Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls FS-06 through FS-08 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response Microsoft Dynamics CRM Online asset and data protection procedures provide prescriptive guidance around the protection of FS-06 logical and physical data and include instructions addressing relocation. Authorization must be obtained to Facility relocation or transfer of hardware, software Security - “Removal of property and change management” is covered under or data to an offsite premises. the ISO 27001 standards, specifically addressed in Annex A, Authorization domains 9.2.7 and 10.1.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. Microsoft's asset management policy and acceptable use standards were developed and implemented for Microsoft Dynamics CRM Online technology assets, infrastructure components, and services technologies. FS-07 Policies and procedures shall be established A customer-facing version of the Information Security Policy can be for securing and asset management for the made available upon request. Customers and prospective Facility use and secure disposal of equipment customers must have a signed NDA or equivalent in order to Security - maintained and used outside the receive a copy of the Information Security Policy. Equipment organization's premise. “Security of equipment off-premises” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 9.2.5. For more information, we suggest a review of the publicly available ISO standards for which we are certified. Microsoft Dynamics CRM Online has implemented a formal policy that requires assets used to provide the online service to be accounted for and have a designated asset owner. An inventory of major hardware assets in the Microsoft Dynamics CRM Online environment is maintained. Asset owners are responsible for maintaining up-to-date information regarding their assets within FS-08 the asset inventory, including owner or any associated agent, A complete inventory of critical assets shall location, and security classification. Asset owners are also Facility be maintained with ownership defined and responsible for classifying and maintaining the protection of their Security - Asset documented. assets in accordance with the standards. Regular audits occur to Management verify inventory. “Asset management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 7. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls FS-06 through FS-08 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response FS-06 Facility Security - Authorization Authorization must be obtained to relocation or transfer of hardware, software or data to an offsite premises. Microsoft Dynamics CRM Online asset and data protection procedures provide prescriptive guidance around the protection of logical and physical data and include instructions addressing relocation. “Removal of property and change management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 9.2.7 and 10.1.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. FS-07 Facility Security - Equipment Policies and procedures shall be established for securing and asset management for the use and secure disposal of equipment maintained and used outside the organization's premise. Microsoft's asset management policy and acceptable use standards were developed and implemented for Microsoft Dynamics CRM Online technology assets, infrastructure components, and services technologies. A customer-facing version of the Information Security Policy can be made available upon request. Customers and prospective customers must have a signed NDA or equivalent in order to receive a copy of the Information Security Policy. “Security of equipment off-premises” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 9.2.5. For more information, we suggest a review of the publicly available ISO standards for which we are certified. FS-08 Facility Security - Asset Management A complete inventory of critical assets shall be maintained with ownership defined and documented. Microsoft Dynamics CRM Online has implemented a formal policy that requires assets used to provide the online service to be accounted for and have a designated asset owner. An inventory of major hardware assets in the Microsoft Dynamics CRM Online environment is maintained. Asset owners are responsible for maintaining up-to-date information regarding their assets within the asset inventory, including owner or any associated agent, location, and security classification. Asset owners are also responsible for classifying and maintaining the protection of their assets in accordance with the standards. Regular audits occur to verify inventory. “Asset management” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 7. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx