Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls LG-01 through LG-02 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response LG-01 Legal - Agreements Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented and reviewed at planned intervals. Microsoft Legal department and Human Resources maintain policies and procedures defining the implementation and execution of non- disclosure and confidentiality agreements which prevent us from providing specific information about one customer’s data to other customers. “Confidentiality agreements and non-disclosure agreements” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 6.1.5. For more information review of the publicly available ISO standards we are certified against is suggested. LG-02 - Third Party Agreements party agreements that directly, or indirectly, impact the organizations information assets or data are required to include explicit coverage of all relevant security requirements. This includes agreements involving processing, accessing, communicating, hosting or managing the organization's information assets, or adding or terminating services or products to existing information. Assets agreements provisions shall include security (e.g., encryption, access controls, and leakage prevention) and integrity controls for data exchanged to prevent improper disclosure, alteration or destruction. Office 365 standards specify that the Office 365 Risk Management organization approves certain exchanges with parties outside of Office 365. As part of this process, the Risk Management organization ensures that exchanges of High Business Impact (Loss could result in immediate, direct, considerable impact to business and includes Highly Sensitive Personally Identifiable Information) and Medium Business Impact (Loss could result in indirect, limited impact to the business and includes Personally Identifiable Information) assets with non-Microsoft parties are made only in connection with a formal procedure. “Addressing security in third party agreements” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 6.2.3. For more information review of the publicly available ISO standards we are certified against is suggested.
OP-03 Operations Management - Capacity / Resource Planning The availability, quality, and adequate capacity and resources be planned, prepared, and measured to deliver the required system performance in accordance with regulatory, contractual and business requirements. Projections of future capacity requirements shall be made to mitigate the risk of system overload. Microsoft has the following operational processes in place: Proactive capacity management based on defined thresholds or events Hardware and software subsystem monitoring for acceptable service performance and availability CPU utilization, service utilization, storage utilization and network latency Business Continuity Management is 1 of the 14 ISO domains that is included as part of the ISO certification. “Capacity management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 10.3.1. For more information review of the publicly available ISO standards we are certified against is suggested. OP-04 Operations Management - Equipment Maintenance Policies and procedures shall be established for equipment maintenance ensuring continuity and availability of operations. A process for the development and maintenance of a Services Continuity Management (SCM) is in place for the Office 365 environment. The process contains a strategy for the recovery of Office 365 assets and the resumption of key Office 365 business processes. The continuity solution reflects security, compliance and privacy requirements of the service production environment at the alternate site. Beyond this, we go the extra mile and provide quarterly worldwide uptime over the and financially back our guarantee of 99.9% uptime. Additionally, we have redundancy at the physical, data, and functional layers, providing high availability and our disaster recovery capabilities keep customers up and running. Business Continuity Management is one of the 14 ISO domains for which we are certified against. “Equipment maintenance” is covered the ISO 27001 standards, specifically addressed in Annex A, domain 9.2.4. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls RI-01 through RI-05 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response RI-01 Risk Management - Program Organizations develop and maintain an enterprise risk management framework to manage risk to an acceptable level. The ISO Plan, Do, Check, Act process is used by Office 365 to continually maintain and improve the risk management framework. Risk Management is one of the 14 ISO domains for which we are certified against. “Establishing the ISMS and risk management framework” is covered under the ISO 27001 standards, specifically addressed in domain