Governance overview

How does Microsoft provide effective security governance across the enterprise?

Microsoft understands that effective security policies must be implemented consistently across the enterprise to protect Microsoft information systems and customers. Security policies must also account for variations in business functions and information systems to be universally applicable. To meet these requirements, Microsoft implements a comprehensive security governance program as a part of the Microsoft Policy Framework. Security governance falls under the Microsoft Security Policy (MSP).

The MSP organizes Microsoft's security policies, standards, and requirements so they can be implemented across all Microsoft engineering groups and business units. Individual business units are responsible for specific implementations of Microsoft security policies. For example, Microsoft 365 documents its security implementations in the Microsoft 365 Information Security Policy and the related Microsoft 365 Control Framework. Azure and Dynamics 365 document their security implementations in the Standard Operating Procedures (SOPs) and the Azure Control Framework. These security implementations align with the goals and objectives of the MSP.

Microsoft's security governance program is informed by and aligns with various regulatory and compliance frameworks. Security requirements are constantly evolving to account for new technologies, regulatory and compliance requirements, and security threats. Because of these changes, Microsoft regularly updates our security policies and supporting documents to protect Microsoft systems and customers, meet our commitments, and maintain customer trust.

How do Microsoft online services implement the Microsoft Security Policy (MSP)?

Microsoft 365 documents security implementations in the Microsoft 365 Information Security Policy. This policy aligns with the Microsoft Security Policy and governs the Microsoft 365 information system, including all Microsoft 365 environments and all resources involved in the collection, processing, maintenance, use, sharing, dissemination, and disposal of data. Similarly, Azure and Dynamics 365 use the Microsoft Security Policy to govern their information system.

The information systems include the following components governed by the Microsoft 365 Information Security Policy (for Microsoft 365) and the Microsoft Security Policy (for Azure and Dynamics 365):

• Infrastructure: The physical and hardware components of Azure, Dynamics 365, and Microsoft 365 systems (facilities, equipment, and networks)
• Software: The programs and operating software of Azure, Dynamics 365, and Microsoft 365 systems (systems, applications, and utilities)
• People: The personnel involved in the operation and use of Azure, Dynamics 365, and Microsoft 365 systems (developers, operators, users, and managers)
• Procedures: The programmed and manual procedures involved in the operation of Azure, Dynamics 365, and Microsoft 365 systems
• Data: The information generated, collected, and processed by Azure, Dynamics 365, and Microsoft 365 systems (transaction streams, files, databases, and tables)

The Microsoft 365 Information Security Policy is supplemented by the Microsoft 365 Control Framework. The Microsoft 365 Control Framework details the minimum-security requirements for all Microsoft 365 services and information system components. It also references the legal and corporate requirements behind each control. The framework includes control activity names, descriptions, and guidance to ensure effective control implementations by service teams. Microsoft 365 uses the control framework to track control implementations for internal and external reporting. Similarly, Azure and Dynamics 365 record control implementations in the Azure Control Framework.

How do online services limit and track exceptions to established policies and procedures?

All exceptions to the Control Frameworks must have legitimate business justification and be approved by an appropriate governance entity within each online services team. Depending on the scope of the exception and the potential risk it represents, approval for exceptions may need to be obtained from a corporate vice president or higher. Exceptions are managed in a tracking tool where they are reviewed and approved for continued relevance.

How do online services keep security and compliance requirements updated?

Governance, Risk, and Compliance teams of each online service (GRC) work to maintain the Control Framework on an ongoing basis. Several scenarios may require the GRC team to update the control framework, including changes in relevant regulations or laws, emerging threats, penetration test results, security incidents, audit feedback, and new compliance requirements. When a framework change is required, the Trust team identifies key stakeholders responsible for approving and implementing the change to ensure it is feasible and will not cause unintended issues with Online services. Once the GRC team and relevant stakeholders agree on what the change requires, the workloads responsible for implementing the change set target completion dates and work to implement the change within their respective services. After implementation targets have been met, the Trust team updates the control framework with the new or updated controls.

Related external regulations & certifications

Microsoft's online services are regularly audited for compliance with external regulations and certifications. Refer to the following table for validation of controls related to governance.

Azure and Dynamics 365

External audits	Section	Latest report date
ISO 27001/27002 Statement of Applicability Certificate	A.18.1: Compliance with legal and contractual requirements A.18.2: Information security reviews	December 3, 2021
ISO 27017 Statement of Applicability Certificate	A.18.1: Compliance with legal and contractual requirements A.18.2: Information security reviews	December 3, 2021
SOC 1	IS-1: Microsoft security policy IS-2: Microsoft security policy review IS-3: Security roles and responsibilities	March 31, 2021
SOC 2 SOC 3	C5-1: Standard operating procedures IS-1: Microsoft security policy IS-2: Microsoft security policy review IS-3: Security roles and responsibilities SOC2-14: Confidentiality and non-disclosure agreements SOC2-18: Statutory, regulatory, and contractual requirements SOC2-19: Cross-functional compliance program SOC2-20: ISMS program	November 12, 2021

Office 365

External audits	Section	Latest report date
FedRAMP	CA-2: Security assessments PL-2: System security plan	September 24, 2021
ISO 27001/27002/27017 Statement of Applicability Certification (27001/27002) Certification (27017)	A.18.1: Compliance with legal and contractual requirements A.18.2: Information security reviews	March 2022
SOC 2	CA-11: Policy framework updates CA-17: Microsoft security policy CA-25: Control framework updates	September 30, 2021

Resources

• Microsoft Security Policy
• Microsoft Security Program Policy