Vendor Due Diligence › Vendors › Microsoft 365 / Office 365
Microsoft 365 / Office 365 is a Productivity Suite / Email vendor used by registered investment advisers and other SEC-regulated firms. MTradecraft tracks Microsoft 365 / Office 365 in its Vendor Due Diligence Portal, where each vendor is researched against a fixed security and regulatory questionnaire — now including a supplemental AI section: every confirmed answer carries a public source URL and capture date, and anything unconfirmed is marked Unknown rather than inferred. Based on its function, MTradecraft classifies Microsoft 365 / Office 365 as High sensitivity, and it handles client personally identifiable information.
What the full profile covers
- Vendor Information — 11 controlled questions
- Information Security Practices — 29 controlled questions
- Training & Oversight — 2 controlled questions
- Cyber Incidents & Testing — 3 controlled questions
- Confidentiality & Compliance — 5 controlled questions
Plus identity facts (parent company, HQ jurisdiction, hosting provider), SOC 2 sourcing, and the items only the vendor can attest to — flagged so you know exactly what to request in writing.
Why this matters for your firm
SEC-registered advisers must oversee service providers that touch customer information (Reg S-P, 17 CFR §248.30), maintain a written compliance program covering vendor risk (Rule 206(4)-7), and retain the records that prove the review happened (Rule 204-2). The portal turns that into a defensible, citable record — including a printable report you can file.
Open the VDD portalGet a free account
Work at Microsoft 365 / Office 365? Complete the vendor self-report questionnaire to add attested answers to this profile.
Related Productivity Suite / Email vendors
Research data may be incomplete or unverified for this vendor; the portal labels the verification state of every answer. Confirm anything decision-critical directly with the vendor. Catalog updated 2026-07-15.