Security and Compliance

Office 365

Published: May 2014

For the latest information, please visit the Office 365 Trust Center at http://trust.office365.com

Introduction 1
Service-Level Security 2 Physical layer—facility and network security 4 Logical layer—host, application, admin user 5 Data layer—data 7 Data integrity and encryption 7 Protection from security threats 8 Security monitoring and response 9 Independent verification 9
Security Customer Controls 10 Secure end-user access 12
Privacy by Design 14
Privacy Customer Controls 15
Service Compliance 16
Customer Compliance Controls 18
Conclusion 21

Introduction
Information security is an essential consideration for all IT organizations around the world. In addition to the prevalence of information technology, the complexity of delivering access to services from a growing number of devices, platforms, and places than ever before forces information security to be a paramount matter. Multi-device access benefits your users, especially with the consumerization of IT, but broader access represents another potential attack surface. At the same time, organizations face ever-evolving cyber-threats from around the world that target users who may accidentally lose or compromise sensitive data.

When you consider moving your organization to cloud services to store your data and various productivity services, the security concerns add another layer of consideration. That consideration is one of trust. You have to be able to trust your service provider to take care of the key expectations around processing and managing your data - security, privacy and compliance.

Our construct for security, compliance, and privacy for Office 365 has two equally important dimensions. The first dimension includes service-level capabilities that include technology, operational procedures, and