Skip to content

Pre-Session Homework: Compliance Officer

This page lists the 53 control(s) you are responsible for as Compliance Officer. Please review each control and bring the requested evidence to your assessment session.

For the full assessment experience, see the Readiness Assessment.

Control 1.1 — Restrict Agent Publishing by Authorization

Security · Zone 1, Zone 2, Zone 3

Pass criteria: Environment Maker role removed from All Users; named publisher security group exists; share-with-everyone disabled and agent publish gated by approval workflow across Zone 2/3 environments.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.11 — Conditional Access and Phishing-Resistant MFA

Security · Zone 1, Zone 2, Zone 3

Pass criteria: CA policies require phishing-resistant MFA (FIDO2/passkey/WHfB/CBA) for agent makers, owners, and admins; break-glass excluded; CA for Workload Identities applied to agent service principals.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.13 — Sensitive Information Types (SITs) and Pattern Recognition

Security · Zone 2, Zone 3

Pass criteria: FSI-relevant built-in and custom SITs (SSN, credit card, ABA routing, account numbers, CRD, MNPI keyword dictionary) are deployed and referenced by DLP, sensitivity labels, and DSPM for AI policies.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.14 — Data Minimization and Agent Scope Control

Security · Zone 1, Zone 2, Zone 3

Pass criteria: Each agent has a documented grounding inventory with zone-based justification, narrowed SharePoint scopes, public web grounding disabled for Zone 3 NPI agents, and active scope-drift monitoring.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.15 — Encryption: Data in Transit and at Rest

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.16 — Information Rights Management (IRM) for Documents

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.17 — Endpoint Data Loss Prevention (Endpoint DLP)

Security · Zone 2, Zone 3

Pass criteria: Devices onboarded via Defender for Endpoint with Endpoint DLP blocking restricted apps, USB/removable media, personal cloud uploads, and Edge for Business AI-paste rules for unmanaged AI.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.18 — Application-Level Authorization and Role-Based Access Control (RBAC)

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.2 — Agent Registry and Integrated Apps Management

Security · Zone 1, Zone 2, Zone 3

Pass criteria: All agents and integrated apps registered with named owner and backup owner, admin consent workflow enabled, and no orphaned service principals across Entra, Integrated Apps, and Copilot Studio.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.20 — Network Isolation and Private Connectivity

Security · Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.21 — Adversarial Input Logging

Security · Zone 2, Zone 3

Pass criteria: Adversarial-input signals captured across Prompt Shields, Defender XDR Copilot, Communication Compliance Prompt Shield classifier, and DSPM for AI, with Sentinel cross-plane correlation.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.22 — Information Barriers for AI Agents

Security · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.23 — Step-Up Authentication for AI Agent Operations

Security · Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.28 — Policy-Based Agent Publishing Restrictions

Security · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.3 — SharePoint Content Governance and Permissions

Security · Zone 1, Zone 2, Zone 3

Pass criteria: External sharing restricted; Everyone groups removed from agent knowledge sites; container sensitivity labels applied; SAM RAC/RCD enabled and quarterly access reviews active for Zone 3.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 1.9 — Data Retention and Deletion Policies

Security · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.1 — Managed Environments

Management · Zone 1, Zone 2, Zone 3

Pass criteria: All Zone 2/3 environments designated as Managed with sharing limits, solution-checker enforcement, weekly digest reviewed, IP firewall configured, and maker welcome content published.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.11 — Bias Testing and Fairness Assessment

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.12 — Supervision and Oversight (FINRA Rule 3110)

Management · Zone 1, Zone 2, Zone 3

Pass criteria: WSP addendum covers AI communications, qualified principal designated, HITL configured for Zone 3 customer-facing outputs, sampling protocol documented, and supervisory review evidence retained.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.13 — Documentation and Record Keeping

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.14 — Training and Awareness Program

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.15 — Environment Routing and Auto-Provisioning

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.16 — RAG Source Integrity Validation

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.17 — Multi-Agent Orchestration Limits

Management · Zone 2, Zone 3

Pass criteria: Multi-agent designs document delegation depth limits, circuit breakers, HITL triggers, and the 128-tool ceiling; A2A/MCP cross-protocol chains tracked in the agent inventory.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.18 — Automated Conflict of Interest Testing

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.19 — Customer AI Disclosure and Transparency

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.2 — Environment Groups and Tier Classification

Management · Zone 1, Zone 2, Zone 3

Pass criteria: Environment groups aligned to Zone 1/2/3 with rules published per zone (sharing, channels, AI model restrictions, CUA disabled), and routing places makers into the correctly governed environment.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.21 — AI Marketing Claims and Substantiation

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.22 — Inactivity Timeout Enforcement

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.24 — Agent Feature Enablement and Restriction Governance

Management · Zone 1, Zone 2, Zone 3

Pass criteria: Per-zone feature catalog approved by change management; tenant, environment, and agent-level toggles enforce it; preview/MCP/code-interpreter features explicitly approved per zone.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.25 — Microsoft Agent 365 — Admin Center Governance Console

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.26 — Entra Agent ID — Identity Governance for Agents

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.3 — Change Management and Release Planning

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.4 — Business Continuity and Disaster Recovery

Management · Zone 2, Zone 3

Pass criteria: Critical agents tier-classified with documented RTO/RPO, secondary-region environments provisioned, automated solution backup running, and annual DR test executed with results retained.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.5 — Testing, Validation, and Quality Assurance

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.6 — Model Risk Management (OCC 2011-12/SR 11-7)

Management · Zone 1, Zone 2, Zone 3

Pass criteria: AI agents classified within the firm's MRM framework with model inventory, independent validation, ongoing performance monitoring, bias testing, and change-control evidence retained per 17a-4(f).

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.7 — Vendor and Third-Party Risk Management

Management · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 2.8 — Access Control and Segregation of Duties

Management · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.1 — Agent Inventory and Metadata Management

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.11 — Centralized Agent Inventory Enforcement

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.12 — Agent Governance Exception and Override Management

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.2 — Usage Analytics and Activity Monitoring

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.3 — Compliance and Regulatory Reporting

Reporting · Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.7 — PPAC Security Posture Assessment

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.8 — Copilot Hub and Governance Dashboard

Reporting · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 3.9 — Microsoft Sentinel Integration

Reporting · Zone 2, Zone 3

Pass criteria: Sentinel ingests Power Platform Admin Activity, CopilotInteraction, Entra and service-principal sign-ins, and Defender connectors with FSI analytics rules, workbooks, and Logic Apps playbooks.

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 4.1 — SharePoint Information Access Governance (IAG) / Restricted Content Discovery

SharePoint · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 4.2 — Site Access Reviews and Certification

SharePoint · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 4.4 — Guest and External User Access Controls

SharePoint · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 4.6 — Grounding Scope Governance

SharePoint · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 4.7 — Microsoft 365 Copilot Data Governance

SharePoint · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Control 4.8 — Item-Level Permission Scanning for Agent Knowledge Sources

SharePoint · Zone 1, Zone 2, Zone 3

Verify in: See control documentation.

Full control documentation · Portal walkthrough

Generated from assessment/manifest/controls.json by scripts/generate_homework_pages.py. Edit the manifest, then re-run.