Generation-e

AI & Platforms / Governance, risk & compliance

Know where your sensitive files are, and who can open them.

We use Microsoft Purview to find sensitive information across Microsoft 365, label it and decide how long it's kept. Copilot respects the labels, and your auditors get evidence they can check.

Ask about a data governance and Purview assessment
A records manager with a tablet walks between rows of archive shelving full of box files. Illustrative image.

Sensitive information ends up in more places than anyone planned.

Contracts, salary files and customer records get saved, copied and shared across Microsoft 365 for years. Copilot draws on what each person has permission to open, so a file shared too widely is much easier to find once it's switched on.

  • SharePoint sites
  • OneDrive folders
  • Mailboxes
  • Teams chats and recordings

Find and label sensitive files before Copilot goes wider.

Purview scans Microsoft 365 for information such as tax file and IRD numbers, bank account numbers and Medicare numbers. It can label files automatically, or prompt people to label them.

A label can encrypt a file and limit who opens it. When Copilot drafts something from a labelled file, the draft takes the label. A data loss prevention policy can also stop Copilot summarising files with the labels you choose.

See how a Copilot readiness assessment works
An IT security lead works on a laptop while a records manager reads a printed folder diagram. Illustrative image.

Keep records for as long as you must, then delete them.

Retention policies keep email, files, chats and Teams meeting recordings, including the ones made in your meeting rooms, for as long as you have to. Records management locks the documents that mustn't be changed or deleted early.

Copilot prompts and responses can be kept under retention policies too, and searched with eDiscovery when a legal or regulatory request arrives.

A senior professional reads her laptop beside a stack of paper files. Illustrative image.

Show an auditor which controls are in place.

Purview Compliance Manager checks your Microsoft 365 settings against templates for ISO 27001, NIST and the Essential Eight, and lists what's left to do. Audit logs record who opened, shared or changed a file, and when Copilot was used.

A Compliance Manager score shows how your settings are configured. It doesn't certify you, so we also help write the policies and processes your auditor will ask to see.

The Essential Eight, as ASD lists them

ASD's Australian Cyber Security Centre (ACSC) responded to 138 ransomware incidents in 2024-25. The Essential Eight is the baseline ASD recommends to protect against attacks like these, with three maturity levels for each strategy. We map your Microsoft 365 and device settings against each one and show you the gaps.

  • Patch applications
  • Patch operating systems
  • Multi-factor authentication
  • Restrict administrative privileges
  • Application control
  • Restrict Microsoft Office macros
  • User application hardening
  • Regular backups

Questions about data governance and compliance

Why sort out governance before a wider Copilot rollout?

Copilot draws on the Microsoft 365 content each person can already open, and finds it in seconds. Labels, data loss prevention and tidier permissions decide what it can summarise and pass on.

What does Microsoft Purview cover?

Finding and classifying sensitive information, sensitivity labels, data loss prevention, retention and records, eDiscovery, audit and Compliance Manager. Which parts you can use depends on your Microsoft 365 licences.

Which frameworks can you map our controls to?

The ones you're held to, such as ISO 27001, NIST and the Essential Eight. Compliance Manager has templates for these; some are licensed separately.

Do labels get in people's way?

They don't have to. A default label can cover most files, automatic labelling can catch the sensitive ones, and people only pick a label themselves when a file needs more protection than the default.

Do you look after it once it's set up?

Yes. M-Serv, our managed support, keeps labels, data loss prevention and retention policies up to date as your organisation changes.

More on Copilot, sign-in and contact centres

Start with the frameworks you report against.

Tell us which standards you're held to, how you use Microsoft 365 and when Copilot is due to go wider. We'll call to propose an assessment that shows where your sensitive files are, who can open them and which of your Microsoft 365 settings fall short of those standards. We agree its scope and cost with you before it starts.

Ask about a data governance and Purview assessment