Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Control IS-20 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response Microsoft Dynamics CRM Online implements technologies to scan the environment for vulnerabilities. Identified vulnerabilities are tracked and verified for remediation. In addition, regular vulnerability/penetration assessments to identify vulnerabilities and determine whether key logical controls are operating effectively are performed. The Microsoft Security Response Center (MSRC) regularly monitors Policies and procedures shall be external security vulnerability awareness sites. As part of the routine established and mechanism vulnerability management process, the Microsoft Dynamics CRM Online IS-20 implemented for vulnerability and team evaluates our exposure to these vulnerabilities and takes action to patch management, ensuring that mitigate risks when necessary. Information application, system, and network Security - device vulnerabilities are evaluated The MSRC releases security bulletins on the second Tuesday of every Vulnerability / and Contractor-supplied security month (“Patch Tuesday”), or as appropriate to mitigate zero-day exploits. Patch patches applied in a timely manner In the event that proof-of-concept code is publicly available regarding a Management taking a risk-based approach for possible exploit, or if a new critical security patch is released, Microsoft prioritizing critical patches. Dynamics CRM Online is required to apply patches to affected systems according to a patching policy to remediate the vulnerability to the customer’s hosted environment. “Control of technical vulnerabilities” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12.6. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Control IS-20 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response IS-20 Information Security - Vulnerability / Patch Management Policies and procedures shall be established and mechanism implemented for vulnerability and patch management, ensuring that application, system, and network device vulnerabilities are evaluated and Contractor-supplied security patches applied in a timely manner taking a risk-based approach for prioritizing critical patches. Microsoft Dynamics CRM Online implements technologies to scan the environment for vulnerabilities. Identified vulnerabilities are tracked and verified for remediation. In addition, regular vulnerability/penetration assessments to identify vulnerabilities and determine whether key logical controls are operating effectively are performed. The Microsoft Security Response Center (MSRC) regularly monitors external security vulnerability awareness sites. As part of the routine vulnerability management process, the Microsoft Dynamics CRM Online team evaluates our exposure to these vulnerabilities and takes action to mitigate risks when necessary. The MSRC releases security bulletins on the second Tuesday of every month (“Patch Tuesday”), or as appropriate to mitigate zero-day exploits. In the event that proof-of-concept code is publicly available regarding a possible exploit, or if a new critical security patch is released, Microsoft Dynamics CRM Online is required to apply patches to affected systems according to a patching policy to remediate the vulnerability to the customer’s hosted environment. “Control of technical vulnerabilities” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 12.6. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx