Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 601–675

Automation rules in Microsoft Sentinel are specifically designed to orchestrate responses to security incidents. By configuring an automation rule to trigger upon incident creation, it can then execute a pre-defined playbook (an Azure Logic App). This playbook can contain various actions, such as sending a notification to a Microsoft Teams channel, thereby automating the initial communication and response for new incidents.

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities specifically for Azure Kubernetes Service (AKS). It offers continuous security recommendations for AKS configurations, scans container images for vulnerabilities, and detects runtime threats within the cluster, including suspicious activities at the pod and node level, making it the primary tool for securing Kubernetes.

Microsoft Defender for Cloud is the correct solution as it provides comprehensive security posture management and threat protection across hybrid and multi-cloud environments. It natively performs vulnerability assessments for Azure virtual machines and on-premises servers, integrating with Azure Arc to extend its capabilities. This service offers continuous monitoring, security recommendations, and compliance management, directly addressing the need for OS-level vulnerability scanning and configuration recommendations.

Deploying password writeback, a feature of Microsoft Entra Connect, allows users to reset or change their Microsoft Entra ID password and have that new password synchronized back to their on-premises Active Directory account. This ensures password consistency across the hybrid environment and enables cloud-initiated password management for on-premises accounts. Concurrently, enabling Microsoft Entra smart lockout protects user accounts from brute-force attacks by intelligently locking out malicious actors while allowing legitimate users to continue accessing their accounts, specifically preventing lockouts in Microsoft Entra ID.

Defender XDR correlates alerts across endpoints, email, etc.

Auto-labeling policies in Microsoft Purview are powerful tools that automatically apply sensitivity labels to content based on predefined conditions. These conditions often include the detection of specific sensitive information types, keywords, or regular expressions within documents and emails. By automatically assigning labels, these policies effectively classify data at scale, ensuring consistent application of classification without requiring manual user intervention.

Automatic classification based on sensitive content is a cornerstone feature of Microsoft Purview Information Protection. This capability leverages sensitive information types, trainable classifiers, and exact data match to automatically identify and categorize sensitive data across various locations, including documents, emails, and cloud services. By proactively classifying content, Information Protection can then apply appropriate sensitivity labels and protection actions, significantly reducing the manual effort required to secure vast amounts of organizational data.

Microsoft Defender for Endpoint incorporates automatic alert suppression mechanisms designed to combat alert fatigue within security operations. When the system detects multiple instances of the exact same threat or activity on a device within a short timeframe, it intelligently suppresses subsequent duplicate alerts. This ensures security analysts can focus on unique, high-fidelity threats rather than being overwhelmed by redundant notifications, streamlining incident response.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It provides comprehensive capabilities for collecting security data from diverse sources, including Microsoft services, other cloud providers, and on-premises infrastructure. Sentinel leverages AI and machine learning for threat detection, investigation, and automated response, making it the ideal platform for monitoring and responding to security threats across an entire enterprise environment.

Sensitivity labels, when configured with encryption, apply rights management protection to documents. This protection can explicitly define which users or groups have specific access rights, such as view-only, edit, or full control. If a user reports being unable to access a sensitive document, it is highly probable that the label's encryption settings have been configured to restrict access to a specific set of authorized individuals, and the reporting user is not included in that authorized list. This is a fundamental capability of Microsoft Purview Information Protection.

Microsoft Purview Data Lifecycle Management (DLM) is specifically designed to help organizations manage their data throughout its entire lifecycle, including long-term preservation. Creating a retention policy to keep financial records for a specified duration, such as seven years, is a fundamental capability within DLM. These policies ensure compliance with legal, regulatory, and business requirements by preventing premature deletion and ensuring data availability.

The customer retains primary responsibility for managing user identities and controlling access within the SaaS CRM application. This involves provisioning user accounts, assigning appropriate roles and permissions, and configuring authentication methods, often integrating with their own corporate identity provider like Azure Active Directory. This ensures that only authorized personnel can access specific CRM functionalities and data, aligning with the principle of least privilege.

Creating an app discovery policy with a governance action to unsanction the app is the correct and most automated method. This policy allows Microsoft Defender for Cloud Apps to continuously scan discovered applications based on defined criteria (e.g., risk score, category, usage patterns). When an app matches the policy, the configured governance action, such as 'Unsanction app,' automatically marks it as unauthorized and triggers enforcement mechanisms, effectively blocking its use across the organization.

Microsoft Purview Compliance Manager is the dedicated solution for simplifying compliance and reducing risk by providing pre-built assessments for common industry regulations, such as HIPAA. It allows organizations to track progress on improvement actions, assign responsibilities, and generate detailed compliance reports, offering a measurable compliance score. This service directly addresses the need to demonstrate and manage an organization's adherence to regulatory requirements through a structured workflow.

This is the most efficient and cloud-native solution. A dynamic group in Microsoft Entra ID can be configured with a rule (e.g., user.manager -ne null) to automatically include all users who have a manager assigned, ensuring membership is always up-to-date. This dynamic group can then be directly targeted by a Conditional Access policy, allowing granular control over application access or other security requirements for this specific user population.

Trainable classifiers learn from examples and improve detection accuracy.

The command Get-AzureADGroupMember successfully retrieves all direct members of the Azure AD group specified by its object ID. Piping this output to Select-Object DisplayName, UserPrincipalName then precisely extracts and displays only the user's friendly name and their unique sign-in identifier. This combination accurately fulfills the objective of reporting specific identity attributes for each member of the Sales group.

Eligible assignment with no end date, approval required, activation max 1 hour.

Azure Policy definitions, particularly for custom assessments, require the `supportedClouds` property (plural) to correctly specify the cloud environments where the policy should be active. The exhibit incorrectly uses `supportedCloud` (singular), which is not a recognized property in the Azure Policy schema. Furthermore, this property is expected to be an array of strings, even if only one cloud is specified, ensuring proper schema validation and deployment. This specific misnaming and incorrect data type are critical errors preventing successful deployment.

Microsoft Purview Audit (Standard) is specifically designed with a fixed retention period of 90 days for all audit logs. This means that any audit records generated will be automatically retained for exactly 90 days from their creation date. After this 90-day window expires, these logs are automatically and permanently purged from the system, making them irretrievable. This inherent limitation is a primary reason why older audit logs might appear to be missing.

Sensitive information types (SITs) are the fundamental building blocks in Microsoft Purview for automatically identifying sensitive data. They define specific patterns, keywords, regular expressions, and proximity rules that the system uses to detect particular types of sensitive information, such as credit card numbers, national identification numbers, or medical record numbers. This automatic pattern matching is precisely how Purview discovers and classifies data at scale, making SITs the direct answer to automatic classification.

A Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is specifically engineered to identify, monitor, and protect sensitive information sent via email. These policies utilize sensitive information types, keywords, and content matching to detect specific data patterns, such as credit card numbers or national ID numbers, within email messages and attachments. Upon detection, the policy can enforce actions like blocking the email, encrypting it, or notifying administrators, directly preventing unauthorized data egress.

The principle of least privilege dictates that every user, program, and process should be granted only the minimum necessary permissions to perform its legitimate function. This approach significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account or system is compromised. By restricting access to only what is essential, it minimizes the risk of unauthorized actions and data breaches, aligning directly with the scenario described.

Implementing the security recommendations provided by Microsoft Defender for Cloud directly addresses identified vulnerabilities and misconfigurations within your Azure environment. Each recommendation, when remediated, contributes points towards your secure score, reflecting an improved security posture by aligning resources with best practices and security controls. This is the primary mechanism for actively enhancing the secure score and reducing your attack surface.

Microsoft Purview Communication Compliance is specifically designed to help organizations detect and remediate regulatory compliance violations, such as insider trading, harassment, or sensitive data sharing, within their internal and external communications. It uses intelligent templates and customizable policies to proactively scan messages across Microsoft 365 services for specific keywords, sensitive information types, or patterns indicative of policy breaches. Compliance officers can then review, investigate, and take action on identified risky communications through a dedicated workflow.

Self-Service Password Reset (SSPR) directly enables users to reset their forgotten or expired passwords independently, significantly reducing help desk calls. When combined with password protection policies, which are a feature of Microsoft Entra ID, the system enforces rules such as preventing the reuse of a specified number of previous passwords. This combination effectively addresses both requirements: empowering users for self-service and maintaining strong password hygiene through history enforcement.

An auto-labeling policy for sensitivity labels is the precise mechanism within Microsoft Purview designed to automatically apply sensitivity labels to content that contains specific sensitive information types, such as PII. These policies scan content in designated locations (e.g., SharePoint, OneDrive, Exchange) and, upon detecting PII, automatically apply the configured sensitivity label. This label then enforces the associated protection actions, including encryption, visual markings, and access restrictions, thereby directly addressing the requirement to label and protect.

Data Lifecycle Management provides auto-apply retention label policies that can use sensitive information types (SITs) to classify and retain content automatically. This is the correct solution to apply a retention label based on content detection.

Configuring an auto-labeling policy with a sensitive information type for credit card numbers is the most effective and accurate method for automatic protection. This approach leverages Microsoft Purview's built-in capabilities to scan content for specific patterns, keywords, and checksums associated with credit card numbers, then automatically applies the appropriate sensitivity label and its associated protection actions (e.g., encryption, access restrictions) without any user intervention.

Microsoft Entra ID Protection continuously monitors sign-in attempts and user behavior for anomalous activities, such as impossible travel, unfamiliar sign-in properties, or leaked credentials. It assigns a real-time risk score to each sign-in and user, which can then be directly consumed as a condition within Microsoft Entra Conditional Access policies. This allows organizations to enforce adaptive access controls, like multi-factor authentication or blocking access, based on the detected risk level.

Correct. Microsoft Entra ID Free, whether included with Office 365 or standalone, supports SSO across the mentioned services. This option is equivalent to option C.

Access reviews, a core component of Microsoft Entra Identity Governance, enable organizations to efficiently manage group memberships, application access, and role assignments. They allow administrators or group owners to periodically review who has access to what, and crucially, can be configured to automatically remove users from groups if they fail to attest to their continued need for access or if they are identified as inactive based on sign-in data. This capability directly addresses the requirement to maintain clean group memberships by removing inactive users.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across Microsoft 365 services, endpoints, and on-premises repositories. By defining rules based on sensitive information types, labels, or keywords, DLP policies can actively prevent users from sharing files containing sensitive data externally, internally, or to unauthorized applications, thus directly addressing the requirement to block file sharing. These policies enforce controls to stop data exfiltration.

The Microsoft Purview compliance portal audit search provides the native, centralized, and most user-friendly interface for security analysts to query Microsoft 365 audit logs. This dedicated portal allows for comprehensive searching across various services like Exchange Online, SharePoint Online, Teams, and Azure AD, offering extensive filtering capabilities by date, user, activity, and workload. It is specifically designed for investigative purposes, enabling efficient identification of specific user or administrator actions without requiring complex scripting.

Data Lifecycle Management (DLM) effectively establishes a baseline retention policy to retain data for seven years and then automatically delete it, ensuring general compliance with record-keeping regulations. Concurrently, eDiscovery (Premium) allows for the precise application of a legal hold on specific project documents, which critically overrides any deletion policy, including the DLM policy, to preserve evidence for potential litigation. This combination ensures both routine data governance and specific, immutable preservation for legal requirements.

Microsoft Defender for Office 365 is the correct solution as it specifically provides advanced protection against phishing, spam, malware, and other threats delivered via email and collaboration tools like Microsoft Teams. Its key features, Safe Links and Safe Attachments, are designed to perform real-time scanning of URLs and attachments. Safe Links rewrites and scans URLs at the time of click, while Safe Attachments detonates suspicious files in a sandbox environment, directly addressing the need for real-time URL scanning in email and Teams.

Defense in depth is a cybersecurity strategy that employs multiple, independent layers of security controls to protect information and systems. The objective is to ensure that if one security control fails or is bypassed, other controls are in place to prevent or delay a breach, thereby increasing the overall resilience of the system. This layered approach often includes a combination of technical controls like firewalls and intrusion detection systems, administrative controls such as policies and training, and physical controls.

Email & collaboration in Microsoft Defender XDR provides robust, integrated protection for email and collaboration tools like Microsoft Teams, identifying and mitigating threats such as phishing, malware, and spam. It unifies threat investigation and response capabilities across these communication vectors within a single portal, enabling security administrators to proactively defend against sophisticated email-borne attacks and ensure data integrity.

Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables Just-In-Time (JIT) access by allowing users to activate privileged roles only when needed, for a limited duration, and often requiring multi-factor authentication or an approval workflow. PIM also enforces time-bound assignments and provides comprehensive auditing and review capabilities for all privileged role activations, directly addressing the requirement for JIT privileged access management.

Correct. The conditions specify when a policy applies (e.g., when risk is medium or high). Grant controls enforce the required actions: require MFA for medium/high risk and block for high risk. Block access is an available grant control.

The Principle of Least Privilege dictates that users, applications, and systems should be granted only the minimum necessary permissions required to perform their specific job functions or tasks. This fundamental security practice significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account is compromised or an application is exploited. It directly addresses the need to restrict access to only what is absolutely essential, minimizing unauthorized actions.

Microsoft Entra Connect Sync is the designated on-premises agent responsible for synchronizing user identities, groups, and other objects from an on-premises Active Directory to Microsoft Entra ID. It supports various synchronization features crucial for migration, including password hash synchronization (PHS), which securely transfers a hash of the on-premises password to the cloud, enabling single sign-on for users. This tool is fundamental for hybrid identity scenarios, ensuring a consistent user experience across both environments.

Microsoft Entra Domain Services provides a managed domain environment that is fully compatible with traditional Active Directory Domain Services (AD DS). It offers essential domain services like LDAP, Kerberos, and NTLM authentication, which are critical for legacy applications that cannot be easily re-architected to use modern authentication protocols. This service allows companies to lift-and-shift these applications to the cloud without deploying or managing domain controllers, while still leveraging their existing Microsoft Entra ID identities for authentication and directory lookups.

B2B Direct Connect establishes a mutual, two-way trust relationship between two Microsoft Entra ID tenants, enabling users from one organization to access specific resources in the other without creating guest accounts. This feature is primarily used for shared channels in Microsoft Teams, allowing users to collaborate directly and seamlessly across organizations. It eliminates the need for invitations and redemption, providing a more integrated experience for designated collaboration scenarios.

Correct. Information Barriers enforce restrictions between user segments to prevent unwanted communication and collaboration.

DLP blocks sharing; retention policy retains; sensitivity label provides manual classification with encryption and expiration.

Zero Trust is a modern security model that fundamentally shifts from perimeter-based security to a 'never trust, always verify' approach. It mandates explicit verification for every access request, regardless of whether the request originates inside or outside the traditional network perimeter. This model assumes breach and continuously validates identity, device health, and other contextual factors before granting and maintaining access to resources.

Grant controls allow you to either 'Block access' or require specific conditions (e.g., MFA, compliant device) to grant access. The 'Block access' option is located here.

Microsoft Secure Score provides a centralized security posture dashboard.

A conditional access policy is the correct mechanism because it acts as the enforcement engine, evaluating various signals including the device's compliance status reported by Intune. This policy can be configured to explicitly require that a device be marked as 'compliant' before granting access to specific cloud applications or services. It effectively bridges device health with access control decisions, ensuring only trusted devices can reach sensitive data.

This Conditional Access policy specifically targets legacy authentication clients by including both "Exchange ActiveSync clients" and "Other clients" in its scope. Protocols like IMAP, POP, and SMTP inherently utilize legacy authentication methods, which are encompassed within the "Other clients" category. By targeting these client types, the policy effectively applies its controls to connections made using these older, less secure authentication flows.

Conditional Access policies in Azure Active Directory are the robust control plane for enforcing access decisions to cloud applications, including email, based on various signals. These policies evaluate conditions such as user identity, location, application, and crucially, the device's compliance status as reported by Intune. Based on this evaluation, Conditional Access can grant access, block access, or require additional authentication methods, making it the definitive mechanism for enforcing access control based on device compliance.

This option accurately describes a Microsoft Purview DLP policy configured to prevent data exfiltration. The policy rule is set to detect the presence of 10 or more credit card numbers, identified with a high confidence level, within an email message. Upon this condition being met, the specified action is to block the sending of that email, ensuring sensitive data remains within organizational boundaries.

Purview advanced audit logs represent an enhanced set of auditing capabilities available with specific Microsoft 365 E5 compliance licenses. These logs provide higher fidelity events, such as detailed mailbox item access or eDiscovery search activities, and offer extended audit log retention periods up to 10 years. They are integral to advanced forensic investigations and meeting stringent regulatory compliance requirements, building upon the foundational unified audit log.

Microsoft Purview Insider Risk Management proactively detects and acts on malicious or inadvertent insider activities that could lead to data exfiltration. It leverages machine learning and behavioral analytics across Microsoft 365 services to identify unusual or risky user behaviors, such as downloading large amounts of sensitive data or sharing it externally, providing alerts and enabling remediation actions to prevent data loss.

Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps (MDCA) that analyzes traffic logs from firewalls and proxies to identify all cloud services accessed by users in an organization. It provides comprehensive visibility into shadow IT by detecting unsanctioned cloud applications, assessing their risk levels, and generating reports that help administrators understand usage patterns and potential security or compliance gaps.

Defense in depth is a security strategy that employs a series of layered and overlapping security controls to protect assets. The principle is that if one security control fails or is bypassed, another control will be in place to prevent or detect an attack. This multi-layered approach, encompassing administrative, technical, and physical safeguards, significantly enhances an organization's overall resilience against diverse threats, ensuring no single point of failure compromises security.

An auto-labeling policy for sensitivity labels is specifically configured to automatically detect and apply predefined sensitivity labels to content that matches specific conditions, such as the presence of sensitive information types, keywords, or patterns. This capability directly addresses the need to automatically apply a 'confidential' label, which can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring consistent data protection without manual intervention.

Automation rules are a core component of Microsoft Sentinel's Security Orchestration, Automation, and Response (SOAR) capabilities, enabling automated responses to alerts and incidents. They can be configured to automatically create incidents from incoming alerts, apply specific tags, change the incident status, and assign the incident to a designated owner or group. This direct capability to create and assign incidents makes them the correct choice for streamlining security operations.

Microsoft Entra ID Protection is the correct service for this scenario, as it specializes in detecting identity-based risks, including compromised credentials and suspicious sign-ins. It leverages machine learning to identify user and sign-in risks, and its risk-based policies can be configured to automatically enforce remediation actions. When a high user risk is detected, Identity Protection can be set to require a user to perform a secure password change as a self-remediation step, directly addressing the compromised identity.

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and just-enough-access (JEA) to privileged roles. It enables approval workflows for role activation, requiring users to request elevation and obtain approval before gaining temporary administrative rights. This directly addresses the need for a controlled and auditable process for activating privileged roles.

Setting 'Allow override' to 'No' within the policy tip configuration directly controls the user's ability to bypass a Data Loss Prevention (DLP) policy. This specific setting removes the 'override' button or option from the policy tip presented to the user, effectively preventing them from providing a business justification to proceed with a blocked action. This ensures strict enforcement while still providing the user with crucial information about the policy violation, aligning with best practices for user education.

A Selective wipe action, often referred to as "Retire" in Microsoft Intune, is the appropriate choice for removing only organizational data while preserving the user's personal information. This action specifically targets and deletes all managed company applications, data, email profiles, and VPN connections that were deployed or configured by Intune. It is ideal for scenarios where an employee leaves the company or a BYOD device is unenrolled, ensuring corporate data security without impacting personal privacy.

Microsoft Defender for Cloud is the correct solution as it offers comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) capabilities. It continuously assesses the security state of Azure Virtual Machines, identifying vulnerabilities, misconfigurations, and deviations from security best practices. It then provides actionable security recommendations, a secure score, and integrates with vulnerability assessment tools to enhance the overall security posture of the VMs and their running workloads.

The Locations condition in Microsoft Entra Conditional Access is specifically designed to control access based on the network location from which a user is attempting to sign in. Administrators can define 'named locations' using specific public IPv4 ranges, representing trusted corporate networks, or by selecting entire countries/regions, allowing for granular policies to grant access only from approved geographies or block access from high-risk areas. This directly addresses the need to restrict access based on a user's physical or network geographic location.

Conditional Access policies are a core security feature of Microsoft Entra ID, allowing organizations to enforce granular access controls based on specific, real-time conditions. These policies evaluate factors such as user location, device compliance, application sensitivity, and sign-in risk during an authentication attempt. By dynamically requiring multi-factor authentication, blocking access, or limiting session duration, Conditional Access significantly enhances security posture and compliance without impeding legitimate user productivity.

Microsoft Entra Application Provisioning is a robust feature designed to automate the end-to-end lifecycle management of user identities. It directly integrates with cloud-based Human Resources (HR) systems, such as Workday or SAP SuccessFactors, to automatically create, update, and delete user accounts in Microsoft Entra ID and connected SaaS applications. This automation streamlines onboarding and offboarding processes, ensuring that user access is consistently aligned with their employment status and reducing manual administrative overhead.

Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps that specifically ingests and analyzes network traffic logs from firewalls, proxies, or endpoint agents. Its primary purpose is to identify all cloud applications accessed by users in an organization, including unsanctioned 'shadow IT,' and to assess their associated risk scores. This process provides crucial visibility into an organization's entire cloud app landscape by revealing usage patterns and potential vulnerabilities.

In a Zero Trust model, "Verify explicitly" mandates that all access requests are rigorously authenticated and authorized based on all available data points. This includes user identity, device health, location, service or workload, data classification, and any detected anomalies. Access is never implicitly granted; instead, it is always explicitly validated against policy before being permitted, ensuring a robust security posture.

The scenario directly describes a breach of confidentiality, as an unauthorized attacker has gained access to private email communications. Confidentiality is the principle that prevents the unauthorized disclosure of information, ensuring that only authorized individuals or systems can view or access sensitive data. This compromise means the secrecy and privacy of the email content have been violated by an unapproved party.

Self-Service Password Reset (SSPR) is a core Microsoft Entra ID capability specifically designed to empower end-users to securely reset their forgotten passwords or unlock their own accounts without requiring IT helpdesk intervention. It leverages pre-registered authentication methods, such as mobile app notifications, phone calls, or security questions, to verify the user's identity before allowing the password change or account unlock. This significantly reduces helpdesk calls and improves user productivity by enabling immediate account recovery.

The JSON metadata explicitly indicates an 'encrypt' action, confirming that the document's content is protected through encryption. Furthermore, the `protection_type` is set to 'user' with the specific `value` 'finance@contoso.com'. This configuration ensures that only members of the `finance@contoso.com` security group possess the necessary rights to decrypt and access the document, thereby enforcing strict access control.

Retention labels in Microsoft Purview Data Lifecycle Management enable organizations to classify content and apply specific retention settings directly to individual items, such as emails or documents. These labels can be applied manually by users, automatically based on conditions, or through event-based triggers, ensuring that data is retained or deleted according to regulatory or business requirements throughout its lifecycle. They also facilitate the declaration of records, making content immutable for compliance.

Automated user provisioning, often managed by services like Azure AD Connect or Azure AD provisioning to SaaS apps, synchronizes identity data between authoritative sources and target applications. When a user's account is disabled or deleted in the authoritative source (e.g., HR system or on-premises AD), the provisioning service detects this change and automatically propagates it to connected applications. This process disables the user's account and revokes their access to those applications and their associated data, directly addressing the requirement for automatic access revocation upon termination.

To effectively incorporate an organization's unique internal controls and policies into Microsoft Purview Compliance Manager, creating a custom template is the essential first step. This custom template serves as the blueprint for any subsequent custom assessment, allowing administrators to define specific control families, controls, and their associated improvement actions that align precisely with internal requirements. Without a custom template, there is no structured framework to house these unique internal controls within the Compliance Manager environment.