Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Control SA-01 Control ID Description In CCM (CCM Version R1.1. Microsoft Response Our customers around the world are subject to many different laws and regulations. Legal requirements in one country or industry may be inconsistent with legal requirements applicable elsewhere. As a provider of global cloud services, we must run our services with common operational practices and features across multiple customers and jurisdictions. To help our customers comply with their own requirements, we build our services with common privacy and security requirements in mind. To the extent that we identified security, contractual, and regulatory work to the SA-01 customer that we will be requiring of ourselves, we have Prior to granting customers access to data, assets and addressed and remediated these requirements through Security information systems, all identified security, contractual and a set regime of testing prior to sale of services and Architecture - regulatory requirements for customer access shall be ongoing thereafter. However, it is ultimately up to our Customer addressed and remediated. customers to evaluate our offerings against their own Access requirements, so they can determine if our services Requirements satisfy their regulatory needs. We are committed to providing our customers detailed information about our cloud services to help them make their own regulatory assessments. “Identification of risks related to external parties and access control policy” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 6.2.1 and 11.1.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Microsoft Dynamics CRM Online Security Response in the Context of CSA Cloud Control Matrix Control SA-01 Control ID In CCM Description (CCM Version R1.1. Microsoft Response SA-01 Security Architecture - Customer Access Requirements Prior to granting customers access to data, assets and information systems, all identified security, contractual and regulatory requirements for customer access shall be addressed and remediated. Our customers around the world are subject to many different laws and regulations. Legal requirements in one country or industry may be inconsistent with legal requirements applicable elsewhere. As a provider of global cloud services, we must run our services with common operational practices and features across multiple customers and jurisdictions. To help our customers comply with their own requirements, we build our services with common privacy and security requirements in mind. To the extent that we identified security, contractual, and regulatory work to the customer that we will be requiring of ourselves, we have addressed and remediated these requirements through a set regime of testing prior to sale of services and ongoing thereafter. However, it is ultimately up to our customers to evaluate our offerings against their own requirements, so they can determine if our services satisfy their regulatory needs. We are committed to providing our customers detailed information about our cloud services to help them make their own regulatory assessments. “Identification of risks related to external parties and access control policy” is covered under the ISO 27001 standards, specifically addressed in Annex A, domains 6.2.1 and 11.1.1. For more information, we suggest a review of the publicly available ISO standards for which we are certified.
Standard%20Response%20to%20Request%20For%20InformationCRMOLSecurity-Privacy_Dec_2013.docx