framework.
- Connect them to SAF guidance and security disciplines to understand the security work needed.
- Identify the technologies that you must protect and the roles involved.
- Identify implementation options by using relevant technical solutions and Microsoft product guidance.
- Assess progress and alignment against organizational outcomes and applicable framework or standard objectives.
Standards and frameworks can provide important structure and requirements for security programs, but alignment or compliance alone doesn't define security success. SAF helps organizations connect framework-driven work to broader security outcomes, strategy, architecture, implementation, and operations.