Center For Internet Security (CIS) Benchmarks - Adelia Risk

Cloud Security Alliance (CSA) STAR attestation2/17/2021 3 minutes to read Edit OnlineCSA STAR attestation overviewThe Cloud Security Alliance (CSA) maintains the Security, Trust & Assurance Registry (STAR), a free, publiclyaccessible registry where cloud service providers (CSPs) can publish their CSA-related assessments. STARconsists of three levels of assurance aligned with control objectives in the CSA Cloud Controls Matrix (CCM).(The CCM covers fundamental security principles across 16 domains to help cloud customers assess the overallsecurity risk of a cloud service.):Level 1: STAR Self-AssessmentLevel 2: STAR Attestation, STAR Certification, and C-STAR Assessment (which are based on audits by thirdparties)Level 3: STAR Continuous Monitoring (program requirements are still under development by CSA)STAR Attestation involves a rigorous independent audit of a cloud provider's security posture based on a SOC 2Type 2 audit with CCM criteria. The independent auditor that evaluates a cloud provider's offerings for STARAttestation must be a certified public accountant (CPA) and is required to have the CSA Certificate in CloudSecurity Knowledge (CCSK).A SOC 2 Type 2 audit is based on American Institute of Certified Public Accountants (AICPA) Trust ServicesPrinciples and Criteria, including security, availability, confidentiality, and processing integrity, and the criteria inthe CCM. STAR Attestation provides an auditor's findings on the design suitability and operating effectiveness ofSOC 2 controls in Microsoft cloud services. The objective is to meet both the AICPA criteria mentioned aboveand requirements set forth in the CCM.Microsoft in-scope cloud servicesMicrosoft Azure and Microsoft Intune have been awarded CSA STAR Attestation. STAR Attestation provides anauditor's findings on the design suitability and operating effectiveness of SOC 2 controls in Microsoft cloudservices.Azure and Azure GovernmentAzure GermanyMicrosoft Cloud App SecurityMicrosoft GraphIntuneMicrosoft Managed DesktopPower Automate (formerly Microsoft Flow) cloud service either as a standalone service or as included in anOffice 365 or Dynamics 365 branded plan or suitePowerApps cloud service either as a standalone service or as included in an Office 365 or Dynamics 365branded plan or suitePower BIAudits, reports, and certificatesCSA STAR Attestation and Certification

Frequently asked questionsWhich industr y standards does the CSA CCM align with?The CCM corresponds to industry-accepted security standards, regulations, and control frameworks such asISO/IEC 27001, PCI DSS, HIPAA, AICPA SOC 2, NERC CIP, FedRAMP, NIST, and many more. For the most currentlist, visit the CSA website.Where can I see the CSA STAR Attestation for Microsoft cloud ser vices?You can download the CSA STAR Attestation for Azure, which also covers Intune, from the CSA Registry.Which CSA STAR levels of assurance have Microsoft business cloud ser vices attained?Level 1 : CSA STAR Self-Assessment : Azure, Microsoft Dynamics 365, and Microsoft Office 365. The SelfAssessment is a complimentary offering from cloud service providers to document their security controls tohelp customers assess the security of the service.Level 2 : CSA STAR Cer tification : Azure, Microsoft Cloud App Security, Intune, and Microsoft Power BI.STAR Certification is based on achieving ISO/IEC 27001 certification and meeting criteria specified in theCCM. It is awarded after a rigorous third-party assessment of the security controls and practices of a cloudservice provider.Level 2 : CSA STAR Attestation : Azure and Intune. CSA and the AICPA have collaborated to provideguidelines for CPAs to use in conducting SOC 2 engagements, using criteria from the AICPA (Trust ServicePrinciples, AT 101) and the CSA CCM. STAR Attestation is based on these guidelines and is awarded afterrigorous independent assessments of cloud providers.Use Microsoft Compliance Manager to assess your riskMicrosoft Compliance Manager is a feature in the Microsoft 365 compliance center to help you understand yourorganization's compliance posture and take actions to help reduce risks. Compliance Manager offers a premiumtemplate for building an assessment for this regulation. Find the template in the assessment templates pagein Compliance Manager. Learn how to build assessments in Compliance Manager.ResourcesAzure standard response for request for informationAzure Cloud Security Alliance CAIQOffice 365 Mapping of CSA Cloud Control MatrixCloud Security AllianceCSA Security, Trust & Assurance Registry (STAR)SOC 1, 2, and 3 ReportsCloud Controls Matrix (CCM)Microsoft Common Controls Hub Compliance FrameworkCompliance on the Microsoft Trust Center

Cloud Security Alliance (CSA) STAR certification2/17/2021 3 minutes to read Edit OnlineCSA STAR certification overviewThe Cloud Security Alliance (CSA) maintains the Security, Trust & Assurance Registry (STAR), a free, publiclyaccessible registry where cloud service providers can publish their CSA-related assessments. STAR consists ofthree levels of assurance aligned with the control objectives in the CSA Cloud Controls Matrix (CCM). (The CCMcovers fundamental security principles across 16 domains to help cloud customers assess the overall securityrisk of a cloud service.)Level 1: STAR Self-AssessmentLevel 2: STAR Certification, STAR Attestation, and C-STAR AssessmentLevel 3: STAR Continuous Monitoring (program requirements are still under development by CSA)Microsoft and CSA STAR certificationMicrosoft Azure, Microsoft Intune, and Microsoft Power BI have obtained STAR Certification, which involves arigorous independent third-party assessment of a cloud provider’s security posture. This STAR certification isbased on achieving ISO/IEC 27001 certification and meeting criteria specified in the CCM. It demonstrates that acloud service provider conforms to the applicable requirements of ISO/IEC 27001, has addressed issues criticalto cloud security as outlined in the CCM, and has been assessed against the STAR Capability Maturity Model forthe management of activities in CCM control areas.During the assessment, an accredited CSA certification auditor assigns a Maturity Capability score to each of the16 CCM control areas. The average score is then used to assign the overall level of maturity and thecorresponding Bronze, Silver, or Gold award. Azure, Intune, Power BI, and Microsoft Cloud App Security wereawarded Cloud Security Alliance (CSA) STAR Certification at the Gold level.Learn how to accelerate your CSA STAR Certification deployment with our Azure Security and ComplianceBlueprints: Download the Microsoft Azure Responses to CSA Consensus Assessments Initiative QuestionnaireMicrosoft in-scope cloud servicesAzure, Azure Government, and Azure GermanyMicrosoft Cloud App SecurityMicrosoft GraphMicrosoft Healthcare BotIntuneMicrosoft Managed DesktopMicrosoft Defender Advanced Threat ProtectionOMS Service MapPower Automate (formerly Microsoft Flow): cloud service either as a standalone service or as included in anOffice 365 or Dynamics 365 branded plan or suitePowerApps cloud service: either as a standalone service or as included in an Office 365 or Dynamics 365branded plan or suitePower BI: The cloud service portion of Power BI offered as a standalone service or as included in an Office365 branded plan or suitePower BI Embedded

Microsoft StreamAudits, reports, and certificatesAzure, Dynamics 365, and Online Services – CSA STAR CertificateFrequently asked questionsWhich industr y standards does the CSA CCM align with?The CCM corresponds to industry-accepted security standards, regulations, and control frameworks, such as ISO27001, PCI DSS, HIPAA, AICPA SOC 2, NERC CIP, FedRAMP, NIST, and many more. For the most current list, visitthe CSA website.Where can I view the CSA STAR Cer tification for Microsoft cloud ser vices?You can view the CSA STAR Certification for Azure, which also covers Dynamics 365, Intune and, Power BI fromthe CSA Registry.What maturity level did Microsoft cloud ser vices achieve?Azure, Microsoft Cloud App Security, Intune, and Power BI have achieved the highest possible Gold Award forthe Maturity Capability assessment.Which CSA STAR levels of assurance have Microsoft business cloud ser vices attained?Level 1 : CSA STAR Self-Assessment : Azure, Dynamics 365, and Office 365. The Self-Assessment is acomplimentary offering from cloud service providers to document their security controls to help customersassess the security of the service.Level 2 : CSA STAR Cer tification : Azure, Microsoft Cloud App Security, Intune, and Power BI. STARCertification is based on achieving ISO/IEC 27001 certification and meeting criteria specified in the CCM. It isawarded after a rigorous third-party assessment of the security controls and practices of a cloud serviceprovider.Level 2 : CSA STAR Attestation : Azure and Intune. CSA and the AICPA have collaborated to provideguidelines for CPAs to use in conducting SOC 2 engagements, using criteria from the AICPA (Trust ServicePrinciples, AT 101) and the CSA CCM. STAR Attestation is based on these guidelines and is awarded afterrigorous independent assessments of cloud providers.ResourcesAzure standard response for request for informationAzure Cloud Security Alliance CAIQOffice 365 Mapping of CSA Cloud Control MatrixCloud Security AllianceCSA Security, Trust & Assurance Registry (STAR)About CSA STAR certificationCloud Controls Matrix (CCM)ISO/IEC 27001Microsoft Common Controls Hub Compliance FrameworkCompliance on the Microsoft Trust Center

Cloud Security Alliance (CSA) STAR self-assessment11/30/2020 3 minutes to read Edit OnlineCSA STAR self-assessment overviewThe Cloud Security Alliance (CSA) is a nonprofit organization led by a broad coalition of industry practitioners,corporations, and other important stakeholders. It is dedicated to defining best practices to help ensure a moresecure cloud computing environment, and to helping potential cloud customers make informed decisions whentransitioning their IT operations to the cloud.In 2010, the CSA published a suite of tools to assess cloud IT operations: the CSA Governance, RiskManagement, and Compliance (GRC) Stack. It was designed to help cloud customers assess how cloud serviceproviders (CSPs) follow industry best practices and standards and comply with regulations.In 2013, the CSA and the British Standards Institution launched the Security, Trust & Assurance Registry (STAR), afree, publicly accessible registry in which CSPs can publish their CSA-related assessments.CSA STAR is based on two key components of the CSA GRC Stack:Cloud Controls Matrix (CCM): a controls framework covering fundamental security principles across 16domains to help cloud customers assess the overall security risk of a CSP.The Consensus Assessments Initiative Questionnaire (CAIQ): a set of more than 140 questions based on theCCM that a customer or cloud auditor may want to ask of CSPs to assess their compliance with CSA bestpractices.STAR provides three levels of assurance; CSA-STAR Self-Assessment is the introductory offering at Level 1,which is free and open to all CSPs. Going further up the assurance stack, Level 2 of the STAR program involvesthird-party assessment-based certifications, and Level 3 involves certifications based on continuous monitoring.Microsoft and CSA STAR self-assessmentAs part of the STAR Self-Assessment, CSPs can submit two different types of documents to indicate theircompliance with CSA best practices: a completed CAIQ, or a report documenting compliance with CCM. For theCSA STAR Self-Assessment, Microsoft publishes both a CAIQ and a CCM-based report for Microsoft Azure, andCCM-based reports for Microsoft Dynamics 365 and Microsoft Office 365.Learn how to accelerate your CSA STAR Self-Assessment deployment with our Azure Security and ComplianceBlueprint: Download Azure response to the CSA Consensus AssessmentsMicrosoft in-scope cloud servicesAzure and Azure GovernmentDynamics 365 CSA STAR Self-AssessmentAudits, reports, and certificatesAzure standard response for request for informationAzure Cloud Security Alliance CAIQAzure responses to the CSA CAIQ v3.0.1Frequently asked questions

Which industr y standards does the CSA CCM align with?The CCM corresponds to industry-accepted security standards, regulations, and control frameworks such as ISO27001, PCI DSS, HIPAA, AICPA SOC 2, NERC CIP, FedRAMP, NIST, and many more. For the most current list, visitthe CSA website.Why is the CSA STAR Self-Assessment impor tant?It enables CSPs to document compliance with CSA published best practices in a transparent manner. Selfassessment reports are publicly available, thereby helping cloud customers gain visibility into the securitypractices of CSPs, and compare various CSPs using the same baseline.Which CSA STAR levels of assurance have Microsoft business cloud ser vices attained?Level 1 : CSA STAR Self-Assessment : Azure, Dynamics 365, and Office 365. The Self-Assessment is acomplimentary offering from cloud service providers to document their security controls to help customersassess the security of the service.Level 2 : CSA STAR Cer tification : Azure, Microsoft Cloud App Security, Intune, and Power BI. STARCertification is based on achieving ISO/IEC 27001 certification and meeting criteria specified in the CCM. It isawarded after a rigorous third-party assessment of the security controls and practices of a cloud serviceprovider.Level 2 : CSA STAR Attestation : Azure and Intune. CSA and the AICPA have collaborated to provideguidelines for CPAs to use in conducting SOC 2 engagements, using criteria from the AICPA (Trust ServicePrinciples, AT 101) and the CSA CCM. STAR Attestation is based on these guidelines and is awarded afterrigorous independent assessments of cloud providers.ResourcesCloud Security AllianceCloud Controls Matrix (CCM)Consensus Assessments Initiative Questionnaire (CAIQ)CSA Security, Trust & Assurance Registry (STAR)Compliance on the Microsoft Trust CenterMicrosoft CSA STAR self-assessmentsAzureDynamics 365

Microsoft 365 ISO 27001 action plan — Toppriorities for your first 30 days, 90 days, and beyond2/5/2021 9 minutes to read Edit OnlineThe International Organization for Standardization (ISO) is an independent nongovernmental developer ofvoluntary international standards. The International Electrotechnical Commission (IEC) leads the preparation andpublication of international standards for electrical, electronic, and related technologies. The ISO/IEC 27000family of standards outlines controls and mechanisms that help maintain the security of information assets.ISO/IEC 27001 is the international standard for implementing an information security management system(ISMS). An ISMS describes the necessary methods used and evidence associated with requirements that areessential for the reliable management of information asset security in any type of organization.This article includes a prioritized action plan you can follow as you work to meet the requirements of ISO/IEC27001. This action plan was developed in partnership with Protiviti, a Microsoft partner specializing inregulatory compliance. Learn more about how to use this action plan at Microsoft Ignite by attending thissession: Chart your Microsoft 365 compliance path and information protection strategy, presented by MaithiliDandige (Microsoft) and Antonio Maio (Protiviti).Action plan outcomesThese recommendations are provided across three phases in a logical order with the following outcomes:P H A SEO UTC O M ES

P H A SEO UTC O M ES30 daysUnderstand your ISO 27001 governance andcompliance requirements. Conduct a risk assessment and align risk management andmitigation to that assessment’s outcomes. Assess and manage your compliance risks by usingMicrosoft Compliance Manager. Establish standard operating procedures (SOPs) for each ofthe 14 ISO 27001 groups.Star t planning a roll out of an informationclassification and retention policies and tools to theorganization to help users identify, classify, andprotect sensitive data and assets. Learn how the Azure Information Protection applicationand policies can help users easily apply visual sensitivitymarkings and metadata to documents and emails. Developyour organization’s information classification schema, alongwith an education and roll out plan. Consider rolling out Labels to the organization to helpusers easily apply record retention and protection policies tocontent. Plan your organization’s labels in accordance withyour legal requirements for information record retention,along with an education and roll out plan.Ensure that records related to information securityare protected from loss, deletion, modification, orunauthorized access by creating Audit andAccountability policies as par t of your StandardOperating Procedures (SOPs). Enable audit logging (including mailbox auditing) tomonitor Microsoft 365 for potentially malicious activity andto enable forensic analysis of data breaches. On a regular cadence, search your company’s audit logs toreview changes that have been made to the tenant’sconfiguration settings. Enable alert policies for sensitive activities, such as when anelevation of privileges occurs on a user account. For long-term storage of audit log data, use the Office 365Management Activity API reference to integrate with asecurity information and event management (SIEM) tool.Define administrative and security roles for theorganization, along with appropriate policies relatedto segregation of duties. Utilize the Microsoft 365 administrative roles to enableseparation of administration duties. Segment permissions to ensure that a single administratordoes not have greater access than necessary.

P H A SEO UTC O M ES90 daysUse Microsoft 365 security capabilities to controlaccess to the environment, and protectorganizational information and assets according toyour defined standard operating procedures (SOPs). Protect administrator and end-user accounts by enablingidentity and authentication solutions, such as multi-factorauthentication and modern authentication. Establish strong password policies to manage and protectuser account credentials. Configure and roll out message encryption capabilities tohelp end users comply with your organization’s SOPs whensending sensitive data via email. Protect against malicious code and implement data breachprevention and response procedures. Configure Data Loss Prevention (DLP) policies to identify,protect, and control access to sensitive data. Ensure that sensitive data is stored and accessed accordingto corporate policies. Prevent the most common attack vectors includingphishing emails and Office documents containing maliciouslinks and attachments.Beyond 90 daysUse Microsoft 365 advanced data governance toolsand information protection to implement ongoinggovernance programs for personal data. Automatically identify personal information in documentsand emails Protect sensitive data stored and accessed on mobiledevices across the organization, and ensure that compliantcorporate devices are used to data.Monitor ongoing compliance across Microsoft 365and other Cloud applications. To evaluate performance against standard operatingprocedures (SOPs), utilize Compliance Manger to performregular assessments of the organization’s informationsecurity policies and their implementation. Review and monitor the information security managementsystem on an on-going basis. Control and perform regular reviews of all users andgroups with high levels of permissions (i.e. privileged oradministrative users). Deploy and configure Microsoft 365 capabilities forprotecting privileged identities and strictly controllingprivileged access. As part of your standard operating proce

The Center for Internet Security (CIS) has published benchmarks for Microsoft products and services including the Microsoft Azure and Microsoft 365 Foundations Benchmarks, the Windows 10 Benchmark, and the Windows Server 2016 Benchmark. CIS benchmarks are internationally recognized as security standards for defending IT systems and data against