IS-22 Policy, process and procedures shall be Microsoft Online has developed robust processes to facilitate a established to triage security related coordinated response to incidents if one was to occur. A security Information events and ensure timely and thorough incident may include, but are not limited to: e-mail viruses, malware, incident management. worms, denial of service attacks, unauthorized access, and any other Security - Incident type of unauthorized, or unlawful activity involving Microsoft Online Management computer networks or data processing equipment. Our process consists of the following Identification, containment, eradication, recovery, and lessons learned. “Security incident response are covered under the ISO 27001 standards, specifically addressed in Annex A, domain 13.2. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Control Matrix Control IS-23 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response All Microsoft Online Services’ security incidents, weaknesses, and malfunctions are required to be reported by Microsoft Online Services Staff and Contractor Staff immediately. The reporting and handling of these events follow prescribed procedures pursuant to defined and implemented policy. Microsoft Online has developed robust processes to facilitate a coordinated response to incidents if one was to occur. A security event may include, among other things unlawful access to Contractors, employees and third party users customer data stored on our equipment and facilities and shall be made aware of their responsibility to IS-23 unauthorized access resulting in loss, disclosure or alteration of report all information security events in a customer data. timely manner. Information security events Information shall be reported through predefined Security - The Microsoft Online Security Incident Response process follows communications channels in a prompt and Incident the following phases: expedient manner in compliance with Reporting statutory, regulatory and contractual • – Identification System and security alerts may be harvested, requirements. correlated, and analyzed. Events are investigated by Microsoft Online operational and security organizations. . If an indicates a security issue, the incident is assigned a severity classification and appropriately escalated within Microsoft. This escalation will include product, security, and engineering specialists. • Containment – The escalation team evaluates the scope and impact of an incident. The immediate priority of the escalation team is to ensure the incident is contained and data is safe. The escalation team forms the response, performs appropriate testing,
IS-22 Information Security - Incident Management Policy, process and procedures shall be established to triage security related events and ensure timely and thorough incident management. Microsoft Online has developed robust processes to facilitate a coordinated response to incidents if one was to occur. A security incident may include, but are not limited to: e-mail viruses, malware, worms, denial of service attacks, unauthorized access, and any other type of unauthorized, or unlawful activity involving Microsoft Online computer networks or data processing equipment. Our process consists of the following Identification, containment, eradication, recovery, and lessons learned. “Security incident response are covered under the ISO 27001 standards, specifically addressed in Annex A, domain 13.2. For more information review of the publicly available ISO standards we are certified against is suggested. Office 365 Security Response in the Context of CSA Control Matrix Control IS-23 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response IS-23 Information Security - Incident Reporting Contractors, employees and third party users shall be made aware of their responsibility to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a prompt and expedient manner in compliance with statutory, regulatory and contractual requirements. All Microsoft Online Services’ security incidents, weaknesses, and malfunctions are required to be reported by Microsoft Online Services Staff and Contractor Staff immediately. The reporting and handling of these events follow prescribed procedures pursuant to defined and implemented policy. Microsoft Online has developed robust processes to facilitate a coordinated response to incidents if one was to occur. A security event may include, among other things unlawful access to customer data stored on our equipment and facilities and unauthorized access resulting in loss, disclosure or alteration of customer data. The Microsoft Online Security Incident Response process follows the following phases: • Identification – System and security alerts may be harvested, correlated, and analyzed. Events are investigated by Microsoft Online operational and security organizations. . If an indicates a security issue, the incident is assigned a severity classification and appropriately escalated within Microsoft. This escalation will include product, security, and engineering specialists. • Containment – The escalation team evaluates the scope and impact of an incident. The immediate priority of the escalation team is to ensure the incident is contained and data is safe. The escalation team forms the response, performs appropriate testing,
Standard%20Response%20to%20Request%20For%20Information-O365-Security-Privacy_v2.docx