Your M365 tenant is already generating ISO 27001 evidence.
Certaria maps your M365 configuration to ISO 27001 controls; your Microsoft Teams workflow guides the work, with an optional AI Agent. No consultant required.
- Read-only scan: your data stays in your tenant
- Annex A mapped from live M365 configuration
- Built on Microsoft Power Platform
- Read-only scan permissions
- No data leaves your tenant
- Built on Microsoft Power Platform
Talastron built Certaria for real ISO 27001 workloads on Microsoft 365. Meet the team How it works Pricing
functional requirements
Annex A categories (the ISO 27001 control groups)
minute initial scan
per year, all inclusive
What you already have
You're not starting from zero.
Your Microsoft 365 tenant already produces security evidence that counts toward ISO 27001.
Device management
Intune policies controlling which devices access company data. That is evidence for asset management and endpoint security controls.
Access control
Conditional Access policies deciding who signs in and from where. That is evidence for access controls and identity management.
Data protection
Sensitivity labels on documents and emails. That is evidence for information classification and data handling controls.
How Certaria works
Certaria reads it, maps it, guides you.
Your M365 security configuration maps to ISO 27001 controls. Certaria maps it automatically.
Conditional Access is already ISO 27001 evidence.
Your policies controlling who signs in, from where, and on which devices map directly to Annex A access control requirements. Certaria reads this automatically.
See what we detectAI tells you exactly what to do next.
Certaria generates prioritised tasks based on your scan results. Each task maps to a specific ISO 27001 control. No guesswork: the workflow walks you through each task in Microsoft Teams, with the optional Certaria AI Agent for conversational interpretation when you enable Copilot Credits.
See the full processAsk your ISMS anything, in Teams.
A Copilot agent that understands ISO 27001 and your specific implementation. Ask about controls, get policy guidance, check your progress. All inside Microsoft Teams.
Learn moreWhat do I need for Annex A.8 access control?
Based on your scan, you already have 3 of 5 controls evidenced. You still need:
- -Access review schedule
- -Privileged access policy
Pricing
£3,990/year. Not £15,000-40,000.
Complete ISO 27001 software. Microsoft Teams workflow from Day 1; optional AI Agent via Copilot Credits.
Certaria Standard
Complete ISO 27001 software with AI agent
See full pricingTypical consultant
Year 1, then £5-10k ongoing
How it works
Three steps. AI-guided every step of the way.
From first scan to certification, you stay in control.
What's included
Everything you need. Nothing you don't.
A complete ISMS on the platform you already pay for.
Readiness Scan
Automated M365 configuration analysis mapping to all 14 Annex A control categories. Five minutes, read-only. Initial plus monthly recurring.
AI Compliance Agent
In-Teams Copilot agent for ISO 27001 guidance in the context of your ISMS.
What controls am I missing?
You need 2 more: access review and privileged access.
Policy Templates
Pre-built policies deployed to SharePoint. Editable, auditor-ready.
Task Generation
Automated gap-closing tasks prioritised by impact across your team.
Evidence & Progress
Graph API collects M365 evidence automatically. Real-time dashboard tracks coverage with exportable reports.
Our story
Built by a team certifying themselves with it.
Talastron built Certaria to solve our own ISO 27001 challenge. Same constraints: small team, tight deadlines, the need to certify without putting the business on hold.
We built an AI compliance agent in Microsoft Teams to do the work, and we're using Certaria to pursue our own certification. Not as a demo. As our actual ISMS.
The scars are in the product.
Microsoft professional certifications
Azure, Data, AI, and Power Platform
Cyber Essentials Certified
UK Government-backed baseline
ISO 27001
Pursuing with Certaria. Target: Nov 2026.
See where you stand.
Run the free readiness scan to see how much of ISO 27001 your Microsoft 365 tenant already covers. Five minutes, read-only, and nothing leaves your environment.