All other categories of data will be stored in the multi-tenant cloud. Microsoft Azure, on which most Microsoft business cloud services are built, hosts multiple tenants in a highly-secure way through logical data isolation. Data storage and processing for our tenant is segregated from each other tenant as described in section E. (Technical and Operational Risk Q&A) below. What data will be Various APRA guidelines on the risks associated with data processing for example, the Practice Guide: CPG – “Prudential processed by the 235 Managing Data Risk”. It is therefore important to understand what data will be processed through Microsoft cloud – service provider on services. You will need to tailor this section depending on what data you intend to store or process within Microsoft cloud behalf of the financial services. The following are common categories of data that our customers choose to store and process in the Microsoft cloud institution? services. Customer data (including customer name, contact details, account information, payment card data, security credentials and correspondence). Employee data (including employee name, contact details, internal and external correspondence by email and other means and personal information relating to their employment with the organisation). Transaction data (data relating to transactions in which the organisation is involved). Indices (for example, market Other personal and non-personal data relating to the organisation’s business operations as a financial institution. We ensure, pursuant to the terms of the contract in place with Microsoft, that all data is treated with the highest level of security so that we can continue to comply with our legal and regulatory obligations and our commitments to customers. We only collect and process data that is necessary for our business operations in compliance with all applicable laws and regulation and this applies whether we process the data on our own systems or via a cloud solution. How is the issue of Various APRA documents recommend that financial institutions do their due diligence on the service provider to address risks counterparty risk associated with a service provider failing to meet the terms of any agreement or otherwise to perform as agreed (for example, addressed through the APRA Prudential Practice Guide: Outsourcing). The following is a summary of the factors that our customers typically tell us are important. To access more information about Microsoft, visit the Trust Center at microsoft.com/trust.
All other categories of data will be stored in the multi-tenant cloud. Microsoft Azure, on which most Microsoft business cloud services are built, hosts multiple tenants in a highly-secure way through logical data isolation. Data storage and processing for our tenant is segregated from each other tenant as described in section E. (Technical and Operational Risk Q&A) below. What data will be processed by the service provider on behalf of the financial institution? Various APRA guidelines on the risks associated with data processing – for example, the “Prudential Practice Guide: CPG 235 – Managing Data Risk”. It is therefore important to understand what data will be processed through Microsoft cloud services. You will need to tailor this section depending on what data you intend to store or process within Microsoft cloud services. The following are common categories of data that our customers choose to store and process in the Microsoft cloud services. Customer data (including customer name, contact details, account information, payment card data, security credentials and correspondence). Employee data (including employee name, contact details, internal and external correspondence by email and other means and personal information relating to their employment with the organisation). Transaction data (data relating to transactions in which the organisation is involved). Indices (for example, market Other personal and non-personal data relating to the organisation’s business operations as a financial institution. We ensure, pursuant to the terms of the contract in place with Microsoft, that all data is treated with the highest level of security so that we can continue to comply with our legal and regulatory obligations and our commitments to customers. We only collect and process data that is necessary for our business operations in compliance with all applicable laws and regulation and this applies whether we process the data on our own systems or via a cloud solution. How is the issue of counterparty risk addressed through Various APRA documents recommend that financial institutions do their due diligence on the service provider to address risks associated with a service provider failing to meet the terms of any agreement or otherwise to perform as agreed (for example, the APRA Prudential Practice Guide: Outsourcing). The following is a summary of the factors that our customers typically tell us are important. To access more information about Microsoft, visit the Trust Center at microsoft.com/trust.
Microsoft_APRA_Checklist_June_2017(10096539_1).docx