Microsoft 365 Copilot Pre-Rollout Security Readiness Assessment

The Teachers’ Retirement System of New York is seeking an independent vendor to conduct a focused, risk‑based security assessment of its Microsoft 365 Copilot pilot before the licenses are activated. The work is limited to evaluating existing security controls, identifying data‑exposure risks, and providing a readiness determination; the vendor will not make configuration changes or perform remediation. Deliverables include a detailed security readiness report, a findings matrix, a prioritized pre‑rollout action plan, a rollout readiness determination, and a final technical presentation. • Validate access, identity, and privileged‑role controls for the Copilot pilot. • Perform sample‑based data‑exposure and DLP/sensitivity‑label assessments across SharePoint, OneDrive, Teams, and other Microsoft 365 services. • Test Copilot behavior using up to six controlled scenarios and document audit evidence. • Recommend required remediation steps and determine whether rollout can proceed, proceed with restrictions, or be delayed.