Microsoft Online Services provides capabilities for customers to apply data retention policies as defined in the individual (). As for backups, content is replicated from a primary data center to a secondary data center. As such, there is not a specific backup schedule as the replication is constant. Customers can choose to perform their own extractions/backups if necessary. Customer data Policies and procedures for data retention DG-04 is stored in a redundant environment with robust backup, restore, and storage shall be established and backup and failover capabilities to enable availability, business continuity, or redundancy mechanisms implemented to Data and rapid recovery. Multiple levels of data redundancy are ensure compliance with regulatory, statutory, Governance - implemented, ranging from redundant disks to guard against local contractual or business requirements. Testing Retention disk failure to continuous, full data replication to a geographically the recovery of disk or tape backups must be Policy dispersed data center. Microsoft online undergoes an annual implemented at planned intervals. validation of backup/recovery practices. “Information back-up” is covered the ISO 27001 standards, specifically addressed in Annex A, domain 10.5.1. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls DG-05 through DG-06 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response
DG-04 Data Governance - Retention Policy Policies and procedures for data retention and storage shall be established and backup or redundancy mechanisms implemented to ensure compliance with regulatory, statutory, contractual or business requirements. Testing the recovery of disk or tape backups must be implemented at planned intervals. Microsoft Online Services provides capabilities for customers to apply data retention policies as defined in the individual (). As for backups, content is replicated from a primary data center to a secondary data center. As such, there is not a specific backup schedule as the replication is constant. Customers can choose to perform their own extractions/backups if necessary. Customer data is stored in a redundant environment with robust backup, restore, and failover capabilities to enable availability, business continuity, and rapid recovery. Multiple levels of data redundancy are implemented, ranging from redundant disks to guard against local disk failure to continuous, full data replication to a geographically dispersed data center. Microsoft online undergoes an annual validation of backup/recovery practices. “Information back-up” is covered the ISO 27001 standards, specifically addressed in Annex A, domain 10.5.1. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Cloud Control Matrix Controls DG-05 through DG-06 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response
Standard%20Response%20to%20Request%20For%20Information-O365-Security-Privacy_v2.docx