Office 365 Security Response in the Context of CSA Cloud Control Matrix Control IS-03 through IS-06 Control ID Description In CCM (CCM Version R1.1. Microsoft Response Management shall approve a formal information security policy document which shall be communicated and published to employees, contractors and other relevant external parties. The Information security policy document is covered under the ISO IS-03 Information Security Policy shall establish 27001 standards, specifically addressed in Annex A, domain 5.1.1, the direction of the organization and align for more information review of the publicly available ISO standards Information to best practices, regulatory, federal/state we are certified against is suggested. Security - Policy and international laws where applicable. The Information Security policy shall be For more information see IS-02 supported by a strategic plan and a security program with well-defined roles and responsibilities for leadership and officer roles. Baseline security requirements shall be established and applied to the design and As part of the overall ISMS framework baseline security implementation of (developed or requirements are constantly reviewed, improved and IS-04 purchased) applications, databases, implemented. systems, and network infrastructure and Information information processing that comply with “Information systems acquisition, development maintenance and Security - policies, standards and applicable security requirements of information systems” is covered under the Baseline regulatory requirements. Compliance with ISO 27001 standards, specifically addressed in Annex A, domain 12. Requirements security baseline requirements must be For more information review of the publicly available ISO standards reassessed at least annually or upon we are certified against is suggested. significant changes. The Microsoft Online Services Information Security Policy undergoes a formal review and update process at a regularly scheduled interval not to exceed 1 year. In the event a significant IS-05 Management review the information change is required in the security requirements, it may be reviewed security policy at planned intervals or as a and updated outside of the regular schedule. Information result of changes to the organization to Security - Policy ensure its continuing effectiveness and “Review of the information security policy” is covered under the Reviews accuracy. ISO 27001 standards, specifically addressed in Annex A, domain 5.1.2. For more information review of the publicly available ISO standards we are certified against is suggested.
Office 365 Security Response in the Context of CSA Cloud Control Matrix Control IS-03 through IS-06 Control ID In CCM Description (CCM Version R1.1. Microsoft Response IS-03 Information Security - Policy Management shall approve a formal information security policy document which shall be communicated and published to employees, contractors and other relevant external parties. The Information Security Policy shall establish the direction of the organization and align to best practices, regulatory, federal/state and international laws where applicable. The Information Security policy shall be supported by a strategic plan and a security program with well-defined roles and responsibilities for leadership and officer roles. Information security policy document is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 5.1.1, for more information review of the publicly available ISO standards we are certified against is suggested. For more information see IS-02 IS-04 Information Security - Baseline Requirements Baseline security requirements shall be established and applied to the design and implementation of (developed or purchased) applications, databases, systems, and network infrastructure and information processing that comply with policies, standards and applicable regulatory requirements. Compliance with security baseline requirements must be reassessed at least annually or upon significant changes. As part of the overall ISMS framework baseline security requirements are constantly reviewed, improved and implemented. “Information systems acquisition, development maintenance and security requirements of information systems” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12. For more information review of the publicly available ISO standards we are certified against is suggested. IS-05 Information Security - Policy Reviews Management review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing effectiveness and accuracy. The Microsoft Online Services Information Security Policy undergoes a formal review and update process at a regularly scheduled interval not to exceed 1 year. In the event a significant change is required in the security requirements, it may be reviewed and updated outside of the regular schedule. “Review of the information security policy” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 5.1.2. For more information review of the publicly available ISO standards we are certified against is suggested.
Standard%20Response%20to%20Request%20For%20Information-O365-Security-Privacy_v2.docx