Operational Infrastructure Glossary

Software category coined by simiriki: the execution layer between policy (what the M365 admin intends) and configuration (what the tenant actually runs). CSPMs observe; consultants advise; Operational Infrastructure closes the loop with continuous evaluation, approved remediation, and evidence generation.

Proprietary 0–100 posture metric. Derived from 197 rule outcomes weighted by severity (Critical −15, High −8, Medium −3, Low −1). Letter grades A+ through F. Reproducible: the same tenant snapshot yields the same sIPO regardless of who runs it.

Proprietary risk-exposure metric, normalized to tenant scale (users, mailboxes, sites). Used in S.O.S monthly executive reviews and the M365 Mexico 2026 benchmark to compare posture across tenants of different sizes.

Four-phase methodology to operate Microsoft 365: Evaluate, Optimize, Protect, Scale. Each phase ships fixed deliverables, flat pricing, and observable metrics from day one.

Authentication mechanism requiring at least two independent factors (typically something you know + something you have). In Microsoft 365 it is enforced via Conditional Access policies; missing MFA on privileged accounts is the #1 critical finding in the sIPO Mexico benchmark.

Microsoft Entra ID's policy engine that evaluates signals (user, device, location, risk) before granting resource access. Replaces binary rules with contextual decisions: require MFA, block access, require compliant device.

Microsoft Entra ID service that activates admin permissions only when needed, with approval workflow and expiry. Replaces standing access with just-in-time (JIT) elevation.

Single authentication event grants access to multiple applications. In Microsoft 365 it is implemented via Entra ID using SAML, OIDC, or WS-Federation. Reduces phishing vectors by consolidating the authentication surface.

Old protocols (POP3, IMAP4, basic SMTP AUTH, basic Exchange ActiveSync) that do not support MFA and are the preferred password-spray vector. simiriki recommends blocking them via Conditional Access on every tenant.

DNS TXT record declaring which servers are authorized to send mail on behalf of a domain. First of the three email-authentication layers (SPF + DKIM + DMARC); insufficient alone.

Cryptographic signature added to each outgoing email that the receiver verifies against a public key published in DNS. Proves the message was not tampered with in transit and that the sender domain signed it.

DNS policy telling receivers what to do with mail that fails SPF or DKIM (none/quarantine/reject) and where to report failures. p=reject is the only policy that fully stops domain spoofing.

Standard mandating TLS on inbound SMTP with certificate validation. Closes the downgrade-attack gap that SPF/DKIM/DMARC do not cover. simiriki publishes an MTA-STS policy at /.well-known/mta-sts.txt.

Microsoft's anti-phishing and anti-malware product for Exchange Online. Includes Safe Links, Safe Attachments, anti-phishing impersonation, and sandbox attachment detonation. Requires E5 license or add-on.

Set of policies that detect, alert on, or block the egress of sensitive information (card numbers, national IDs, secrets) via email, shared files, or endpoints. In Microsoft 365 it lives in Purview with prebuilt templates and customizable rules.

Labels applied to documents and emails that trigger automatic controls: encryption, watermarks, external-sharing restrictions, expiration. Persist with the file and apply even outside the tenant.

Encryption of data stored on disk, in a database, or in blob storage. simiriki uses AES-256-GCM for OAuth tokens (lib/crypto.ts) and Supabase PostgreSQL with column-level encryption for sensitive fields.

Encryption of data while it travels over the network. At simiriki: TLS 1.2+ mandatory on every HTTPS endpoint (HSTS preload), MTA-STS on inbound SMTP, OAuth with PKCE for public flows.

Platform that correlates signals from multiple telemetries (endpoint, email, identity, cloud apps) to detect and respond to threats. Microsoft Defender XDR is the native implementation in the Microsoft 365 ecosystem.

Platform that ingests logs from multiple sources, normalizes them, and enables correlation, alerting, and forensics. Microsoft Sentinel is Microsoft's cloud-native SIEM; typically costs $5K-$50K USD/month in mid-market tenants.

Automation layer that runs incident-response playbooks without human intervention or with explicit approval. In Sentinel it is implemented via Logic Apps + Automation Rules.

Capability to detect malicious behavior on endpoints (not just file signatures) and respond with isolation, kill-process, or rollback. Microsoft Defender for Endpoint is the Microsoft implementation; requires E5 license or add-on.

Prioritized list of 18 security controls maintained by the Center for Internet Security. Each control ships measurable safeguards. simiriki maps every one of its 197 detection rules to specific CIS controls.

CIS document with configuration recommendations specific to Microsoft 365. Defines two levels (Level 1 essential, Level 2 defense-in-depth). simiriki executes the full Level 1 in the free scan.

National Institute of Standards and Technology framework organized in six functions: Identify, Protect, Detect, Respond, Recover, Govern (v2.0, February 2024). The reference language in corporate defense.

International standard for information-security management systems (ISMS). Defines how to organize policies, controls, risk assessment, and continuous improvement. Certification is audited by an accredited third party.

Audit report developed by AICPA against five Trust Services criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Type I assesses design; Type II assesses design + operating effectiveness over 6-12 months.

Mexican federal law on personal data held by private parties. Current text published in the DOF on March 20, 2025, with the most recent amendment on November 14, 2025. Regulated by INAI. Applies to any private company collecting or processing data on individuals.

Mexican autonomous body regulating transparency and personal-data protection. The sanctioning authority for LFPDPPP and LGPDPPSO; issues the guidelines and resolutions that detail both laws.

Mexican financial regulator. The Circular Única de Bancos and Circular Única de Casas de Bolsa impose cybersecurity, business-continuity, incident-reporting, and document-retention obligations on the Mexican financial sector.

Mexican Official Standard on data-message preservation. Requires time-stamping by a certifying authority approved by the Secretaría de Economía to prove the integrity of digital documents. Applies to CFDI, contracts, legal records.

Mandatory electronic-invoicing scheme in Mexico, version 4.0 effective since 2023. Every invoice, payroll receipt, and payment supplement must be issued as CFDI with SAT digital signature.

Mexican customs regime for companies that temporarily import inputs to process and re-export. Carries specific obligations for document traceability, electronic-evidence retention, and SAT reporting.

Isolated Microsoft 365 instance tied to an organization. Identified by a Tenant ID (GUID) and one or more verified domains. Every simiriki scan operates against a specific tenant with admin consent.

Automatable sequence of actions to remediate a finding. simiriki maintains 69 playbooks mapped to its detection rules; every execution requires explicit human approval and leaves a complete audit trail.

Immutable record of every action executed against the tenant. The Microsoft 365 Unified Audit Log records events from Exchange, SharePoint, Teams, Entra ID, and Power Platform; must be enabled to comply with LFPDPPP Art. 19/20.

OAuth 2.0 extension that protects the authorization-code flow for public clients (browsers, mobile). simiriki uses it on /scan to avoid exposing client_secret and protect against interception attacks.