All other categories of data will be stored in the multi-tenant cloud. Microsoft Azure, on which most Microsoft business cloud services are built, hosts multiple tenants in a highly-secure way through logical data isolation. Data storage and processing for our tenant is segregated from each other tenant as described in section E. (Technical and Operational Risk Q&A) below. What data will be processed by the service provider on behalf of the financial institution? Various APRA guidelines on the risks associated with data processing – for example, the “Prudential Practice Guide: CPG 235 – Managing Data Risk”. It is therefore important to understand what data will be processed through Microsoft cloud services. You will need to tailor this section depending on what data you intend to store or process within Microsoft cloud services. The following are common categories of data that our customers choose to store and process in the Microsoft cloud services. Customer data (including customer name, contact details, account information, payment card data, security credentials and correspondence). Employee data (including employee name, contact details, internal and external correspondence by email and other means and personal information relating to their employment with the organisation). Transaction data (data relating to transactions in which the organisation is involved). Indices (for example, market Other personal and non-personal data relating to the organisation’s business operations as a financial institution. We ensure, pursuant to the terms of the contract in place with Microsoft, that all data is treated with the highest level of security so that we can continue to comply with our legal and regulatory obligations and our commitments to customers. We only collect and process data that is necessary for our business operations in compliance with all applicable laws and regulation and this applies whether we process the data on our own systems or via a cloud solution. How is the issue of counterparty risk addressed through Various APRA documents recommend that financial institutions do their due diligence on the service provider to address risks associated with a service provider failing to meet the terms of any agreement or otherwise to perform as agreed (for example, the APRA Prudential Practice Guide: Outsourcing). The following is a summary of the factors that our customers typically tell us are important. To access more information about Microsoft, visit the Trust Center at microsoft.com/trust.
the contract terminates)? on-premises solution but it is still useful to consider what would happen to data at the end of the relationship with your service provider. Yes. Microsoft uses best practice procedures and a wiping solution that is NIST 800-88 compliant. For hard drives that cannot be wiped it uses a destruction process that destroys it (i.e. shredding) and renders the recovery of information impossible (e.g., disintegrate, shred, pulverize, or incinerate). The appropriate means of disposal is determined by the asset type. Records of the destruction are retained. All Microsoft online services utilize approved media storage and disposal management services. Paper documents are destroyed by approved means at the pre-determined end-of-life cycle. “Secure disposal or re-use of equipment and disposal of media” is covered under the ISO/IEC 27001 standards against which Microsoft is certified. Are there documented security procedures for safeguarding premises and restricted areas? If yes, provide descriptions of these procedures. APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “The absence of physical security could compromise the effectiveness of other IT security controls”. Yes. Physical access control uses multiple authentication and security processes, including badges and smart cards, biometric scanners, on-premises security officers, continuous video surveillance and two-factor authentication. The data centres are monitored using motion sensors, video surveillance and security breach alarms. Are there documented security procedures for safeguarding hardware, software APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “The absence of physical security could compromise the effectiveness of other IT security controls”. Yes. are described at length in the Microsoft Trust Center at microsoft.com/trust.