Legal notes
The fine print, in one place
Who we are
Hardpoint Compliance LLC is a Georgia limited liability company and an independent consultancy. We are not affiliated with, endorsed by, or certified by Microsoft Corporation, the Cybersecurity and Infrastructure Security Agency (CISA), the Center for Internet Security, the U.S. Department of Defense, or any accreditation body. Our engagements support your readiness; any certification or compliance decision rests with the authorized assessor, insurer, customer or regulator who makes it.
How scores are calculated
Scores shown on this site and in our reports are configuration scores produced by Hardpoint Compliance's own assessment method. Each score counts the checks a tenant passes out of those that can be fixed with the licenses the tenant already owns, weighted by severity, from checks defined in the CISA Secure Cloud Business Applications (SCuBA) baselines and the CIS Microsoft 365 Foundations Benchmark. A score is not a Microsoft Secure Score, not an SPRS score, not a certification, and not a guarantee against incidents. Checks that require a higher Microsoft 365 plan, and deliberate exceptions you choose to keep, are reported separately and do not count against the score.
The scores shown for our own tenant (34, 78 and 96) come from assessments of Hardpoint Compliance's Microsoft 365 tenant on 2026-10-28 through 2026-10-30, using the same tooling and method we use for clients. That tenant was new at the time and had less in it than a working business's tenant, so a client's starting score and fix list are usually different.
The 60-second check
The self-check at /check/ scores your own answers in your browser. It is a self-assessment, not a security assessment: it cannot see your tenant and does not verify anything. The five questions are examples of the kinds of questions cyber-insurance applications and customer security questionnaires ask; they are not the wording of any particular insurer or form, and a perfect result does not mean an application will be approved. Nothing is sent to us unless you submit the optional guide request, in which case your answers travel with it so the guide can address your gaps.
The sample report
The sample pages are excerpts from the report produced on our own tenant, provided for your evaluation of the report format only. Each copy is watermarked with the recipient's name and company. Please do not redistribute, republish or use it to build a competing product. We send samples to people at operating businesses after a quick check; we may decline a request.
Trademarks
Microsoft, Microsoft 365, Entra, Defender, Purview and Teams are trademarks of the Microsoft group of companies. CIS and the CIS Benchmarks are marks of the Center for Internet Security. NIST is an agency of the U.S. Department of Commerce. All other names belong to their owners and are used only to identify the products and standards the assessment measures against.
Examples and testimonials
Where this site describes what the assessment typically finds at a firm of a given size, it is describing patterns from published baselines and our own work, not a specific client. We do not publish client names, scores or findings without written permission.
Not legal, insurance or accounting advice
Our reports describe the state of a Microsoft 365 configuration and how to change it. They do not interpret contracts, insurance policies, regulations or laws, and they are not a substitute for advice from your attorney, broker or accountant.
Questions
Write to preston@hardpointcompliance.com. For what we collect and how we handle it, see the privacy policy.