Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls SA-07 through SA-08 Control ID Description In CCM (CCM Version R1.1. Final) Microsoft Response Access to the Microsoft Dynamics CRM Online production environments by staff and contractors is tightly controlled. All access requires management approval. Automation exists to remove access upon change in employee status. All other Multi-factor authentication is required for all access is tracked and reviewed on a regular basis. remote user access. SA-07 What forms of authentication are used for Terminal Services servers are configured to use the highest operations requiring high assurance? This encryption setting. Security may include login to management interfaces, Architecture - key creation, access to multiple-user Remote access requires two-factor authentication to a secure Remote User accounts, firewall configuration, remote terminal server. Microsoft must have a Microsoft-issued access, etc. smartcard with a valid certificate and a valid domain account to Authentication · Is two-factor authentication used to manage establish a remote access session. critical components within the infrastructure, such as firewalls, etc.? “Microsoft user authentication for external connections” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 11.4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. Network environments be designed and configured to restrict connections between The networks within the Microsoft Dynamics CRM Online data trusted and untrusted networks and reviewed centers are designed to create multiple separate network at planned intervals, documenting the segments. This segmentation helps to provide physical SA-08 business justification for use of all services, separation of critical, back-end servers and storage devices protocols, and ports allowed, including from the public-facing interfaces. Security rationale or compensating controls Architecture - implemented for those protocols considered “Segregation in networks” is covered under the ISO 27001 Network Security to be insecure. Network architecture standards, specifically addressed in Annex A, domain 11.4.5. diagrams must clearly identify high-risk For more information review of the publicly available ISO environments and data flows that may have standards we are certified against is suggested. regulatory compliance impacts.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Controls SA-07 through SA-08 Control ID In CCM Description (CCM Version R1.1. Final) Microsoft Response SA-07 Security Architecture - Remote User Authentication Multi-factor authentication is required for all remote user access. What forms of authentication are used for operations requiring high assurance? This may include login to management interfaces, key creation, access to multiple-user accounts, firewall configuration, remote access, etc. · Is two-factor authentication used to manage critical components within the infrastructure, such as firewalls, etc.? Access to the Microsoft Dynamics CRM Online production environments by staff and contractors is tightly controlled. All access requires management approval. Automation exists to remove access upon change in employee status. All other access is tracked and reviewed on a regular basis. Terminal Services servers are configured to use the highest encryption setting. Remote access requires two-factor authentication to a secure terminal server. Microsoft must have a Microsoft-issued smartcard with a valid certificate and a valid domain account to establish a remote access session. “Microsoft user authentication for external connections” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 11.4.2. For more information, we suggest a review of the publicly available ISO standards for which we are certified. SA-08 Security Architecture - Network Security Network environments be designed and configured to restrict connections between trusted and untrusted networks and reviewed at planned intervals, documenting the business justification for use of all services, protocols, and ports allowed, including rationale or compensating controls implemented for those protocols considered to be insecure. Network architecture diagrams must clearly identify high-risk environments and data flows that may have regulatory compliance impacts. The networks within the Microsoft Dynamics CRM Online data centers are designed to create multiple separate network segments. This segmentation helps to provide physical separation of critical, back-end servers and storage devices from the public-facing interfaces. “Segregation in networks” is covered under the ISO 27001 standards, specifically addressed in Annex A, domain 11.4.5. For more information review of the publicly available ISO standards we are certified against is suggested.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx