Microsoft 365: Staying Compliant

First, define regulatory compliance. IT compliance means complying to a specification, regulation, standard, or law. Compliance in IT refers to regulatory compliance, which is the goal organizations strive for in their attempts to comply with relevant laws, policies, and regulations. HIPAA, which applies to all US health businesses, FISMA, which applies to federal organizations, and HACCP, GDPR, and PCI DSS for credit card organizations are examples of rules. How do regulations affect IT? Most regulatory compliance criteria influence IT since more information is digitalized and controlled by IT. HIPAA, for example, requires that access records be preserved for at least six years. Complex ones include testing security systems and processes routinely. PCI DSS demands quarterly internal and external network vulnerability scans and after network changes. So you can see how these requirements can strain IT, especially in planning, while introducing a new system, having a scan done, and other day-to-day IT duties. Noncompliance: There are two punishments, and it depends on several factors. Usually it's a fine, which can be significant for an organization, but people have also gone to prison and had legal issues. Your organization must obey all applicable regulations.

Microsoft helps us reach regulatory compliance. Microsoft Service Trust Portal is part of this answer. The Service Trust Portal contains audit reports, pen tests, security assessments, and more on how Microsoft controls security, privacy, and compliance. The Service Trust Portal requires audit, pen test, and security reports for regulatory requirements. Microsoft must undertake audits on the infrastructure it hosts and manages. Since Microsoft undertakes audits and pen tests, internal IT doesn't have to. Service Trust Portal contains whitepapers on anticipated regulatory needs. Microsoft Compliance Manager is also important. The Compliance Manager is a workflow-based risk assessment tool in the Microsoft Service Trust Portal that tracks, assigns, and verifies your organization's regulatory compliance actions connected to Microsoft professional services and cloud services including Office 365, Dynamics 365, and Azure. When we look at Compliance Manager in a few minutes, we'll see what I said at the beginning of the course: cloud security is a partnership. The screenshot shows it. Most acts or requirements fall into two groups. Consumer- and Microsoft-managed. Since Microsoft maintains the infrastructure, they make sure all their action items are taken care of, but you still have tasks to do. The Compliance Manager makes it easy to follow, assign, and review compliance responsibilities.

Let's speak about Office 365 DLP now that we've seen the Service Trust Portal and Compliance Manager. Data loss prevention is vital for regulatory compliance because most regulations only apply to a subset of an enterprise's information. Credit card info, PII such SSN, passport, driver's license, patient info. It doesn't apply to sales brochures and other basic company material. How can you prevent users from misusing sensitive data? DLP prevents this. DLP identifies sensitive data in Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. It also lets you easily implement rules or actions when sensitive information is identified, such as prohibiting unintentional distribution or hiding it until reviewed. You can define criteria for common information, like a social security number, or develop your own sensitive information category, like a medical file. Using Office 365 DLP, you can rapidly identify sensitive information and ensure it's not misplaced or misused.

#ms900 #az900 #cloudcomputing #iaas #saas #paas #azure #microsoft365 #computing #deployments #microsoftoffice #office365

Видео Microsoft 365: Staying Compliant канала EduFi