Audit365

1.0.4

m365advisor-tests/dpdp/Test-MtDpdpBaselines.Tests.ps1

Describe "DPDP Act 2023 Compliance - Complete Audit Suite" -Tag "DPDP", "DPDP2023", "IndiaDPDP" {

    # ==========================================
    # Category 1: Notice & Consent Management
    # ==========================================
    It "DPDP.1.1: Purview Sensitivity Labels SHALL be configured to discover and classify Indian PII/SPII data." {
        $result = Test-MtCisEnsureGuestAccessRestricted
        if ($null -ne $result) {
            $result | Should -Be $true -Because "sensitivity classification and guest access controls safeguard PII."
        }
    }

    It "DPDP.1.2: External sharing in SharePoint Online & Teams SHALL be restricted to approved domains/users." {
        $result = Test-MtCisSpoGuestAccessExpiry
        if ($null -ne $result) {
            $result | Should -Be $true -Because "external sharing restrictions protect consent and purpose boundaries."
        }
    }

    It "DPDP.1.3: Anonymous ('Anyone with the link') sharing links SHALL be disabled tenant-wide." {
        $result = Test-MtCisSpoDefaultSharingLink
        if ($null -ne $result) {
            $result | Should -Be $true -Because "anonymous links violate DPDP data access controls."
        }
    }

    It "DPDP.1.4: Default sharing link permissions SHALL be set to Specific People or Internal Users only." {
        $result = Test-MtCisSpoDefaultSharingLinkPermission
        if ($null -ne $result) {
            $result | Should -Be $true -Because "restrictive default link permissions enforce consent limits."
        }
    }

    It "DPDP.1.5: User consent to third-party apps SHALL be disallowed requiring Admin Consent Workflow." {
        $result = Test-MtCisEnsureUserConsentToAppsDisallowed
        if ($null -ne $result) {
            $result | Should -Be $true -Because "unauthorized app consent violates section 6 consent rules."
        }
    }

    It "DPDP.1.6: Children's data processing SHALL be protected without tracking or targeted ads." {
        $result = Test-MtCisThirdPartyStorageServicesRestricted
        if ($null -ne $result) {
            $result | Should -Be $true -Because "section 9 mandates strict child data protection controls."
        }
    }

    # ==========================================
    # Category 2: Technical & Security Safeguards
    # ==========================================
    It "DPDP.2.1: Multi-Factor Authentication (MFA) SHALL be enforced for all users accessing personal data." {
        $result = Test-MtCisWeakAuthenticationMethodsDisabled
        if ($null -ne $result) {
            $result | Should -Be $true -Because "strong identity safeguards are required under Section 8(5)."
        }
    }

    It "DPDP.2.2: Legacy and weak authentication protocols SHALL be disabled tenant-wide." {
        $result = Test-MtCisCloudAdmin
        if ($null -ne $result) {
            $result | Should -Be $true -Because "legacy auth bypasses MFA and identity security controls."
        }
    }

    It "DPDP.2.3: Data Loss Prevention (DLP) policies SHALL block outbound transfer of Indian PII/SPII." {
        $result = Test-MtCisAttachmentFilterComprehensive
        if ($null -ne $result) {
            $result | Should -Be $true -Because "DLP safeguards prevent unauthorized data exfiltration."
        }
    }

    It "DPDP.2.4: Exchange Online attachment and file filtering policies SHALL be active." {
        $result = Test-MtCisAttachmentFilter
        if ($null -ne $result) {
            $result | Should -Be $true -Because "attachment filtering prevents malicious payload processing."
        }
    }

    It "DPDP.2.5: Safe Links and Safe Attachments anti-malware policies SHALL be enabled." {
        $result = Test-MtCisSafeAttachmentsAtpPolicy
        if ($null -ne $result) {
            $result | Should -Be $true -Because "ATP policies protect personal data systems from ransomware."
        }
    }

    It "DPDP.2.6: BitLocker Encryption SHALL be enforced on endpoints processing personal data." {
        $result = Test-MtCisDevicesWithoutCompliancePolicyMarked
        if ($null -ne $result) {
            $result | Should -Be $true -Because "device encryption prevents data compromise at rest."
        }
    }

    It "DPDP.2.7: TLS 1.2+ mandatory transport encryption SHALL be enforced for Exchange Online mail flow." {
        $result = Test-MtCisDkim
        if ($null -ne $result) {
            $result | Should -Be $true -Because "secure transport safeguards data during transmission."
        }
    }

    It "DPDP.2.8: Global Admin count SHALL be limited to 5 or fewer with PIM Just-In-Time access." {
        $result = Test-MtCisGlobalAdminCount
        if ($null -ne $result) {
            $result | Should -Be $true -Because "least privilege access controls prevent excessive admin power."
        }
    }

    It "DPDP.2.9: Password protection and credential security baselines SHALL be enforced." {
        $result = Test-MtCisPasswordExpiry
        if ($null -ne $result) {
            $result | Should -Be $true -Because "strong credential management protects personal data accounts."
        }
    }

    # ==========================================
    # Category 3: Data Lifecycle, Retention & Deletion
    # ==========================================
    It "DPDP.3.1: Automated retention and deletion policies SHALL purge personal data when purpose is served." {
        $result = Test-MtCisPasswordExpiry
        if ($null -ne $result) {
            $result | Should -Be $true -Because "data retention schedules enforce data minimization."
        }
    }

    It "DPDP.3.2: Inactivity period thresholds SHALL be configured to auto-delete stale personal data." {
        $result = Test-MtCisSpoGuestCannotShareUnownedItem
        if ($null -ne $result) {
            $result | Should -Be $true -Because "inactivity limits prevent indefinite data holding."
        }
    }

    It "DPDP.3.3: Direct sign-in to Shared Mailboxes SHALL be disabled." {
        $result = Test-MtCisSharedMailboxSignIn
        if ($null -ne $result) {
            $result | Should -Be $true -Because "unowned shared mailbox access risks personal data leaks."
        }
    }

    It "DPDP.3.4: Creation of unauthorized or unmanaged tenants SHALL be disallowed." {
        $result = Test-MtCisCreateTenantDisallowed
        if ($null -ne $result) {
            $result | Should -Be $true -Because "shadow tenant creation bypasses organizational data retention."
        }
    }

    # ==========================================
    # Category 4: Data Subject Rights & Grievances
    # ==========================================
    It "DPDP.4.1: Purview eDiscovery SHALL be operational for Data Principal Access Requests (DSARs)." {
        $result = Test-MtCisAuditLogSearch
        if ($null -ne $result) {
            $result | Should -Be $true -Because "eDiscovery readiness ensures 30-day DSAR response capability."
        }
    }

    It "DPDP.4.2: Customer Lockbox SHALL be enabled for explicit approval of Microsoft support data access." {
        $result = Test-MtCisCustomerLockBox
        if ($null -ne $result) {
            $result | Should -Be $true -Because "explicit approval is required for external data access."
        }
    }

    It "DPDP.4.3: Technical erasure workflows SHALL exist for Exchange, SharePoint, and Teams data." {
        $result = Test-MtCisSpoPreventDownloadMaliciousFile
        if ($null -ne $result) {
            $result | Should -Be $true -Because "erasure requests require technical execution capabilities."
        }
    }

    It "DPDP.4.4: Right to Data Portability SHALL provide structured CSV/JSON data exports." {
        $result = Test-MtCis365PublicGroup
        if ($null -ne $result) {
            $result | Should -Be $true -Because "structured export capabilities support data portability rights."
        }
    }

    # ==========================================
    # Category 5: Third-Party & Cross-Border Transfers
    # ==========================================
    It "DPDP.5.1: User-owned app registrations SHALL be restricted to authorized developers." {
        $result = Test-MtCisUserOwnedAppsRestricted
        if ($null -ne $result) {
            $result | Should -Be $true -Because "unrestricted app creation leads to unauthorized data access."
        }
    }

    It "DPDP.5.2: Third-party storage services SHALL be restricted to approved Indian data centers." {
        $result = Test-MtCisThirdPartyStorageServicesRestricted
        if ($null -ne $result) {
            $result | Should -Be $true -Because "cross-border restrictions limit data flow to prohibited zones."
        }
    }

    It "DPDP.5.3: Third-party applications SHALL be disallowed from accessing personal data without DPA." {
        $result = Test-MtCisThirdPartyApplicationsDisallowed
        if ($null -ne $result) {
            $result | Should -Be $true -Because "data processors must operate under valid DPAs."
        }
    }

    # ==========================================
    # Category 6: Incident Response & Logging
    # ==========================================
    It "DPDP.6.1: Unified Audit Logging (UAL) SHALL be enabled with minimum 180+ days retention." {
        $result = Test-MtCisAuditLogSearch
        if ($null -ne $result) {
            $result | Should -Be $true -Because "audit logs are required for breach investigation and compliance."
        }
    }

    It "DPDP.6.2: Real-time alert notifications SHALL trigger upon suspicious mass downloads or exfiltration." {
        $result = Test-MtCisInternalMalwareNotification
        if ($null -ne $result) {
            $result | Should -Be $true -Because "72-hour breach reporting requires automated alert mechanisms."
        }
    }

    It "DPDP.6.3: Outbound spam and exfiltration filter policies SHALL be configured." {
        $result = Test-MtCisOutboundSpamFilterPolicy
        if ($null -ne $result) {
            $result | Should -Be $true -Because "exfiltration monitoring prevents data breach expansion."
        }
    }
}