NIS2 is in force and your tenant already covers more than you think. The Article 21 to Microsoft 365 mapping, the 24/72-hour reality, and a 90-day plan.

The 30 checks I run in every Microsoft 365 SMB tenant: identity, email, devices, data, monitoring and governance — with evidence pack and quarterly cadence.

Practical 2026 NIS2 framework for Microsoft 365 admins in SMBs: scope check, 10 Article 21 measures mapped to M365, gaps, 24h/72h/1-month reporting, management body accountability.