Office 365: Everything You Wanted to Know How to Use this Document?

Privacy, Security and Compliance

Historically, security and compliance technologies and mandates were perceived as disruptive to productivity, driving down employee satisfaction while driving up IT costs. If users feel impeded by the technology they’re given, they often look for ways around it, which in turn can create new corporate non-compliance issues and bring the problem full circle.

This is why we believe that the most well-run organizations are those in which people are empowered to do their best work, on any device, while IT is able to responsibly manage security and compliance requirements.

1. 
   Service-level capabilities that include technical features, operational procedures, and policies that are enabled by default for customers using the service
   
2. 
   Customer controls that include features that enable businesses to customize the Office 365 environment based on the specific needs of their organization
   

Office 365 Trust Center

• 
  Built-in security
  

• 
  Service-level security through defense-in-depth
  
• 
  Customer controls within the service
  
• 
  Security hardening and operational best practices
  

• 
  Privacy by design
  

• 
  Your data is not used for advertising
  
• 
  You have extensive privacy controls
  
• 
  You can take your data with you when you want
  

• 
  Continuous compliance
  

• 
  Proactive processes to meet evolving compliance needs
  
• 
  Customer controls for organizational compliance
  
• 
  Independently verified to meet evolving standards
  

• 
  Transparent operations
  

• 
  You know where your data resides and who has access
  
• 
  Visibility into availability and changes to the service
  
• 
  Financially backed guarantee of 99.9% uptime
  

• 
  The video series - Conversations from Inside the Cloud
  
• 
  Office 365 Compliance Framework for Industry Standards and Regulations
  
• 
  Office 365 security white paper
  
• 
  Office 365 privacy white paper
  
• 
  Protecting data and privacy in the cloud
  
• 
  Tenant Isolation in Microsoft Office 365
  
• 
  Customer controls for information protection white paper
  
• 
  Security Incident Management in Microsoft Office 365
  
• 
  File Security in Microsoft SharePoint and OneDrive for Business
  

Service Assurance

• 
  Microsoft security practices for customer data that is stored in Office 365.
  
• 
  Independent third-party audit reports of Office 365.
  
• 
  Implementation and testing details for security, privacy, and compliance controls that Office 365 uses to protect your data.
  

• 
  International Organization for Standardization (ISO) 27001 and 27018
  
• 
  Health Insurance Portability and Accountability Act of 1996 (HIPAA)
  
• 
  Federal Risk and Authorization Management Program (FedRAMP)
  

For more details, refer to the Service assurance in the Office 365 Security & Compliance Center article.

Security in a Cloud-Enabled World

Security in the cloud is a partnership

The security of your Microsoft cloud services is a partnership between you and Microsoft.

Keys to success

Enterprise organizations benefit from taking a methodical approach to cloud security. This involves investing in core capabilities within the organization that lead to secure environments.

Governance & Security Policy

Microsoft recommends developing policies for how to evaluate, adopt, and use cloud services to minimize creation of inconsistencies and vulnerabilities that attackers can exploit.

Ensure governance and security policies are updated for cloud services and implemented across the organization:

• 
  Identity policies
  
• 
  Data policies
  
• 
  Compliance policies and documentation
  

Administrative Privilege Management

Your IT administrators have control over the cloud services and identity management services. Consistent access control policies are a dependency for cloud security.

Privileged accounts, credentials, and workstations where the accounts are used must be protected and monitored.

Identity Systems and Identity Management

Identity services provide the foundation of security systems. Most enterprise organizations use existing identities for cloud services, and these identity systems need to be secured at or above the level of cloud services.

Threat Awareness

Organizations face a variety of security threats with varying motivations. Evaluate the threats that apply to your organization and put them into context by leveraging resources like threat intelligence and Information Sharing and Analysis Centers (ISACs).

Data Protection

You own your data and control how it should be used, shared, updated, and published.

You should classify your sensitive data and ensure it is protected and monitored with appropriate access control policies wherever it is stored and while it is in transit.

Please refer to the Office 365 Security & Compliance Center and Enterprise Mobility + Security sections later in this document.

MSIT Showcase: Changing our approach to information security at Microsoft.

With collaboration on the rise, Microsoft IT is rethinking information security. Social collaboration, ubiquitous connectivity, and new ways of collecting data and storing content encourage innovation and content sharing—but they also pose potential security risks for organizations. We help protect content through technologies like Microsoft Office Delve, Azure Information Protection, and Microsoft Teams—securing content wherever it exists, and in ways that go beyond traditional IT security.

Industry Leadership

Leading technology research companies Gartner Inc. and Forrester evaluate technology vendors and their solutions on a regular basis, and then publish research reports for customers. Both research companies have recognized Microsoft Office 365 as a “leader” and rated it “positive” in their research reports.

The Forrester Wave™: Enterprise Collaboration, Q4 2016	Dec 2016	Leader
Cloud Access Security Broker Leadership Compass, 2016	Aug 2016	Leader
Magic Quadrant for Unified Communications as a Service, Worldwide	Aug 2016	Challenger
Magic Quadrant for Sales Force Automation	Aug 2016	Leader
Magic Quadrant for Unified Communications	Jul 2016	Leader
Magic Quadrant for Mobile App Development Platforms	Jun 2016	Leader
Magic Quadrant for Enterprise Mobility Management Suites	Jun 2016	Visionary
The Forrester Wave: Enterprise File Sync And Share Platforms, Cloud Solutions, Q1 2016	Mar 2016	Leader
Gartner Magic Quadrant for Web Conferencing	Dec 2015	Leader
Gartner Magic Quadrant for Social Software in the Workplace	Oct 2015	Leader
The Forrester Wave: Agile Business Intelligence Platforms, Q3 2015	Sep 2015	Leader
Gartner Magic Quadrant for Unified Communications as a Service	Sep 2015	Challenger
Gartner Magic Quadrant for Unified Communications	Aug 2015	Leader
Gartner Magic Quadrant for Secure Email Gateways	Jun 2015	Leader
Gartner Magic Quadrant for Business Intelligence and Analytics Platforms	Feb 2015	Leader

Refer to Analyst Relations – Reports page for a collection of reports published by leading independent analyst firms.