Microsoft Dynamics CRM Online Response in the Context of CSA Control Matrix Controls CO-01 through CO-02 Control ID In CCM Description (CCM Version R1.1. Microsoft Response CO-01 Compliance - Audit Planning Audit plans, activities and operational action items focusing on data duplication, access, and data boundary limitations shall be designed to minimize the risk of business process disruption. Audit activities must be planned and agreed upon in advance by stakeholders. Our goals are to operate our services with security as a key principle, and to give you accurate assurances about our security. We have implemented and will maintain reasonable and appropriate technical and organizational measures, internal controls, and information security routines intended to help protect customer data against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction. Each year, we undergo third-party audits by internationally recognized auditors to validate that we have independent attestation of compliance with our policies and procedures for security, privacy, continuity, and compliance. Audit information is available under NDA upon request by prospective customers and through the Trust Center for current customers. Microsoft Dynamics CRM Online independent audit reports and certifications are shared with customers in lieu of individual customer audits. These certifications and attestations accurately represent how we obtain and meet our security and compliance objectives and serve as a practical mechanism to validate our promises for all customers. For security and operational reasons, Microsoft Dynamics CRM Online does not our customers to perform their own audits. “Monitor and review the Information Security Management System (ISMS)” is covered under the ISO 27001 standards, specifically addressed in Clause 4.2.3. For more information, we suggest a review of the publicly available ISO standards for which we are certified. CO-02 Compliance - Independent Audits Independent reviews and assessments shall be performed at least annually, or at planned intervals, to ensure the organization is compliant with policies, procedures, standards and applicable regulatory requirements (i.e., internal/external audits, certifications, vulnerability and penetration testing) For more information see CO-01 or the Trust Center for our current certifications and third party attestations.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls FS-06 through FS-08 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response FS-06 Facility Security - Authorization Authorization must be obtained to relocation or transfer of hardware, software or data to an offsite premises. Microsoft Dynamics CRM Online asset and data protection procedures provide prescriptive guidance around the protection of logical and physical data and include instructions addressing relocation. “Removal of property and change management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 9.2.7 and 10.1.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. FS-07 Facility Security - Equipment Policies and procedures shall be established for securing and asset management for the use and secure disposal of equipment maintained and used outside the organization's premise. Microsoft's asset management policy and acceptable use standards were developed and implemented for Microsoft Dynamics CRM Online technology assets, infrastructure components, and services technologies. A customer-facing version of the Information Security Policy can be made available upon request. Customers and prospective customers must have a signed NDA or equivalent in order to receive a copy of the Information Security Policy. “Security of equipment off-premises” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 9.2.5. For more information, we suggest a review of the publicly available ISO standards for which we are certified. FS-08 Facility Security - Asset Management A complete inventory of critical assets shall be maintained with ownership defined and documented. Microsoft Dynamics CRM Online has implemented a formal policy that requires assets used to provide the online service to be accounted for and have a designated asset owner. An inventory of major hardware assets in the Microsoft Dynamics CRM Online environment is maintained. Asset owners are responsible for maintaining up-to-date information regarding their assets within the asset inventory, including owner or any associated agent, location, and security classification. Asset owners are also responsible for classifying and maintaining the protection of their assets in accordance with the standards. Regular audits occur to verify inventory. “Asset management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 7. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Control IS-20 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response IS-20 Information Security - Vulnerability / Patch Management Policies and procedures shall be established and mechanism implemented for vulnerability and patch management, ensuring that application, system, and network device vulnerabilities are evaluated and Contractor-supplied security patches applied in a timely manner taking a risk-based approach for prioritizing critical patches. Microsoft Dynamics CRM Online implements technologies to scan the environment for vulnerabilities. Identified vulnerabilities are tracked and verified for remediation. In addition, regular vulnerability/penetration assessments to identify vulnerabilities and determine whether key logical controls are operating effectively are performed. The Microsoft Security Response Center (MSRC) regularly monitors external security vulnerability awareness sites. As part of the routine vulnerability management process, the Microsoft Dynamics CRM Online team evaluates our exposure to these vulnerabilities and takes action to mitigate risks when necessary. The MSRC releases security bulletins on the second Tuesday of every month (“Patch Tuesday”), or as appropriate to mitigate zero-day exploits. In the event that proof-of-concept code is publicly available regarding a possible exploit, or if a new critical security patch is released, Microsoft Dynamics CRM Online is required to apply patches to affected systems according to a patching policy to remediate the vulnerability to the customer’s hosted environment. “Control of technical vulnerabilities” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12.6. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls RI-01 through RI-03 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response RI-01 Risk Management - Program Organizations shall develop and maintain an enterprise risk management framework to manage risk to an acceptable level. The ISO Plan, Do, Act process is used by Microsoft to continually maintain and improve the risk management framework. “Establishing the ISMS and risk management framework” is covered under the ISO 27001 standards, specifically addressed in domain 4.2.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified. RI-02 Risk Management - Assessments Aligned with the enterprise-wide framework. Formal risk assessments be performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk should be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance). Microsoft’s Risk Management organization bases the risk assessment framework on the ISO27001 standards. An integrated part of the methodology is the Risk Assessment process. The Risk Assessment Assess phase begins with identifying risks, establishing a risk level by determining the likelihood of occurrence and impact, and finally, identifying controls and safeguards that reduce the impact of the risk to an acceptable level. According measures, recommendations, and controls are put in place to mitigate the risks to the extent possible. “Establishing and managing the ISMS” is covered under the ISO 27001 standards, specifically addressed in Clause 4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. RI-03 Risk Management - Mitigation / Acceptance Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and executive approval. “Establishing and managing the ISMS” is covered the ISO 27001 standards, specifically addressed in Clause 4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. For additional information, see RI-02.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Control SA-01 Control ID In CCM Description (CCM Version R1.1. Microsoft Response SA-01 Security Architecture - Customer Access Requirements Prior to granting customers access to data, assets and information systems, all identified security, contractual and regulatory requirements for customer access shall be addressed and remediated. Our customers around the world are subject to many different laws and regulations. Legal requirements in one country or industry may be inconsistent with legal requirements applicable elsewhere. As a provider of global cloud services, we must run our services with common operational practices and features across multiple customers and jurisdictions. To help our customers comply with their own requirements, we build our services with common privacy and security requirements in mind. To the extent that we identified security, contractual, and regulatory work to the customer that we will be requiring of ourselves, we have addressed and remediated these requirements through a set regime of testing prior to sale of services and ongoing thereafter. However, it is ultimately up to our customers to evaluate our offerings against their own requirements, so they can determine if our services satisfy their regulatory needs. We are committed to providing our customers detailed information about our cloud services to help them make their own regulatory assessments. “Identification of risks related to external parties and access control policy” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 6.2.1 and 11.1.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls SA-03 through SA-04 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response SA-03 Security Architecture - Data Security / Integrity Policies and procedures be established and mechanisms implemented to ensure security (e.g., encryption, access controls, and leakage prevention) and integrity of data exchanged between one or more system interfaces, jurisdictions, or with a third party shared services provider to prevent improper disclosure, alteration or destruction complying with legislative, regulatory, and contractual requirements. To minimize the risks associated with the exchange of assets between organizations, exchanges between internal or external organizations are completed in a predefined manner and access to the Microsoft Dynamics CRM Online production environments by staff and contractor staff is tightly controlled. “Information exchange policies and procedures and information leakage” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 10.8.1 and 12.5.4. For more information, we suggest a review of the publicly available ISO standards for which we are certified. SA-04 Security Architecture - Application Security Applications shall be designed in accordance with industry accepted security standards (i.e., OWASP for web applications) and complies with applicable regulatory and business requirements. Microsoft applies Security Development Lifecycle, a software security assurance process, to design, develop, and implement the Microsoft Dynamics CRM Online service. Security Development Lifecycle helps to ensure that communication and collaboration services are highly secured—even at the foundation level. Through controls like Establish Design Requirements, Analyze Attack Surface, and Threat Modeling, Security Development Lifecycle helps Microsoft identify potential threats while running a service and exposed aspects of the service that are open to attack. If potential threats are identified at Design, Development, or Implementation phases, Microsoft can minimize the probability of attacks by restricting services or eliminating unnecessary functions. After eliminating the unnecessary functions, Microsoft reduces these potential threats in the Verification phase by fully testing the controls in the Design phase. More information can be found in: Furthermore, we validate the service using third-party penetration testing based upon the Open Web Application Security Project (OWASP) Top Ten. “Control of technical vulnerabilities” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12.6.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls SA-07 through SA-08 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response SA-07 Security Architecture - Remote User Authentication Multi-factor authentication is required for all remote user access. What forms of authentication are used for operations requiring high assurance? This may include login to management interfaces, key creation, access to multiple-user accounts, firewall configuration, remote access, etc. · Is two-factor authentication used to manage critical components within the infrastructure, such as firewalls, etc.? Access to the Microsoft Dynamics CRM Online production environments by staff and contractors is tightly controlled. All access requires management approval. Automation exists to remove access upon change in employee status. All other access is tracked and reviewed on a regular basis. Terminal Services servers are configured to use the highest encryption setting. Remote access requires two-factor authentication to a secure terminal server. Microsoft must have a Microsoft-issued smartcard with a valid certificate and a valid domain account to establish a remote access session. “Microsoft user authentication for external connections” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 11.4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. SA-08 Security Architecture - Network Security Network environments be designed and configured to restrict connections between trusted and untrusted networks and reviewed at planned intervals, documenting the business justification for use of all services, protocols, and ports allowed, including rationale or compensating controls implemented for those protocols considered to be insecure. Network architecture diagrams must clearly identify high-risk environments and data flows that may have regulatory compliance impacts. The networks within the Microsoft Dynamics CRM Online data centers are designed to create multiple separate network segments. This segmentation helps to provide physical separation of critical, back-end servers and storage devices from the public-facing interfaces. “Segregation in networks” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 11.4.5. For more information review of the publicly available ISO standards we are certified against is suggested.