Microsoft has the following operational processes in place: Proactive capacity management based on defined thresholds or events Hardware and software subsystem monitoring for The availability, quality, and adequate acceptable service performance and availability OP-03 capacity and resources be planned, CPU utilization, service utilization, storage utilization and prepared, and measured to deliver the network latency Operations required system performance in accordance Management - with regulatory, contractual and business Business Continuity Management is 1 of the 14 ISO domains that is Capacity / requirements. Projections of future capacity included as part of the ISO certification. Resource requirements shall be made to mitigate the Planning risk of system overload. “Capacity management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 10.3.1. For more information review of the publicly available ISO standards we are certified against is suggested. A process for the development and maintenance of a Services Continuity Management (SCM) is in place for the Office 365 environment. The process contains a strategy for the recovery of Office 365 assets and the resumption of key Office 365 business processes. The continuity solution reflects security, compliance and privacy requirements of the service production environment at the alternate site. OP-04 Beyond this, we go the extra mile and provide quarterly worldwide Policies and procedures shall be uptime over the and financially back our guarantee of 99.9% established for equipment maintenance Operations uptime. Additionally, we have redundancy at the physical, data, and ensuring continuity and availability of Management - functional layers, providing high availability and our disaster operations. Equipment recovery capabilities keep customers up and running. Maintenance Business Continuity Management is one of the 14 ISO domains for which we are certified against. “Equipment maintenance” is covered the ISO 27001 standards, specifically addressed in Annex A, domain 9.2.4. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls RI-01 through RI-05 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response The ISO Plan, Do, Check, Act process is used by Office 365 to RI-01 continually maintain and improve the risk management framework. Organizations develop and maintain an Risk Management is one of the 14 ISO domains for which we are Risk enterprise risk management framework to certified against. Management - manage risk to an acceptable level. Program “Establishing the ISMS and risk management framework” is covered under the ISO 27001 standards, specifically addressed in domain
OP-03 Operations Management - Capacity / Resource Planning The availability, quality, and adequate capacity and resources be planned, prepared, and measured to deliver the required system performance in accordance with regulatory, contractual and business requirements. Projections of future capacity requirements shall be made to mitigate the risk of system overload. Microsoft has the following operational processes in place: Proactive capacity management based on defined thresholds or events Hardware and software subsystem monitoring for acceptable service performance and availability CPU utilization, service utilization, storage utilization and network latency Business Continuity Management is 1 of the 14 ISO domains that is included as part of the ISO certification. “Capacity management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 10.3.1. For more information review of the publicly available ISO standards we are certified against is suggested. OP-04 Operations Management - Equipment Maintenance Policies and procedures shall be established for equipment maintenance ensuring continuity and availability of operations. A process for the development and maintenance of a Services Continuity Management (SCM) is in place for the Office 365 environment. The process contains a strategy for the recovery of Office 365 assets and the resumption of key Office 365 business processes. The continuity solution reflects security, compliance and privacy requirements of the service production environment at the alternate site. Beyond this, we go the extra mile and provide quarterly worldwide uptime over the and financially back our guarantee of 99.9% uptime. Additionally, we have redundancy at the physical, data, and functional layers, providing high availability and our disaster recovery capabilities keep customers up and running. Business Continuity Management is one of the 14 ISO domains for which we are certified against. “Equipment maintenance” is covered the ISO 27001 standards, specifically addressed in Annex A, domain 9.2.4. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls RI-01 through RI-05 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response RI-01 Risk Management - Program Organizations develop and maintain an enterprise risk management framework to manage risk to an acceptable level. The ISO Plan, Do, Check, Act process is used by Office 365 to continually maintain and improve the risk management framework. Risk Management is one of the 14 ISO domains for which we are certified against. “Establishing the ISMS and risk management framework” is covered under the ISO 27001 standards, specifically addressed in domain
Office%20365%20mapping%20of%20CSA%20Security%20Compliance%20and%20Privacy%20Cloud%20Control%20Matrix%20requirements_FINALv2final_final.docx