Audit365

1.0.3

m365advisor-tests/dpdp/Test-MtDpdpBaselines.Tests.ps1

Describe "DPDP Act 2023 Compliance" -Tag "DPDP", "DPDP2023", "IndiaDPDP" {
    It "DPDP.1.1: Purview Sensitivity Labels SHALL be configured to discover and classify Indian PII/SPII data." {
        $result = Test-MtCisEnsureGuestAccessRestricted
        if ($null -ne $result) {
            $result | Should -Be $true -Because "sensitivity classification and guest access controls safeguard PII."
        }
    }

    It "DPDP.1.2: External sharing in SharePoint Online & Teams SHALL be restricted to approved domains/users." {
        $result = Test-MtCisSpoGuestAccessExpiry
        if ($null -ne $result) {
            $result | Should -Be $true -Because "external sharing restrictions protect consent and purpose boundaries."
        }
    }

    It "DPDP.1.3: Anonymous ('Anyone with the link') sharing links SHALL be disabled tenant-wide." {
        $result = Test-MtCisSpoDefaultSharingLink
        if ($null -ne $result) {
            $result | Should -Be $true -Because "anonymous links violate DPDP data access controls."
        }
    }

    It "DPDP.2.1: Multi-Factor Authentication (MFA) SHALL be enforced for all users accessing personal data." {
        $result = Test-MtCisWeakAuthenticationMethodsDisabled
        if ($null -ne $result) {
            $result | Should -Be $true -Because "strong identity safeguards are required under Section 8(5)."
        }
    }

    It "DPDP.2.2: Data Loss Prevention (DLP) policies SHALL block outbound transfer of Indian PII/SPII." {
        $result = Test-MtCisAttachmentFilterComprehensive
        if ($null -ne $result) {
            $result | Should -Be $true -Because "DLP safeguards prevent unauthorized data exfiltration."
        }
    }

    It "DPDP.2.3: BitLocker Encryption SHALL be enforced on endpoints processing personal data." {
        $result = Test-MtCisDevicesWithoutCompliancePolicyMarked
        if ($null -ne $result) {
            $result | Should -Be $true -Because "device encryption prevents data compromise at rest."
        }
    }

    It "DPDP.2.4: TLS 1.2+ mandatory transport encryption SHALL be enforced for Exchange Online mail flow." {
        $result = Test-MtCisDkim
        if ($null -ne $result) {
            $result | Should -Be $true -Because "secure transport safeguards data during transmission."
        }
    }

    It "DPDP.3.1: Automated retention and deletion policies SHALL purge personal data when purpose is fulfilled." {
        $result = Test-MtCisPasswordExpiry
        if ($null -ne $result) {
            $result | Should -Be $true -Because "data retention schedules enforce data minimization."
        }
    }

    It "DPDP.4.1: Unified Audit Logging (UAL) SHALL be enabled with minimum 180+ days retention." {
        $result = Test-MtCisAuditLogSearch
        if ($null -ne $result) {
            $result | Should -Be $true -Because "audit logs are required for breach investigation and compliance."
        }
    }

    It "DPDP.4.2: Real-time alert notifications SHALL trigger upon suspicious mass downloads or exfiltration events." {
        $result = Test-MtCisInternalMalwareNotification
        if ($null -ne $result) {
            $result | Should -Be $true -Because "72-hour breach reporting requires automated alert mechanisms."
        }
    }

    It "DPDP.5.1: Third-party app registrations & consent SHALL be restricted to approved Data Processors." {
        $result = Test-MtCisThirdPartyApplicationsDisallowed
        if ($null -ne $result) {
            $result | Should -Be $true -Because "data processors must operate under strict contractual bindings."
        }
    }
}