MicrosoftOnlineServicesSecurityandCompliance OperationalCertificationInitiative Published:February2009 1
MicrosoftOnlineServicesSecurityandCompliance OperationalCertificationInitiative Introduction GlobalFoundationServices(GFS)providestheinfrastructureforMicrosoft sonlineservices.gfshasstreamlinedthe mannerinwhichcompliancewithrelevantsecurityandprivacystandardsismanagedandmaintained.thesestandards arebasedongovernmentregulations,industrymandates,internalpoliciesandindustrybestpractices.inadditionto ensuringthatcomplianceexpectationsarecontinuallyachieved,thismethodologyhashelpedproducesas70typeiand IIattestations,ISO27001certifications,aswellasstreamliningtheworkassociatedwithmeetingauditobligations. ThispaperwilldiscussthecurrentcompliancelandscapeandthemethodologyusedbytheGFSOnlineServicesSecurity andcompliance(ossc)organizationtorationalizeandoptimizemanagementofsecuritycompliance. ComplianceLandscape TheGFS managedonlineoperatingenvironmentisrequiredtomeetasignificantnumberofgovernment mandated, industry,internallyderivedandindustrybestpracticesecurityrequirements.manyoftheserequireaperiodicreviewto validatethatcomplianceisbeingmaintained.someoftheexistingauditsandassessmentsofexternalcompliance expectationsare: ThePaymentCardIndustryDataSecurityStandard(PCI DSS)requiresannualreviewandvalidationofsecurity controlsrelatedtocreditcardtransactions.numerousonlineservicesareauditedannuallyforpcicompliance; MicrosoftagreedtoaConsentOrderwiththeFTCin2002thatrequiresanauditeveryotheryeartovalidate compliancewiththeorderandadherencetothemicrosoftonlineservicesinformationsecurityprogram.this auditrequirementisineffectuntil2022; VariousAdvertisingsystemsareauditedagainsttheMediaRatingsCouncil(MRC)requirements.Thisstandard relatestotheintegrityofadvertisingsystemdatagenerationandprocessing; SelectedAdvertisingsystemsareauditedforSarbanes Oxley(SOX)complianceannuallytovalidatecompliance withkeyprocessesrelatedtofinancialreportingintegrity; Microsoft sentryintothehealthservicesindustryintroducescompliancerequirementsasabusinessassociate ofentitiescoveredbythehealthinsuranceportabilityandaccountabilityact(hipaa); Inaddition,variousInternalAuditandprivacyassessmentsoccurthroughoutagivenyear. AsMicrosoftonlinebusinessescontinuetogrowandevolveandnewonlineservicesareintroducedintotheGFS environment,additionalrequirementsareexpectedwhichcouldincluderegionalandcountry specificdatasecurity standards. 2
OperationalCertificationInitiative Itwasdeterminedthatmanyoftheauditsandassessmentslistedaboverequiredanevaluationofthesameoperational controlsandprocessesforseveralofthegfsteamsprovidingoperationalinfrastructureservices.thereforecompliance wasoftendemonstratedbyproducingthesamedataandinformation.whilemicrosoftcontinuedtomeetthevarious securityrequirementsandtopasstheassociatedauditsorassessments,therewasasignificantopportunitytoconverge redundantefforts,tostreamlineprocesses,andtoproactivelymanagecomplianceexpectationsinamoreholistic manner. Inanefforttoaccomplishthis,OSSCcreatedtheOperationalCertificationInitiative,otherwiseknownasOCI.OCI rationalizedthevariouscomplianceeffortsbydefiningaunifyingmethodologyformanagingcomplianceacrossthegfs environment,andbyextensionacrossthevariousbusinessesoperatingwithinthisenvironment,thusprovidinga consistentandmanageableprocessforpreparingfor,andultimatelysatisfying,securityrequirements. OCIisdesignedtobeacontinuousandscalableprogramthatensuresGFSismeetingsecurityrequirementsandthatthe OnlineServicesInformationSecurityProgram,policy,standardsandassociatedcontrolsandprocessesremaincurrentas businessrequirementschange.inaddition,thestandardizedsecuritycontrolframeworkcomingoutofocicanbe consumedorleveragedbyotherteamswithinmicrosoft. OCIMethodology OCIfollowsafivestepmethodologyrepresentedinthefollowingillustration: Step1:IdentifyandIntegrateRequirements 3
Ananalysisofinternalpolicy,regulatory,industry,legalandcontractualrequirementswasconductedtodefinea supersetofstandardsecuritycontrolobjectives.eachindividualrequirementwasmappedtothesestandardizedcontrol objectives,providingforaconsistentapplicationofsecurityrequirements.toallowtheframeworktobeeasily expandedinthefuture,aninternationalstandard(iso27001)wasusedasthebasisfordefiningthecontrolobjectives. Step2:AssessandRemediateGaps Functionson boardedtotheociframeworkareprovidedwithasetofstandardcontrolobjectivesthatmustbemet throughadequatelydesignedinternalcontrolsandprocesses.aninitialstateofcomplianceisdeterminedthroughthe identificationandevaluationofeachfunction sexistingcontrolactivitiesandprocedures,otherwiseknownasacontrol designreview.alsoaspartofthisinitialevaluation,highriskorhighlymanualcontrolsareidentifiedsomonitoring controlscanbeidentifiedtoensurethesekeycontrolsarecontinuouslymonitored.controldesigngapsareidentified andrequireremediationbeforeoperatingeffectivenesstesting. Step3:TestEffectivenessandAssessRisk Oncethecontroldesigngapsareremediated,operatingeffectivenesstestingofthecontrolsisconducted,either internallyorbyexternalthirdparties.operatingeffectivenessfailuresareidentifiedandrequireremediationbefore certificationsandattestationsareperformed. Step4:AttainCertificationandAttestations ThestateofcompliancewiththeOCIframeworkisperiodicallyevaluatedandreportedonthroughthirdpartyreviews, suchassas70typeiandiiattestationsaswellasiso27001certifications.thesas70reportsandisocertificationare alsousedascollateraltosatisfytheexpectationsofselectedexternalaudits,includingsomeofthoselistedabove.for auditsthatcannotdirectlyconsumethesas70orisocertification,oftenthematerialproducedandcollectedduring thesereviewscanbeusedtorepresentandsupportcomplianceclaims.securingasas70reportandisocertification alsoprovidesassurancestopotentialcustomersthatgfs ssecuritycontrolsareappropriatelydesignedandare operatingeffectively. Step5:ImproveandOptimize TheOCIcontrolframeworkisperiodicallyaugmentedwithnewrequirementsthatareintroducedtotheenvironment throughregulation,contractualorlegalobligations,internalpolicyand/orindustrybestpractices.acomprehensive reviewofthecontrolframeworkoccursannuallyandindividualrequirementscanbeaddedormodifiedasdeemed necessary. Conclusion OCIistheculminationofhardworkwithinOSSCtorationalizerequirementsformultipleauditsintoasingle,expandable framework.gfshasoptimizedauditingacrosstheinfrastructurebyauditingonlyagainstthatframework.themost significantbenefitisforcustomers:theindependent,externalvalidationofrequirementsthatmakeupociprovidesa levelofassurancethatmicrosoftmeetsorexceedsindustrystandards. 4
TheinformationcontainedinthisdocumentrepresentsthecurrentviewofMicrosoftCorporationontheissuesdiscussedasofthe dateofpublication.becausemicrosoftmustrespondtochangingmarketconditions,itshouldnotbeinterpretedtobea commitmentonthepartofmicrosoft,andmicrosoftcannotguaranteetheaccuracyofanyinformationpresentedafterthedateof publication. ThisWhitePaperisforinformationalpurposesonly.MICROSOFTMAKESNOWARRANTIES,EXPRESS,IMPLIEDORSTATUTORY,AS TOTHEINFORMATIONINTHISDOCUMENT. Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.Withoutlimitingtherightsundercopyright,nopartof thisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans (electronic,mechanical,photocopying,recording,orotherwise),orforanypurpose,withouttheexpresswrittenpermissionof MicrosoftCorporation. Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubject matterinthisdocument.exceptasexpresslyprovidedinanywrittenlicenseagreementfrommicrosoft,thefurnishingofthis documentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty. 2009MicrosoftCorporation.Allrightsreserved. 5