microsoft dynamics crm online security and...
Post on 29-Sep-2018
221 Views
Preview:
TRANSCRIPT
Microsoft Dynamics CRM Online security and service continuity guide
Microsoft Corporation
Published: July 2012
Updated: September 2013
Abstract
This service description describes the security, continuity, and compliance policies and controls
for the Microsoft Dynamics CRM Online service offering. The document is intended to provide
Microsoft Dynamics CRM Online customers with an overview of how the Microsoft Dynamics
CRM Online service is designed to provide a high degree of security, continuity, and
compliance—service goals that are derived from the Microsoft Risk Management program.
This document is provided "as-is". Information and views expressed in this document, including
URL and other Internet Web site references, may change without notice. You bear the risk of
using it.
Some examples depicted herein are provided for illustration only and are fictitious. No real
association or connection is intended or should be inferred.
This document does not provide you with any legal rights to any intellectual property in any
Microsoft product. You may copy and use this document for your internal, reference purposes.
© 2013 Microsoft Corporation. All rights reserved.
Microsoft, Active Directory, Excel, Hyper-V, Internet Explorer, Microsoft Dynamics, Microsoft
Dynamics logo, MSDN, Outlook, Notepad, SharePoint, Silverlight, Visual C++, Windows,
Windows Azure, Windows Live, Windows PowerShell, Windows Server, and Windows Vista are
trademarks of the Microsoft group of companies.
All other trademarks are property of their respective owners.
Contents
Microsoft Dynamics CRM Online security and service continuity guide ......................................... 4
Applies To .................................................................................................................................... 4
Microsoft Dynamics CRM Online security .................................................................................... 5
Securing the Microsoft Dynamics CRM Online service ............................................................ 5
Physical security ....................................................................................................................... 5
Logical security ......................................................................................................................... 6
Delivering reliable service ......................................................................................................... 9
Microsoft Dynamics CRM Online service continuity .................................................................. 10
Service continuity management .............................................................................................. 11
Incident classification........................................................................................................... 11
Catastrophic outages and declarations of disaster ............................................................. 12
The Service health dashboard ......................................................................................... 12
Microsoft Dynamics CRM Online compliance ............................................................................ 14
Support for leading industry certifications ............................................................................... 15
Appendix A: Additional resources .............................................................................................. 17
Microsoft Dynamics CRM Online ............................................................................................ 17
Security and operations .......................................................................................................... 17
Appendix B: Accessibility for Microsoft Dynamics CRM ............................................................ 17
Feedback .................................................................................................................................... 18
4
Microsoft Dynamics CRM Online security and service continuity guide
Published: July 2012 Updated: September 2013
This service description describes the security, continuity, and compliance policies and controls
for the Microsoft Dynamics CRM Online service offering. The document is intended to provide
Microsoft Dynamics CRM Online customers with an overview of how the Microsoft Dynamics
CRM Online service is designed to provide a high degree of security, continuity, and
compliance—service goals that are derived from the Microsoft Risk Management program.
Applies To Microsoft Dynamics CRM Online
In this white paper
Introduction
Microsoft Dynamics CRM Online security
Microsoft Dynamics CRM Online service continuity
Microsoft Dynamics CRM Online compliance
Appendix A: Additional resources
Appendix B: Accessibility for Microsoft Dynamics CRM
Feedback
This section introduces the purpose and scope of the information provided in this paper.
Purpose
Microsoft Dynamics CRM Online delivers the power of cloud productivity to businesses of all
sizes, helping customers save time and money and free up valued resources. Microsoft
understands that when customers allow an external service provider to store and manage their
data, key considerations include security, data protection, privacy, and data ownership. Microsoft
takes these concerns seriously and has applied its years of cloud and on-premises experience
with security and privacy to the Microsoft Dynamics CRM Online service.
Scope
This service description describes the security, continuity, and compliance policies and controls
for the Microsoft Dynamics CRM Online service offering. The document is intended to provide
Microsoft Dynamics CRM Online customers with an overview of how the Microsoft Dynamics
CRM Online service is designed to provide a high degree of security, continuity, and
compliance—service goals that are derived from the Microsoft Risk Management program.
Download
5
This paper can be downloaded from the Microsoft Download Center: Microsoft Dynamics CRM
Online security and service continuity guide.
Microsoft Dynamics CRM Online security The security architecture of Microsoft Dynamics CRM Online has been designed using key
principles of the Microsoft Trustworthy Computing initiative. To ensure that customer data is
highly safeguarded from risks and threats, Microsoft applies a common set of security policies to
the Microsoft Dynamics CRM Online service through the Microsoft security program. The
Microsoft Dynamics CRM Online service operates in compliance with these security policies and
relevant industry standards. Microsoft is committed to continually improving and evolving the
Microsoft Dynamics CRM Online service to ensure that customers are highly protected from
current and future threats.
This section describes how Microsoft protects customers’ business data and delivers the
Microsoft Dynamics CRM Online service securely and reliably.
Securing the Microsoft Dynamics CRM Online service
Microsoft helps comprehensively secure the Microsoft Dynamics CRM Online service by applying
the Trustworthy Computing approach, which ensures that the security of the Microsoft Dynamics
CRM Online service is vigilantly maintained, regularly enhanced, and routinely verified through
testing.
For more information, see the page Foundations of Trustworthy Computing.
The Trustworthy Computing approach provides protection at multiple levels:
Physical layers at data centers: Physical controls, video surveillance, and access control.
Logical layers: Data isolation, hosted applications security, infrastructure service, network
level, identity and access management, federated identity and single sign-on.
Physical security
Microsoft ensures that the environment in which the Microsoft Dynamics CRM Online customer’s
data is stored is physically secured by controlling accessibility through multiple security checks.
These physical security checks are applied at multiple levels in the Microsoft data centers, and
the Microsoft Dynamics CRM Online service is delivered through carrier-class data centers that
ensure consistent delivery according to the service-level agreement (SLA).
These data centers include the following industry-standard features:
Secure physical access for authorized personnel only: Access is restricted by job
function so that only essential personnel receive authorization to manage customers’
applications and service. Physical access authorization utilizes multiple authentication and
security processes: badge and smartcard, biometric scanners, on-premises security officers,
Note
6
continuous video surveillance, and two-factor authentication for physical access to the data
center environment.
Redundant power supplies, including two separate power feeds into each data center,
battery backup, and diesel generators (with alternative fuel delivery contracts in place).
Climate control to ensure that equipment runs at optimal temperature and humidity.
Natural disaster control, including seismically braced racks where required and fire
prevention and extinguishing systems.
Physical monitoring, including motion sensors, 24-hour secured access, video camera
surveillance, and security breach alarms.
Worldwide Microsoft data center locations: The Microsoft Dynamics CRM Online service
is deployed in Microsoft data centers that are located around the world, and offer
geographically local hosting with global availability.
Secure network design and operations: The networks within the Microsoft data centers are
designed to create multiple separate network segments within each data center. This
segmentation helps to provide physical separation of critical, back-end servers and storage
devices from the public-facing interfaces.
Exceptional hardware: The underlying hardware used in Microsoft data centers is
specifically designed to operate as efficiently, effectively, and securely as possible. The
hardware helps Microsoft eliminate unnecessary costs, save power and space consumption,
and pass on these savings to Microsoft Dynamics CRM Online customers.
Logical security
Logical security in Microsoft Dynamics CRM Online is just as important as physical security. In
Microsoft Dynamics CRM Online, the following key features provide logical security.
Data isolation: Data storage and processing is logically segregated among customers. The
multitenant security architecture ensures that customer data stored in shared Microsoft
Dynamics CRM Online data centers is not accessible by or compromised to any other
organization. Each tenant is provisioned their own database, which ensures isolation from
other customer data. In addition, tenants are isolated from each other based on security
boundaries which are enforced logically through the Microsoft Dynamics CRM Online middle
tier.
Hosted applications security: Microsoft ensures that applications hosted by Microsoft data
centers are highly protected by robust security features and security measures that control
access, which are described in the following table.
7
Feature Description
Customizable security roles Govern user access and the actions they
can perform.
Business data auditing Allow organizations to maintain an audit trail
that demonstrates accountability from
beginning to end.
Field-level security Control the permission of users and teams
to read, create, or write in a data field.
Role-based forms Control the visibility of data for a specific
record type.
For guidelines and best practices associated with setting up these features in
Microsoft Dynamics CRM Online, see the Microsoft Dynamics CRM Online security
and compliance planning guide.
Security Development Lifecycle: Microsoft applies Security Development Lifecycle, a
software security assurance process, to design, develop, and implement the Microsoft
Dynamics CRM Online service. Security Development Lifecycle helps to ensure that the
service is highly secured—even at the foundation level.
Through controls like Establish Design Requirements, Analyze Attack Surface, and Threat
Modeling, the Security Development Lifecycle helps Microsoft to identify:
Potential threats while running a service.
Exposed aspects of the service that are open to attack.
If potential threats are identified at Design, Development, or Implementation phases,
Microsoft can minimize the probability of attacks by restricting service or eliminating
unnecessary functions. After eliminating unnecessary functions, Microsoft reduces these
potential threats in the Verification phase by fully testing the controls in the Design phase.
Secured Microsoft Dynamics CRM Online service infrastructure: Infrastructure-level
security measures include:
Extensive server monitoring support integrated with the overall Microsoft System Center
Operations Manager monitoring architecture.
Secure remote access via Microsoft Windows Server Remote Desktop Service.
Multi-tier administration, using a three-tier administration model that isolates
administrative tasks and controls access based on user role and the level of authorized
administrative access.
Environmental security scanning to monitor for vulnerabilities and incorrect configuration.
Intrusion detection systems to provide continuous monitoring of all access to the
Microsoft Dynamics CRM Online service. Sophisticated correlation engines analyze this
data to immediately alert staff of any “suspicious” connection attempts.
Note
8
Security standards for operating systems to help protect the Microsoft Dynamics CRM
Online service from attack by malicious users or malicious code, including disabling
nonessential services, securing file shares to require authorization, and implementing the
Data Execution Prevention (DEP) feature. DEP is a set of hardware and software
technologies that perform additional checks on memory to help prevent malicious code
from running.
Systems management and access control using Active Directory. Active Directory
manages networks and component servers that run the Microsoft Dynamics CRM Online
service. Applications that provide the online service are designed to operate efficiently
and effectively within the Active Directory environment.
Central management of security policies. The Microsoft staff manages and enforces
security policies centrally from secured servers that are dedicated to controlling and
monitoring network-wide systems. A delegated management model enables
administrators to have only the access they need to perform specific tasks, reducing the
potential for error and allowing access to systems and functions strictly on an as-needed
basis.
New servers can be quickly and safely configured, and template-based server hardening
ensures that new capacity is brought online with security measures already in place.
Network-level security measures: These measures include features related to providing a
highly secured connection over the Internet:
Customer access to service provided over the Internet originates from users’ Internet-
enabled locations and ends at a Microsoft data center. These connections established
between customers and Microsoft data centers are encrypted using industry-standard
Transport Layer Security (TLS) /Secure Sockets Layer (SSL), which effectively
establishes a highly secure browser-to-server connection to help provide data
confidentiality and integrity between the desktop and data center.
A redundant network provides full failover capability and helps ensure 99.9 percent
network availability.
All remote connections by Microsoft operations personnel must be made via Remote
Desktop Service and two-factor authentication.
Identity and access management: Access to the systems hosting the Microsoft Dynamics
CRM Online service is controlled through the following methods:
Staff-level access control: Data center staff’s access to the IT systems that store
customer data is strictly controlled. Access control follows the separation of duties
principle and granting least privilege.
Proactive host security: Microsoft Dynamics CRM Online security is enhanced by
proactively securing the host system.
Server hardening by disabling unnecessary service
Logging and auditing
Restricted access to service:
Content inspection
Hardened servers
Sessions better protected by SSL/TLS
9
Mobile device access depends on wireless capability or mobile network availability.
Federated identity and single sign-on: With on-premises Active Directory, administrators
can use single sign-on for Microsoft Dynamics CRM Online service authentication. To
achieve this, administrators can configure on-premises Active Directory Federation
Services—a Windows Server service—to federate with the Office 365 services federation
gateway. After Active Directory Federation Services is configured, all Microsoft Dynamics
CRM Online users whose identities are based on the federated domain can use their existing
corporate logon to automatically authenticate to Microsoft Dynamics CRM Online.
For more information, see the Office 365 Identity Service Description, which is one of the
Office 365 for Enterprise Service Descriptions.
Delivering reliable service
To ensure the reliability of the Microsoft Dynamics CRM Online service, Microsoft focuses on
effective deployment, administration, and maintenance.
Operations management and service deployment: Operations is a key component of the
Microsoft Dynamics CRM Online service and is central to overall security and availability.
Operations management practices for Microsoft Dynamics CRM Online (for example, change
management, incident and problem management) are based upon industry-standard
principles of the Information Technology Infrastructure Library (ITIL). Microsoft has added the
Microsoft Operations Framework (MOF)—a standardized implementation of ITIL
recommendations—which provides an integrated set of best practices, principles, and
activities that help organizations achieve reliability for their IT solutions and service.
Microsoft Dynamics CRM Online maintains a dedicated security organization that is focused
on constant security vigilance, with a staff that follows the principles defined in MOF. The
security team adheres to the following functions defined by ITIL and applies them to the
operation of the Microsoft Dynamics CRM Online service:
Change management
Incident management
Problem management
In addition, the Microsoft Dynamics CRM Online service requires distinct hosted service
development, deployment, and operations staff to adhere to the principle of segregation of
duty. This includes controlling access to the source code, build servers, and production
environment. For example:
Access to the Microsoft Dynamics CRM Online service production environment is
restricted to operations personnel. Development and test teams may be granted
temporary access to help troubleshoot issues.
Access to the Microsoft Dynamics CRM Online service source code control is restricted
to development personnel; operations personnel cannot change source code.
Note
Note
10
Monitoring and risk reduction: Microsoft makes significant investments in developing tools
and services for monitoring Microsoft Dynamics CRM Online and its environment.
Microsoft System Center Operations Manager: Servers within the Microsoft Dynamics
CRM Online service environment are configured to maximize the reporting of security
events from the operating system and applications. The Microsoft Dynamics CRM Online
service operations team uses the latest technology and optimized processes to harvest,
correlate, and analyze information as it is received. System Center Operations Manager
is an end-to-end service management environment that integrates with platform and
service hardware and software to provide continuous health monitoring. System Center
Operations Manager management packs provide internal transaction monitoring,
capabilities for looking at service threshold models, and CPU utilization analysis that is
tailored to the Microsoft Dynamics CRM Online service applications. In addition, custom
management packs are layered above the Microsoft Dynamics CRM Online platform to
provide operations staff with very specific information that helps identify trends and
predict behavior that may require proactive intervention.
Integrated infrastructure and web performance monitoring: System Center Operations
Manager data is combined with feeds from additional specialized tools and service to
capture, aggregate, and analyze the network that operates Microsoft Dynamics CRM
Online service as well as the behavior of key sites on the Internet. For example, if
connectivity begins to degrade, staff can identify whether the problem is internal to the
Microsoft Dynamics CRM Online service or caused by conditions on the Internet that may
represent a risk to Microsoft Dynamics CRM Online customers.
Hardware and software subsystems monitoring: Proactive monitoring continuously
measures the performance of key subsystems of the Microsoft Dynamics CRM Online
service platform against the established boundaries for acceptable service performance
and availability. When a threshold is reached or an irregular event occurs, the monitoring
system generates warnings so that operations staff can address the threshold or event.
Microsoft Dynamics CRM Online service continuity Service continuity management focuses on the ability to restore service for Microsoft Dynamics
CRM Online customers in a predetermined timeframe during a critical service outage. Achieving
restored service requires preparation, planning, technical implementation, exercises that simulate
outages, and execution at the time of an incident.
This section describes the common approach to service continuity management that is taken by
Microsoft Dynamics CRM Online. It also explains how Microsoft Dynamics CRM Online ensures
data availability and service reliability to customers. This section also explains how service
continuity capabilities developed by Microsoft are integrated into the design of the Microsoft
Dynamics CRM Online service.
11
Service continuity management
Microsoft Dynamics CRM Online is delivered by highly resilient systems that help to ensure high
levels of service. Microsoft Dynamics CRM Online capitalizes on the experience that Microsoft
has in hosting services as well as close ties to Microsoft product groups and support service to
create a service that meets the high standards that customers demand.
Part of the Microsoft Dynamics CRM Online system design, service continuity provisions enable
Microsoft Dynamics CRM Online to recover quickly from unexpected events such as hardware or
application failure, data corruption, or other incidents that affect users. These service continuity
solutions also apply during catastrophic outages (for example, natural disasters or a fire within a
Microsoft data center that renders the entire data center inoperable).
Incident classification
Service outages may be caused by hardware or software failure in the Microsoft data center, a
faulty network connection between the customer and Microsoft, or a major data center challenge
such as fire, flood, or regional catastrophe. Most service outage incidents can be addressed
using Microsoft technology and process solutions and are resolved within a short time. However,
some incidents are more serious and can lead to long-term outages.
To classify outage incidents, as minor, critical, and catastrophic events based on their impact to
customers, Microsoft Dynamics CRM Online uses the Service Interruption Scale, which is shown
in the following graphic:
12
Catastrophic outages and declarations of disaster
Microsoft Dynamics CRM Online analyzes each incident that affects service availability to
determine scope and possible solutions. Outages that cause customer work to stop may be
considered catastrophic outages. In addition, outages that are classified as a critical or
catastrophic event based on the Service Interruption Scale may be declared disasters.
Declaration of a disaster does not automatically result in failover of a customer’s
redundant secondary site.
The Service health dashboard
Customers using the Microsoft online services portal to manage their Microsoft Dynamics CRM
Online deployments are notified of service interruptions and via the Service health dashboard,
which is shown in the following graphic:
When an outage is declared a disaster, regular customer notifications are provided through the
Service health dashboard (for customers managing their Microsoft Dynamics CRM Online
subscription through the Microsoft online services portal) until a solution is found.
Responsibilities during a service outage
During a system outage, Microsoft’s responsibilities include:
Providing contact information in the form of a single email group alias and phone number so
that the customer can engage appropriate personnel at the time of an event to review current
status of the outage, disaster declaration criteria, and approval or disapproval of failing over
to the secondary site.
Incorporating feedback from the customer to decide whether to fail over to the customer’s
secondary site.
Ensuring data availability
Microsoft ensures customer data is available whenever it is needed, with the help of the following
features of Microsoft Dynamics CRM Online service.
Important
13
Data storage and redundancy
Customers’ data is stored in a redundant environment with robust backup, restore, and failover
capabilities to enable availability, business continuity, and rapid recovery. Multiple levels of data
redundancy are implemented, ranging from redundant disks to guard against local disk failure to
continuous, full data replication to a geographically diverse data center. As an additional
safeguard, Microsoft performs daily back-ups to a secure, offsite location.
Data monitoring and maintenance
Along with the safeguards in place against avoiding data loss, Microsoft Dynamics CRM Online
service policies help to maintain data performance levels.
Monitoring databases: Databases are regularly checked for blocked processes and long-
running queries.
Preventative maintenance: Maintenance includes refreshing indexes, reviewing error logs,
and monitoring storage capacity levels.
Dedicated support
The Microsoft Dynamics CRM Online development and operations teams are complemented by a
dedicated Microsoft Dynamics CRM Online support organization, which plays an important role in
providing customers with business continuity. Support staff has a deep knowledge of the service
and its associated applications as well as direct access to Microsoft experts in architecture,
development, and testing.
The support organization closely aligns with operations and product development, offers fast
resolution times, and provides a channel for customers’ voices to be heard. Feedback from
customers provides input to the planning, development, and operations processes.
Online issue tracking: Customers need to know that their issues are being addressed, and
they need to be able to track timely resolution. For customers using the Microsoft online
services portal to manage their Microsoft Dynamics CRM Online deployments, the portal
serves as a single web-based interface for support. Customers can use the portal to add and
monitor service requests and receive feedback from Microsoft support teams.
Customers not using the Microsoft online services portal can track and follow their
issues via the CRM Customer Center link for support access.
Self-help, backed by continuous staff support: Microsoft Dynamics CRM Online offers a
wide range of self-help resources and tools that can help customers to resolve service-
related issues without requiring Microsoft support. Before customers enter service requests,
they can access knowledge base articles and FAQs that provide immediate help with the
most common problems. These resources are continually updated with the latest information,
which helps avoid delays by providing solutions to known issues. However, when an issue
arises that needs the help of a support professional staff members are available through
online communication to cover most situations and by telephone for mission critical needs.
Warning
14
Microsoft Dynamics CRM Online compliance Microsoft has designed security, data protection, reliability, and privacy of the Microsoft Dynamics
CRM Online service around high industry standards. Microsoft Dynamics CRM Online and the
infrastructure on which it relies (Microsoft Global Foundation Services) employ security
frameworks based on the International Standards Organization (ISO/IEC 27001:2005) family of
standards and are ISO 27001 certified by independent auditors. Our ISO 27001 certifications
enable customers to evaluate how Microsoft meets or exceeds the standards and implementation
guidance against which we are certified.
BSI auditing professionals are bound by professional ethics to provide an unbiased, third-party
analysis of Microsoft Dynamics CRM Online compliance. To make this evaluation, they observe
routine operations, interview relevant personnel, and review documentation in each of the areas
covered in the Statement of Applicability (SOA). ISO 27001 defines how to implement, monitor,
maintain, and continually improve the Information Security Management System (ISMS). In
addition, both the service and the infrastructure undergo yearly audits resulting in SOC 1 type II
reports (SSAE16).
The Microsoft Online Service Information Security Policy, which is applicable to Microsoft
Dynamics CRM Online, aligns with International Organization for Standards ISO 27002
augmented with requirements that are specific to online services. The ISO 27001 certification
which Microsoft has received is supplemented by ISO 27002, which provides a suggested set of
suitable controls.
Microsoft Dynamics CRM Online customers can review the ISO standard and published Microsoft
service documentation to determine whether their security requirements are satisfied. Microsoft
Dynamics CRM Online features enhanced security for most types of data and jurisdictions.
For more information, see the white paper Standard Response to Request for Information
– Security and Privacy.
However, customers must evaluate sensitive data, or data that must be held to a certain level of
security or under applicable regulations, for use through the service offering. In some instances,
the data may require a specific security requirement that Microsoft does not provide.
Please note that the Microsoft Dynamics CRM Online ISO 27001 certified security framework
(“Security Framework”) does not expand to or cover online services or software provided by
Microsoft or other third parties that connect to Microsoft Dynamics CRM Online. Subject to your
direct control, Microsoft Dynamics CRM Online connects to other Microsoft software or services
and third party services whose privacy and security practices differ from those of Microsoft
Dynamics CRM Online. These additional services and software include but are not limited to
Microsoft Dynamics CRM Online for supported devices (i.e. tablets and smart-phones), Microsoft
Dynamics CRM Email Router Microsoft Dynamics CRM Resource Center, Microsoft Office,
Office365, Yammer Enterprise, Bing Maps, Skype, Outlook.com, Microsoft Dynamics CRM
Activity Feeds/Mobile Express, Marketing Pilot, and Microsoft Dynamics Marketing. Connecting
Microsoft Dynamics CRM Online to these online services will enable certain data to be shared
outside the scope of the Security Framework. Different use and privacy policies apply to data
Note
15
shared with and received by these software and online services. We encourage you to review
these other use and privacy policies.
Support for leading industry certifications
Microsoft was first certified for Safe Harbor in 2001, and the LCA Regulatory Affairs team
recertifies compliance with the Safe Harbor Principles every 12 months.
In addition to EU Member States, members of the European Economic Area (Iceland, Norway,
and Liechtenstein) also recognize Safe Harbor members as providing adequate privacy
protection to justify trans-border transfers from their countries to the U.S. Switzerland has a
nearly identical agreement (Swiss-U.S. Safe Harbor) with the U.S. Department of Commerce to
legitimize transfers from Switzerland to the U.S., to which Microsoft has also certified.
Several other countries, such as Canada and Argentina, have passed comprehensive privacy
laws and the EU has cleared them for data transfer from the EU to those countries.
EU Model Clauses*. In addition to EU Safe Harbor, Microsoft Dynamics CRM Online is
willing to sign the standard contractual clauses created by the European Union (called the
“EU Model Clauses”), which address international transfer of data. The EU Model Clauses
are standardized contractual terms approved by the European Commission that allow for the
transfer of personal data out of the EU. They include additional security and notice
requirements that a service is willing to contractually commit to in order to support customers.
When included in service agreements with data processors, the Model Clauses assure
customers that appropriate steps have been taken to help safeguard personal data, even if
data is stored in a cloud-based service center located outside the European Economic Area.
Committing to operate under the Model Clauses creates additional operational requirements
for Microsoft, which Microsoft has met by building exacting processes to comply with these
requirements.
HIPAA/HITECH-Business Associate Agreement*. Microsoft Dynamics CRM Online is also
willing to sign requirements for the Health Insurance Portability and Accountability Act of
1996 (HIPPA)/Health Information Technology for Economic and Clinical Health Act (HITECH)
Business Associate Agreement with all customers. HIPAA/HITECH are U.S. laws that govern
the security and privacy of personally identifiable health information stored or processed
electronically. This information is referred to as electronic protected health information
(ePHI). HIPAA refers to healthcare providers, payors and clearing houses that use or
process ePHI as covered entities. Under HIPAA/HITECH, covered entities must implement
mandated physical, technical and administrative safeguards to protect ePHI. Certain service
providers that store or process ePHI on behalf of covered entities are called business
associates. Covered entities must ensure that their business associates implement similar
security and privacy safeguards. In most circumstances, for a covered healthcare company
to use a service such as Microsoft Dynamics CRM Online, in which ePHI could be stored or
processed, the service provider will be a business associate and must agree in writing to
implement required safeguards set out in HIPAA/HITECH. This written agreement is known
as a Business Associate Agreement (BAA).
Data Processing Agreement*. Article 17 of the EU Data Protection Directive (Directive
95/46/EC of the European Parliament) requires data controllers (typically customers loading
data onto an online service) to have a written agreement with data processors obligating the
16
data processor to follow the instructions of the data controller and to provide sufficient
security measures to protect the data being processed. These are called Data Processing
Agreements ("DPA"). Some EU member states require additional terms in DPAs beyond the
baseline requirements of the EU Data Protection Directive. Microsoft offers customers a
comprehensive standard Data Processing Agreement that addresses privacy, security and
handling of Customer Data. Our standard Data Processing Agreement enables customers to
comply with their local privacy regulatory requirements.
*Applicable to Microsoft Dynamics CRM Online customers who manage their Online Services
through the Microsoft online services environment.
For additional detail about Microsoft Dynamics CRM Online support for leading industry
certifications, see the Microsoft Dynamics CRM Online Service Trust Center.
The Gramm Leach Bliley Act (GLBA) sets minimum security and privacy requirements for
financial institutions in the United States. Software/ service cannot claim to be “GLBA compliant”
because GLBA compliance also requires procedures and policies. Two of the principal
regulations under GLBA that affect the Microsoft Dynamics CRM Online service are:
1. Financial Privacy Rule: Governs the collection and disclosure of customers’ personal
financial information by financial institutions.
2. Safeguards Rule: Requires all financial institutions to design, implement, and maintain
safeguards to protect customer information, whether they collect such information themselves
or receive it from other financial institutions.
Microsoft Dynamics CRM Online ordering, billing, and payment systems that handle credit card
data are Level One Payment Card Industry (PCI) Compliant, and customers can use credit cards
to pay for the service with confidence. An independent third party audits and determines whether
the commerce platform that supports Microsoft Dynamics CRM Online has satisfactorily met the
Payment Card Industry Data Security Standard (PCI DSS) version 1.2.
The Microsoft Dynamics CRM Online service is not suitable for processing, transmitting, or
storing PCI-governed data. PCI-DSS is an industry standard designed to protect and maintain
sensitive data during transmission and storage throughout the data life cycle. At a minimum,
organizations that support transactions via credit and debit cards are required to have a degree of
compliance to the PCI standard.
There is confusion in the marketplace around the impact of PCI DSS; many customers state that
all data within their organizations requires PCI certification and compliance, and that the online
service must also demonstrate compliance. While Microsoft does need to be compliant for the
Primary Account Number (PAN) data it processes, and it is, customers should not use the
Microsoft Dynamics CRM Online service to transmit or store PAN data for their own use.
PCI compliance will only apply if Primary Account Number (PAN) is transmitted or stored
within the online environment. To be compliant, the PAN data must be encrypted during
transmission and storage. In addition, reporting must demonstrate that this encryption
has successfully protected the PAN data. As a result, the service is not a suitable storage
Important
Note
17
medium for PAN data, and companies should apply customer-side policies to prevent the
transmission of PAN data to the online environment. To integrate transaction information,
customers may choose to use a PCI validated payment gateway service, which stores
and processes the PAN data.
With the Microsoft Dynamics CRM December 2012 Service Update, the Microsoft
Dynamics CRM Online service now operates in a FIPS 140-2 compliant manner.
Appendix A: Additional resources For additional information related to Microsoft Dynamics CRM Online security and service
continuity, see the following resources.
Microsoft Dynamics CRM Online
Microsoft Dynamics CRM Online Product Fact Sheet
Microsoft Dynamics CRM Online Service Agreement
Microsoft Dynamics CRM Online Service Level Agreement
Support for Dynamics CRM Online
Microsoft Dynamics CRM Online Customer Center
Microsoft Dynamics CRM Online Service Description
Microsoft Dynamics CRM Online security and service continuity guide
Microsoft Dynamics CRM Online security and compliance planning guide
Deployment and Administration Guide for Microsoft Dynamics CRM Online
Security and operations
Microsoft® System Center Operations Manager 2007
System Center Operations Manager 2007 R2 SDK
The Security Model of Microsoft Dynamics CRM
The Trustworthy Computing Security Development Lifecycle
Microsoft Safety & Security Center
Appendix B: Accessibility for Microsoft Dynamics CRM Administrators and users who have administrative responsibilities typically use the Settings area
of the Microsoft Dynamics CRM Web application to manage Microsoft Dynamics CRM. A mouse
and keyboard are the typical devices that administrators use to interact with the application.
Important
18
Users who don’t use a mouse can use a keyboard to navigate the user interface and complete
actions. The ability to use the keyboard in this way is a result of support for keyboard interactions
that a browser provides.
For more information, see the following Microsoft Dynamics CRM Web application accessibility
topics:
Keyboard shortcuts
Accessibility for people with disabilities
Administrators and users who have administrative responsibilities for on-premises deployments of
Microsoft Dynamics CRM 2013 also use Microsoft Dynamics CRM Deployment Manager, a
Microsoft Management Console (MMC) application, to manage on-premises deployments of
Microsoft Dynamics CRM Server 2013.
For more information, see the following Microsoft Management Console (MMC) accessibility
topics:
Navigation in MMC Using the Keyboard and Mouse
MMC Keyboard Shortcuts
Accessibility features in browsers
Browser Documentation
Internet Explorer Microsoft Accessibility
Language Support and Accessibility Features
Mozilla Firefox Accessibility features in Firefox
Apple Safari Safari
Google Chrome Accessibility Technical Documentation
For additional information, see the Microsoft Accessibility Resource Center
Feedback We appreciate hearing from you. To send your feedback, click the link below and type your
comments in the message body.
The subject-line information is used to route your feedback. If you remove or modify the
subject line, we may be unable to process your feedback.
Send feedback
Note
Note
top related