Business Continuity and Cybersecurity Steps Amid the Microsoft 365 Outage

Incident Overview 

On November 12, 2026, Microsoft confirmed widespread connectivity issues affecting multiple regions and services, including Outlook, Teams, SharePoint, Copilot, Defender, and a variety of AI connectors. While details are still emerging about the cause of the incident and its impact, Microsoft is reporting that the outage was not caused by a cyberattack, but rather a breakdown in its infrastructure. 

While Microsoft works to restore affected services, firms should take immediate steps to manage the impact of the incident, shorten recovery time, and reduce the likelihood of additional incidents. 

Compliance Issues 

The incident provides a practical test of firms’ business continuity plans (BCPs). Compliance teams should evaluate how well their firm’s BCP performed. In particular:  

• Electronic communications: Did the firm’s backup communication channels for telephone, email, text, and meetings function as intended? Did the firm’s arrangements for backup recordkeeping operate as planned?  

• Regulatory filings: Did the firm have a backup method ready to make required regulatory filings?  

• Operations: Did the outage affect trading, settlement, market-data access, investment research, valuation, or risk management?  Did backup arrangements work? 

• AI tools: Did the outage disrupt AI tools or workflows? Did the firm’s systems flag the loss of AI connectors? Were backup arrangements in place and, if so, did they work? For tools that rely on Copilot, did the firm recognize the impact of the Copilot outage? Did the firm’s backup processes permit necessary functions to operate?   

• Service providers: Did the outage affect trading, settlement, market-data access, investment research, valuation, or risk management? Did backup arrangements work? 

Cybersecurity Issues 

Based on information currently available, this disruption does not appear to have been caused by a cyberattack. However, it may increase cyber risks for affected firms. Potential cybersecurity impacts include: 

• Cybersecurity tools may have been disrupted: Microsoft listed Defender for Office 365 among potentially affected services. If Safe Links was affected, URL checks may not have run as expected. IT and cybersecurity teams should review their Message Trace and Safe Links logs to identify any links that may have been clicked without verification and remind staff to be especially cautious with unexpected links until affected services are fully restored.  

• Logging and monitoring gaps: Firms should confirm if audit logs, alerts, and threat information from Microsoft sources were interrupted during the outage. IT and cybersecurity leaders should identify any critical alerts or vendor notices that may have been missed and follow up as needed. If these services were interrupted or delayed, the firm should document the gap in case regulators or investors ask about it in the future.  

Next Steps 

• Addressing gaps: If this outage revealed gaps in a firm’s BCP, the compliance team should work with business stakeholders and service providers to address them. 

• Cyber insurance review: Firms should review their cyber insurance policies for system-failure or dependent-business-interruption coverage, waiting periods, and notification requirements, and consult their broker as appropriate. Coverage for non-malicious outages varies by policy, and firms should ensure that their continuity and recovery planning takes this coverage into account for future incidents.  

• Social-engineering attacks: With the size and scale of this incident, cybercriminals are likely to exploit the urgency created by the outage through phishing and other social-engineering attacks. Firms should be alert to emails or calls from individuals claiming to represent Microsoft and asking employees to take urgent action to restore their access to Microsoft tools. 

• Disclosure: If the outage materially affected a firm’s operations, the firm may wish to consult counsel regarding whether client or regulatory disclosure is required or advisable. Counsel can advise on the impact, remediation steps, and whether regulatory disclosure is necessary or advisable. 

• Reporting: Large Hedge Fund Advisers¹ to Qualifying Hedge Funds should evaluate whether this outage had a material impact on the firm’s investment, trading, valuation, reporting, or risk management functions and assess whether this impact would constitute an operations event reportable in Section 5 of Form PF.  

• • Large Hedge Fund Advisers that conclude from this review that the outage had a material impact on a Qualifying Hedge Fund must file a report with the SEC explaining that impact. The report must be filed promptly but no later than 72 hours after the occurrence of the event or when the adviser reasonably believes the event occurred.  

• • Advisers that conclude the outage did not have a material impact on any Qualifying Hedge Fund may wish to consider making a written note of their review supporting this conclusion for the firm’s files. 

How We Help   

A significant third-party technology outage can expose gaps that are difficult to identify through routine testing alone. ACA can help firms: 

• Assess the operational, compliance, and cybersecurity implications of the Microsoft 365 disruption 

• Evaluate business continuity and vendor risk controls 

• Document remediation steps 

• Strengthen plans for future incidents 

ACA can also support firms in reviewing cybersecurity monitoring gaps, third-party service provider dependencies, incident documentation, and potential regulatory considerations. 

Contact us to discuss your continuity, cybersecurity, and incident response priorities.