You are evaluating data security and compliance controls for a company that uses Microsoft Copilot for Microsoft 365 services. They need to ensure that their services comply with industry regulations and protect sensitive data. How would you evaluate and implement controls to achieve this?