1. Updated August 10, 2009 Security in Business Productivity Online Suite

2. Agenda What is Business Productivity Online Suite Microsoft Online Services Risk Management Security Privacy & Regulatory Service Continuity Compliance Management Customer Benefits Q&A

3. Business Productivity Online Suite Some existing customers

4. Risk Management Program Information Security Policy Security Privacy Service Continuity Compliance Management

5. Security Program A risk-based, multi-dimensional approach to help safeguard services and data Security Management Security Monitoring & Response, Threat & Vulnerability Management Data Access Control & Monitoring, File/Data Integrity User Account Management, Training & Awareness, Screening Application Secure Development Lifecycle, Access Control & Monitoring, Anti-Malware Host Access Control & Monitoring, Anti-Malware, Patch & Config Mgmt Internal Network Dual-factor Authentication, Intrusion Detection, Vulnerability Scanning Network perimeter Facility Edge Routers, Firewalls, Intrusion Detection, Vulnerability Scanning Video Surveillance, biometrics, Access Control

7. Microsoft Online Services Privacy and Regulatory Divisional Requirements Specific to Software + Services

10. Compliance Management Rationalize and harmonize requirements Microsoft internal Corporate (security & privacy policies, etc.) Microsoft Online Services (security & privacy policies) Trustworthy Computing (SDL, Engineering Excellence, etc.) Industry & regulatory Industry best practices: ISO/IEC 27001:2005, NIST SP 800-53 Customer requirements: SOX, HIPAA, FISMA, GLBA, PCI DSS Data protection laws Inputs Remove non-applicable, harmonize redundant, identify conditional Common Baseline Requirements Conditional Requirements

12. Technical compliance (patch and configuration mgmt, vulnerability scans, penetration tests, etc.)

13. Personnel compliance (training and awareness, screening, etc.)

14. Process compliance (business process evaluation, change control, access management, etc.)

15. Physical security compliance (CCTV monitoring, access control and logging, etc.)

16. Third Party validation

17. Facilities & infrastructure services – ISO cert + SAS 70

18. BPOS Dedicated – ISO aligned + SAS 70

20. Privacy of customer data is respected

21. Audits demonstrate independent validation

22. Service resiliency and service and data recoverability are fundamental to service operations

24. Service upgrades and security updates

25. Comprehensive security monitoring and response

26. Customer control over customer data

28. Technical information on TechNet http://technet.microsoft.com/msonline