Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls RI-01 through RI-03 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response The ISO Plan, Do, Act process is used by Microsoft to RI-01 continually maintain and improve the risk management framework. Organizations shall develop and maintain Risk an enterprise risk management framework “Establishing the ISMS and risk management framework” is covered Management - to manage risk to an acceptable level. under the ISO 27001 standards, specifically addressed in domain Program 4.2.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified. Microsoft’s Risk Management organization bases the risk Aligned with the enterprise-wide assessment framework on the ISO27001 standards. An integrated framework. Formal risk assessments be part of the methodology is the Risk Assessment process. The Risk performed at least annually, or at planned Assessment Assess phase begins with identifying risks, establishing intervals, determining the likelihood and a risk level by determining the likelihood of occurrence and impact, RI-02 impact of all identified risks, using and finally, identifying controls and safeguards that reduce the qualitative and quantitative methods. The impact of the risk to an acceptable level. According measures, Risk likelihood and impact associated with recommendations, and controls are put in place to mitigate the Management - inherent and residual risk should be risks to the extent possible. Assessments determined independently, considering all risk categories (e.g., audit results, threat “Establishing and managing the ISMS” is covered under the ISO and vulnerability analysis, and regulatory 27001 standards, specifically addressed in Clause 4.2. For more compliance). information, we suggest a review of the publicly available ISO standards for which we are certified. RI-03 Risks shall be mitigated to an acceptable “Establishing and managing the ISMS” is covered the ISO level. Acceptance levels based on risk 27001 standards, specifically addressed in Clause 4.2. For more Risk criteria shall be established and information, we suggest a review of the publicly available ISO Management - documented in accordance with reasonable standards for which we are certified. Mitigation / resolution time frames and executive Acceptance approval. For additional information, see RI-02.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls RI-01 through RI-03 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response RI-01 Risk Management - Program Organizations shall develop and maintain an enterprise risk management framework to manage risk to an acceptable level. The ISO Plan, Do, Act process is used by Microsoft to continually maintain and improve the risk management framework. “Establishing the ISMS and risk management framework” is covered under the ISO 27001 standards, specifically addressed in domain 4.2.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified. RI-02 Risk Management - Assessments Aligned with the enterprise-wide framework. Formal risk assessments be performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk should be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance). Microsoft’s Risk Management organization bases the risk assessment framework on the ISO27001 standards. An integrated part of the methodology is the Risk Assessment process. The Risk Assessment Assess phase begins with identifying risks, establishing a risk level by determining the likelihood of occurrence and impact, and finally, identifying controls and safeguards that reduce the impact of the risk to an acceptable level. According measures, recommendations, and controls are put in place to mitigate the risks to the extent possible. “Establishing and managing the ISMS” is covered under the ISO 27001 standards, specifically addressed in Clause 4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. RI-03 Risk Management - Mitigation / Acceptance Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and executive approval. “Establishing and managing the ISMS” is covered the ISO 27001 standards, specifically addressed in Clause 4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. For additional information, see RI-02.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx