Is there any documentation published that can assist in a controls assessment for Microsoft 365 Copilot?

Looking to do a controls assessment on M365 copilot and hoping that there is published security controls that an organization should be operating to reduce any unnecessary risks associated with copilot. Preferably I would hope there's documentation on any NIST 800-53r5 controls that an organization should be operating; however, if there are any other frameworks available for compliance that would be very useful. Thanks!