Is Accred Assess really read-only?
Yes. The Microsoft 365 scan uses read-only Microsoft 365 permissions that a tenant administrator approves, and it makes 0 changes to your tenant. Microsoft publisher verification for the Accred app is still in progress. Anything Accred Assess cannot read is shown as not evaluated, never as a pass. You can disconnect at any time, which removes the stored credential.
What does it check?
67 implementation controls in 12 phases for Microsoft 365 Copilot and AI governance: licensing, oversharing, sensitivity labels and DLP, identity and Conditional Access, device protection, auditing, Teams, monitoring, adoption, and agents. It also covers Claude through the Anthropic Admin API and ChatGPT and Codex through workspace analytics exports.
Does it check our overall security, or only AI?
Both. The security posture view grades 118 checks in 13 areas: identity and MFA, admin accounts, email protection, devices, patching against CISA's actively exploited list, data sharing, logging, backup, internet-facing exposure, AI governance, vendors, policies, and incident readiness. Each maps to CIS Controls v8.1, NIST CSF 2.0, SOC 2, ISO 27001, CISA SCuBA, and Essential Eight. Email and website protections are read from public DNS and HTTPS; settings Accred cannot read are answered by your team and labelled that way. Anything unanswered is not evaluated, never a pass, and it is advisory, not a certification.
Does it cover ChatGPT and Claude, or only Copilot?
All three. Claude organizations connect through the Anthropic Admin API or a Claude analytics export, and ChatGPT and Codex workspaces through their analytics export. Only aggregate counts are kept; individual rows, prompts, and files are not stored.
What does the readiness score mean?
It is an advisory implementation-readiness signal from your recorded decisions. Implemented controls count fully, in-progress controls count half, documented not-applicable controls are excluded, and controls that are not assessed never count. It is not a certification or a compliance determination.
Can it map results to SOC 2, ISO 27001, NIST, CMMC, or HIPAA?
Yes. Choose up to six frameworks, including SOC 2, ISO 27001, NIST CSF 2.0, CMMC Level 1 and 2, FedRAMP Moderate, HIPAA, PCI DSS 4.0.1, CIS Microsoft 365 Foundations Benchmark v7.0.0, CIS Controls v8.1, GDPR, and the NIST AI RMF. Each requirement shows met, partially met, gap, not assessed, or not applicable, based on your control decisions.
What is free and what does the $99 expanded assessment add?
The free assessment needs no account or card to start and includes the readiness overview, 5 priority controls with guidance, and Claude and ChatGPT analytics imports. Connecting Microsoft 365 and buying the expanded assessment need a free Accred Hub sign-in so results are saved to your organization. The expanded assessment is $99 one-time per organization and adds all 67 controls, framework alignment, and the complete print-ready report.
How is my data protected?
Tenant data is summarized in memory and only aggregate metrics and findings are kept. Connector credentials are encrypted with AES-GCM before storage, evidence files sit in private storage, and uploaded files and scan results stay candidates until someone on your team accepts or rejects them.
Who can help us fix what it finds?
Accred Consulting, the US-based Microsoft 365 consulting firm that builds Accred Assess. Its engineers can implement the prioritized controls and document the configuration. The first consultation is free.
