Microsoft Dynamics CRM Online Response in the Context of CSA Control Matrix Controls CO-01 through CO-02 Control ID Description Microsoft Response In CCM (CCM Version R1.1. Our goals are to operate our services with security as a key principle, and to give you accurate assurances about our security. We have implemented and will maintain reasonable and appropriate technical and organizational measures, internal controls, and information security routines intended to help protect customer data against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction. Each year, we undergo third-party audits by internationally recognized auditors to validate that we have independent attestation of compliance with our policies and procedures for security, privacy, continuity, and compliance. Audit information is available under NDA upon request by prospective customers and through the Trust Center for current Audit plans, activities and operational action customers. CO-01 items focusing on data duplication, access, and data boundary limitations shall be designed to Microsoft Dynamics CRM Online independent audit reports Compliance - minimize the risk of business process and certifications are shared with customers in lieu of Audit Planning disruption. Audit activities must be planned and individual customer audits. These certifications and agreed upon in advance by stakeholders. attestations accurately represent how we obtain and meet our security and compliance objectives and serve as a practical mechanism to validate our promises for all customers. For security and operational reasons, Microsoft Dynamics CRM Online does not our customers to perform their own audits. “Monitor and review the Information Security Management System (ISMS)” is covered under the ISO 27001 standards, specifically addressed in Clause 4.2.3. For more information, we suggest a review of the publicly available ISO standards for which we are certified. Independent reviews and assessments shall be CO-02 performed at least annually, or at planned intervals, to ensure the organization is For more information see CO-01 or the Trust Center for our Compliance - compliant with policies, procedures, standards current certifications and third party attestations. Independent and applicable regulatory requirements (i.e., Audits internal/external audits, certifications, vulnerability and penetration testing)
Microsoft Dynamics CRM Online Response in the Context of CSA Control Matrix Controls CO-01 through CO-02 Control ID In CCM Description (CCM Version R1.1. Microsoft Response CO-01 Compliance - Audit Planning Audit plans, activities and operational action items focusing on data duplication, access, and data boundary limitations shall be designed to minimize the risk of business process disruption. Audit activities must be planned and agreed upon in advance by stakeholders. Our goals are to operate our services with security as a key principle, and to give you accurate assurances about our security. We have implemented and will maintain reasonable and appropriate technical and organizational measures, internal controls, and information security routines intended to help protect customer data against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction. Each year, we undergo third-party audits by internationally recognized auditors to validate that we have independent attestation of compliance with our policies and procedures for security, privacy, continuity, and compliance. Audit information is available under NDA upon request by prospective customers and through the Trust Center for current customers. Microsoft Dynamics CRM Online independent audit reports and certifications are shared with customers in lieu of individual customer audits. These certifications and attestations accurately represent how we obtain and meet our security and compliance objectives and serve as a practical mechanism to validate our promises for all customers. For security and operational reasons, Microsoft Dynamics CRM Online does not our customers to perform their own audits. “Monitor and review the Information Security Management System (ISMS)” is covered under the ISO 27001 standards, specifically addressed in Clause 4.2.3. For more information, we suggest a review of the publicly available ISO standards for which we are certified. CO-02 Compliance - Independent Audits Independent reviews and assessments shall be performed at least annually, or at planned intervals, to ensure the organization is compliant with policies, procedures, standards and applicable regulatory requirements (i.e., internal/external audits, certifications, vulnerability and penetration testing) For more information see CO-01 or the Trust Center for our current certifications and third party attestations.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx