DG-02 Data Governance - Classification Data, and objects containing data, be assigned a classification based on data type, jurisdiction of origin, jurisdiction domiciled, context, legal constraints, contractual constraints, value, sensitivity, criticality to the organization and third party obligation for retention and prevention of unauthorized disclosure or misuse. Microsoft Online Services standards provide guidance for classifying assets of several applicable security classification categories, and then implements a standard set of Security and privacy attributes. “Information classification” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 7.2. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls DG-03 through DG-04 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response DG-03 Data Governance - Handling / Labeling / Security Policy Policies and procedures shall be established for labeling, handling and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data. Microsoft Online Services standards provide guidance for classifying assets of several applicable security classification categories, and then implements a standard set of Security and privacy attributes. “Information classification, labeling and handling” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 7.2. For more information review of the publicly available ISO standards we are certified against is suggested.
DG-04 Data Governance - Retention Policy Policies and procedures for data retention and storage shall be established and backup or redundancy mechanisms implemented to ensure compliance with regulatory, statutory, contractual or business requirements. Testing the recovery of disk or tape backups must be implemented at planned intervals. Microsoft Online Services provides capabilities for customers to apply data retention policies as defined in the individual (). As for backups, content is replicated from a primary data center to a secondary data center. As such, there is not a specific backup schedule as the replication is constant. Customers can choose to perform their own extractions/backups if necessary. Customer data is stored in a redundant environment with robust backup, restore, and failover capabilities to enable availability, business continuity, and rapid recovery. Multiple levels of data redundancy are implemented, ranging from redundant disks to guard against local disk failure to continuous, full data replication to a geographically dispersed data center. Microsoft online undergoes an annual validation of backup/recovery practices. “Information back-up” is covered the ISO 27001 standards, specifically addressed in Annex A, domain 10.5.1. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls DG-05 through DG-06 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response
Office 365 Security Response in the Context of CSA Cloud Control Matrix Control IS-03 through IS-06 Control ID In CCM Description (CCM Version R1.1. Microsoft Response IS-03 Information Security - Policy Management shall approve a formal information security policy document which shall be communicated and published to employees, contractors and other relevant external parties. The Information Security Policy shall establish the direction of the organization and align to best practices, regulatory, federal/state and international laws where applicable. The Information Security policy shall be supported by a strategic plan and a security program with well-defined roles and responsibilities for leadership and officer roles. Information security policy document is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 5.1.1, for more information review of the publicly available ISO standards we are certified against is suggested. For more information see IS-02 IS-04 Information Security - Baseline Requirements Baseline security requirements shall be established and applied to the design and implementation of (developed or purchased) applications, databases, systems, and network infrastructure and information processing that comply with policies, standards and applicable regulatory requirements. Compliance with security baseline requirements must be reassessed at least annually or upon significant changes. As part of the overall ISMS framework baseline security requirements are constantly reviewed, improved and implemented. “Information systems acquisition, development maintenance and security requirements of information systems” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12. For more information review of the publicly available ISO standards we are certified against is suggested. IS-05 Information Security - Policy Reviews Management review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing effectiveness and accuracy. The Microsoft Online Services Information Security Policy undergoes a formal review and update process at a regularly scheduled interval not to exceed 1 year. In the event a significant change is required in the security requirements, it may be reviewed and updated outside of the regular schedule. “Review of the information security policy” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 5.1.2. For more information review of the publicly available ISO standards we are certified against is suggested.
IS-22 Information Security - Incident Management Policy, process and procedures shall be established to triage security related events and ensure timely and thorough incident management. Microsoft Online has developed robust processes to facilitate a coordinated response to incidents if one was to occur. A security incident may include, but are not limited to: e-mail viruses, malware, worms, denial of service attacks, unauthorized access, and any other type of unauthorized, or unlawful activity involving Microsoft Online computer networks or data processing equipment. Our process consists of the following Identification, containment, eradication, recovery, and lessons learned. “Security incident response are covered under the ISO 27001 standards, specifically addressed in Annex A, domain 13.2. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Control Matrix Control IS-23 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response IS-23 Information Security - Incident Reporting Contractors, employees and third party users shall be made aware of their responsibility to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a prompt and expedient manner in compliance with statutory, regulatory and contractual requirements. All Microsoft Online Services’ security incidents, weaknesses, and malfunctions are required to be reported by Microsoft Online Services Staff and Contractor Staff immediately. The reporting and handling of these events follow prescribed procedures pursuant to defined and implemented policy. Microsoft Online has developed robust processes to facilitate a coordinated response to incidents if one was to occur. A security event may include, among other things unlawful access to customer data stored on our equipment and facilities and unauthorized access resulting in loss, disclosure or alteration of customer data. The Microsoft Online Security Incident Response process follows the following phases: • Identification – System and security alerts may be harvested, correlated, and analyzed. Events are investigated by Microsoft Online operational and security organizations. . If an indicates a security issue, the incident is assigned a severity classification and appropriately escalated within Microsoft. This escalation will include product, security, and engineering specialists. • Containment – The escalation team evaluates the scope and impact of an incident. The immediate priority of the escalation team is to ensure the incident is contained and data is safe. The escalation team forms the response, performs appropriate testing,
SA-15 Security Architecture - Mobile Code Mobile code shall be authorized before its installation and use, and the configuration shall ensure that the authorized mobile code operates according to a clearly defined security policy. All unauthorized mobile code shall be prevented from executing. Microsoft Online Services is an isolated server centric environment which mobile code isn’t as applicable as in a desktop environment. In addition, all code is explicitly installed on our servers by Administrators through the change control process. “Controls against mobile code” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 10.4.2. For more information review of the publicly available ISO standards we are certified against is suggested.