Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls SA-03 through SA-04 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response To minimize the risks associated with the exchange of assets between organizations, exchanges between Policies and procedures be established and internal or external organizations are completed in a mechanisms implemented to ensure security (e.g., predefined manner and access to the Microsoft SA-03 encryption, access controls, and leakage Dynamics CRM Online production environments by staff prevention) and integrity of data exchanged and contractor staff is tightly controlled. Security between one or more system interfaces, Architecture - jurisdictions, or with a third party shared services “Information exchange policies and procedures and Data Security / provider to prevent improper disclosure, alteration information leakage” is covered under the ISO 27001 Integrity or destruction complying with legislative, standards, specifically addressed in Annex A, domains regulatory, and contractual requirements. 10.8.1 and 12.5.4. For more information, we suggest a review of the publicly available ISO standards for which we are certified. Microsoft applies Security Development Lifecycle, a software security assurance process, to design, develop, and implement the Microsoft Dynamics CRM Online service. Security Development Lifecycle helps to ensure that communication and collaboration services are highly secured—even at the foundation level. Through controls like Establish Design Requirements, Analyze Attack Surface, and Threat Modeling, Security Development Lifecycle helps Microsoft identify potential threats while running a service and exposed aspects of the service that are open to attack. SA-04 If potential threats are identified at Design, Applications shall be designed in accordance with Development, or Implementation phases, Microsoft can Security industry accepted security standards (i.e., OWASP minimize the probability of attacks by restricting services Architecture - for web applications) and complies with applicable or eliminating unnecessary functions. After eliminating Application regulatory and business requirements. the unnecessary functions, Microsoft reduces these Security potential threats in the Verification phase by fully testing the controls in the Design phase. More information can be found in: Furthermore, we validate the service using third-party penetration testing based upon the Open Web Application Security Project (OWASP) Top Ten. “Control of technical vulnerabilities” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12.6.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls SA-03 through SA-04 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response SA-03 Security Architecture - Data Security / Integrity Policies and procedures be established and mechanisms implemented to ensure security (e.g., encryption, access controls, and leakage prevention) and integrity of data exchanged between one or more system interfaces, jurisdictions, or with a third party shared services provider to prevent improper disclosure, alteration or destruction complying with legislative, regulatory, and contractual requirements. To minimize the risks associated with the exchange of assets between organizations, exchanges between internal or external organizations are completed in a predefined manner and access to the Microsoft Dynamics CRM Online production environments by staff and contractor staff is tightly controlled. “Information exchange policies and procedures and information leakage” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 10.8.1 and 12.5.4. For more information, we suggest a review of the publicly available ISO standards for which we are certified. SA-04 Security Architecture - Application Security Applications shall be designed in accordance with industry accepted security standards (i.e., OWASP for web applications) and complies with applicable regulatory and business requirements. Microsoft applies Security Development Lifecycle, a software security assurance process, to design, develop, and implement the Microsoft Dynamics CRM Online service. Security Development Lifecycle helps to ensure that communication and collaboration services are highly secured—even at the foundation level. Through controls like Establish Design Requirements, Analyze Attack Surface, and Threat Modeling, Security Development Lifecycle helps Microsoft identify potential threats while running a service and exposed aspects of the service that are open to attack. If potential threats are identified at Design, Development, or Implementation phases, Microsoft can minimize the probability of attacks by restricting services or eliminating unnecessary functions. After eliminating the unnecessary functions, Microsoft reduces these potential threats in the Verification phase by fully testing the controls in the Design phase. More information can be found in: Furthermore, we validate the service using third-party penetration testing based upon the Open Web Application Security Project (OWASP) Top Ten. “Control of technical vulnerabilities” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12.6.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx