Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls LG-01 through LG-02 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response Microsoft Legal department and Human Resources maintain policies and procedures defining the implementation and Requirements for non-disclosure or execution of non- disclosure and confidentiality agreements which LG-01 confidentiality agreements reflecting the prevent us from providing specific information about one organization's needs for the protection of customer’s data to other customers. Legal - data and operational details shall be identified, documented and reviewed at “Confidentiality agreements and non-disclosure agreements” is Agreements planned intervals. covered under the ISO 27001 standards, specifically addressed in Annex A, domain 6.1.5. For more information review of the publicly available ISO standards we are certified against is suggested. party agreements that directly, or Office 365 standards specify that the Office 365 Risk Management indirectly, impact the organizations organization approves certain exchanges with parties outside of information assets or data are required to Office 365. As part of this process, the Risk Management include explicit coverage of all relevant organization ensures that exchanges of High Business Impact (Loss security requirements. This includes could result in immediate, direct, considerable impact to business LG-02 agreements involving processing, accessing, and includes Highly Sensitive Personally Identifiable Information) communicating, hosting or managing the and Medium Business Impact (Loss could result in indirect, limited - Third organization's information assets, or adding impact to the business and includes Personally Identifiable Party or terminating services or products to Information) assets with non-Microsoft parties are made only in Agreements existing information. Assets agreements connection with a formal procedure. provisions shall include security (e.g., encryption, access controls, and leakage “Addressing security in third party agreements” is covered under prevention) and integrity controls for data the ISO 27001 standards, specifically addressed in Annex A, domain exchanged to prevent improper disclosure, 6.2.3. For more information review of the publicly available ISO alteration or destruction. standards we are certified against is suggested.
Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls LG-01 through LG-02 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response LG-01 Legal - Agreements Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented and reviewed at planned intervals. Microsoft Legal department and Human Resources maintain policies and procedures defining the implementation and execution of non- disclosure and confidentiality agreements which prevent us from providing specific information about one customer’s data to other customers. “Confidentiality agreements and non-disclosure agreements” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 6.1.5. For more information review of the publicly available ISO standards we are certified against is suggested. LG-02 - Third Party Agreements party agreements that directly, or indirectly, impact the organizations information assets or data are required to include explicit coverage of all relevant security requirements. This includes agreements involving processing, accessing, communicating, hosting or managing the organization's information assets, or adding or terminating services or products to existing information. Assets agreements provisions shall include security (e.g., encryption, access controls, and leakage prevention) and integrity controls for data exchanged to prevent improper disclosure, alteration or destruction. Office 365 standards specify that the Office 365 Risk Management organization approves certain exchanges with parties outside of Office 365. As part of this process, the Risk Management organization ensures that exchanges of High Business Impact (Loss could result in immediate, direct, considerable impact to business and includes Highly Sensitive Personally Identifiable Information) and Medium Business Impact (Loss could result in indirect, limited impact to the business and includes Personally Identifiable Information) assets with non-Microsoft parties are made only in connection with a formal procedure. “Addressing security in third party agreements” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 6.2.3. For more information review of the publicly available ISO standards we are certified against is suggested.
Office%20365%20mapping%20of%20CSA%20Security%20Compliance%20and%20Privacy%20Cloud%20Control%20Matrix%20requirements_FINALv2final_final.docx