the contract on-premises solution but it is still useful to consider what would happen to data at the end of the relationship with your service terminates)? provider. Yes. Microsoft uses best practice procedures and a wiping solution that is NIST 800-88 compliant. For hard drives that cannot be wiped it uses a destruction process that destroys it (i.e. shredding) and renders the recovery of information impossible (e.g., disintegrate, shred, pulverize, or incinerate). The appropriate means of disposal is determined by the asset type. Records of the destruction are retained. All Microsoft online services utilize approved media storage and disposal management services. Paper documents are destroyed by approved means at the pre-determined end-of-life cycle. disposal or re-use of equipment and disposal of media” is covered under the ISO/IEC 27001 standards against which “Secure Microsoft is certified. Are there APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “The documented security absence of physical security could compromise the effectiveness of other IT security controls”. procedures for safeguarding Yes. Physical access control uses multiple authentication and security processes, including badges and smart cards, biometric premises and scanners, on-premises security officers, continuous video surveillance and two-factor authentication. The data centres are restricted areas? If monitored using motion sensors, video surveillance and security breach alarms. yes, provide descriptions of these procedures. Are there APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “The documented security absence of physical security could compromise the effectiveness of other IT security controls”. procedures for safeguarding Yes. are described at length in the Microsoft Trust Center at microsoft.com/trust. hardware, software
the contract terminates)? on-premises solution but it is still useful to consider what would happen to data at the end of the relationship with your service provider. Yes. Microsoft uses best practice procedures and a wiping solution that is NIST 800-88 compliant. For hard drives that cannot be wiped it uses a destruction process that destroys it (i.e. shredding) and renders the recovery of information impossible (e.g., disintegrate, shred, pulverize, or incinerate). The appropriate means of disposal is determined by the asset type. Records of the destruction are retained. All Microsoft online services utilize approved media storage and disposal management services. Paper documents are destroyed by approved means at the pre-determined end-of-life cycle. “Secure disposal or re-use of equipment and disposal of media” is covered under the ISO/IEC 27001 standards against which Microsoft is certified. Are there documented security procedures for safeguarding premises and restricted areas? If yes, provide descriptions of these procedures. APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “The absence of physical security could compromise the effectiveness of other IT security controls”. Yes. Physical access control uses multiple authentication and security processes, including badges and smart cards, biometric scanners, on-premises security officers, continuous video surveillance and two-factor authentication. The data centres are monitored using motion sensors, video surveillance and security breach alarms. Are there documented security procedures for safeguarding hardware, software APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “The absence of physical security could compromise the effectiveness of other IT security controls”. Yes. are described at length in the Microsoft Trust Center at microsoft.com/trust.
Microsoft_APRA_Checklist_June_2017(10096539_1).docx