To help organizations comply with national, regional, and industry-specific requirements governing the collection and use of individuals’ data, Microsoft offers the most comprehensive set of certifications and attestations of any cloud service provider.
Microsoft Azure has passed the audit for the Content Delivery and Security Association Content Protection and Security standard for compliance with antipiracy procedures governing digital media.
Microsoft Azure has implemented technical and organization security safeguards to help our customers protect individual’s privacy when they use our cloud service.
Azure and Office 365 operated by 21Vianet have been rated at Level 3 Classification by the evaluation organizations authorized by the Ministry of Public Security (MPS) for GB/T 22239-2008. Registration certifications are issued to both services.
Microsoft Azure is certified by the China Electronics Standardization Institute as compliant with GB 18030, the encoding standard mandated by the Chinese government for the Chinese ideographic character set.
Microsoft Azure operated by 21Vianet adheres to Multi-Level Protection Scheme, a Chinese state cloud security standard issued by the Ministry of Public Security.Learn more (Chinese)
Microsoft Azure Government, Microsoft Office 365 U.S. Government, and Microsoft Dynamics 365 U.S. Government adhere to the CJIS Security Policy, required to access the FBI's Criminal Justice Information Services (CJIS) database through the cloud.
The Cloud Security Mark is the first security standard for cloud service providers in Japan. Microsoft achieved a CS Gold Mark for all three service classifications: Microsoft Azure for IaaS and PaaS, and Microsoft Office 365 for SaaS.
Based on a rigorous assessment by an accredited independent CSA certification body, Microsoft Azure, Microsoft Intune, and Microsoft Power BI have been awarded the Cloud Security Alliance (CSA) STAR Certification at the Gold level.
Our Cloud Security Alliance (CSA) STAR Self-Assessment details how Microsoft cloud services fulfill the security, privacy, compliance, and risk management requirements defined in the CSA Cloud Controls Matrix (CCM) and the Consensus Assessment Initiative Questionnaire (CAIQ).
Based on FedRAMP authorizations, the Defense Information Systems Agency Cloud Service Support has granted a DoD Impact Level 4 Provisional Authorization (PA) for one Microsoft enterprise cloud service, and a DoD Impact Level 2 PA for others.
Microsoft offers European Union Standard Contractual Clauses that provide contractual guarantees around transfers of personal data. Microsoft was the first cloud service provider to gain approval from the EU’s Article 29 Working Party for contractual commitments.
Microsoft complies with the EU-U.S. Privacy Shield Framework as set forth and certified to the US Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States.
Microsoft helps customers comply with US Food and Drug Administration Code of Federal Regulations Title 21 Part 11, which details security requirements for the electronic records of companies that sell food and drugs in the United States.
FedRAMP is mandatory for cloud services used by U.S. federal agencies. Azure maintains a FedRAMP P-ATO at the Moderate Impact Level, and Azure Government has received a P-ATO at the High Impact Level. Dynamics 365 U.S. Government, Office 365, and Office 365 U.S. Government have received FedRAMP ATOs at the Moderate Impact Level.
Microsoft enterprise cloud services align with the requirements of the Family Educational Rights and Privacy Act, a US federal law that protects the privacy of students’ education records.
Microsoft certifies that the underlying cryptographic modules used in Microsoft products, including Microsoft enterprise cloud services, comply with the Federal Information Processing Standard Publication 140-2, a US government standard.
Microsoft Azure and Microsoft Office 365 have been independently assessed as meeting the requirements for the Center for Financial Industry Information Systems Version 8 standard security for banking computer systems in Japan.
Microsoft Azure Government and Microsoft Office 365 Government cloud services provide a contractual commitment that they have the appropriate controls in place to meet the requirements of US Internal Revenue Service Publication 1075.
Microsoft is the first hyperscale cloud service provider to receive the ISO 22301 certification for business continuity management. An independent certification body, BSI, awarded it to Azure, Azure Government, Intune, and Power BI.
Microsoft enterprise cloud services offer customers a Health Insurance Portability and Accountability Act Business Associate Agreement that stipulates adherence to HIPAA, which regulates patient Protected Health Information in the US.
Microsoft Azure, Microsoft Dynamics 365, and Microsoft Office 365 are accredited for the Certified Cloud Services List, which identifies cloud services that have successfully completed an IRAP assessment by the Australian Signals Directorate.
The ISO/IEC 27001 certificate validates that Microsoft enterprise cloud services have implemented the internationally recognized information security controls defined in the ISO/IEC 27001 standard.
The ISO/IEC 27017:2015 certificate validates that Microsoft enterprise cloud services have implemented the internationally recognized code of practice for information security controls based on the ISO/IEC 27002 standard for cloud services.
Microsoft was the first cloud provider to adhere to the ISO/IEC 27018 code of practice, which covers privacy protections for the processing of personal information by cloud service providers.
Azure Government supports customers building ITAR-capable systems on Azure Government.
Microsoft Azure Germany has published an IT Grundschutz Compliance Workbook developed by Hisolutions AG. This supports our clients in achieving their IT Grundschutz certification for solutions on Microsoft Azure Germany.
Microsoft Azure and Microsoft Azure Government comply with the Minimum Acceptable Risk Standards for Exchanges (MARS-E) for information security regulations for health-based exchanges under the Patient Protection and Affordable Care Act (ACA) of 2010.
Microsoft is one of the first global cloud service providers to have successfully achieved a Provisional Accreditation by MeitY (Ministry of Electronics and Information Technology), the governing body under the Ministry of Communications and IT, Government of India.
The Motion Picture Association of America offers guidance and control frameworks for studio partners to help ensure the security of digital film assets. Microsoft Azure was the first hyperscale, multitenant cloud service to successfully complete a formal MPAA assessment.
Microsoft was the first global CSP to receive MTCS 584:2013 certification across all three MTCS security levels. Furthermore, Microsoft Azure services (IaaS and PaaS) and Microsoft Office 365 services (SaaS) were certified at Level 3 and Microsoft Dynamics 365 services (SaaS) were certified at Level 2.
Microsoft Azure, Microsoft Azure Government, Dynamics 365 U.S. Government, Office 365 MT, and Office 365 US Government conform to the requirements set forth in NIST 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.
The New Zealand Government Chief Information Officer published a cloud computing framework of 100+ questions on the security, privacy, and sovereignty aspects of cloud services. Microsoft NZ demonstrates how Microsoft addresses these questions.
Microsoft Azure complies with Payment Card Industry Data Security Standards Level 1 version 3.1, the global certification standard for organizations that accept most payment cards and store, process, or transmit cardholder data.
Service Organization Controls (SOC) are a series of accounting standards that measure the control of financial information for a service organization. Azure’s SOC 1 and SOC 2 Type 2 audit reports attest to the effectiveness of the design and operation of its security controls.
Microsoft cloud services have been successfully audited against American Institute of Certified Public Accountants (AICPA) Service Organization Controls 1 standards for design and operational security.
Microsoft cloud services have been successfully audited against American Institute of Certified Public Accountants (AICPA) Service Organization Controls Type 2 standards for design and operational security.
Microsoft Azure and Microsoft Intune in-scope services have been successfully audited against American Institute of Certified Public Accountants (AICPA) Service Organization Controls 3 standards for design and operational security.
The UK Crown Commercial Service has renewed the classification of Microsoft’s in-scope cloud services to Government Cloud v6, covering all four of its offerings at the OFFICIAL level.
Microsoft cloud services offer Voluntary Product Accessibility Templates, a standardized form documenting whether a product meets the accessibility requirements of Section 508, an amendment to the Rehabilitation Act of 1973.
The US Department of Defense Information Assurance Certification and Accreditation Process was replaced with the NIST 800-37 Risk Management Framework and DoD 8510.01. Microsoft Azure demonstrates compliance through its FedRAMP accreditation.
The European Network and Information Security Agency Information Assurance Framework requirements have been mapped to Microsoft Azure through the CSA CCM. Customers can refer to the CSA CCM response version 3.0.1.
Azure, Azure Government, and Office 365 Government have a Provisional Authority to Operate for FedRAMP, the successor of the Federal Information Security Management Act for US government cloud solutions.
Microsoft demonstrates the alignment of Microsoft Azure with the Shared Assessments Program—a vendor-risk management toolset—through the CSA CCM version 3.0.1.
Microsoft Azure, Microsoft Dynamics 365, and Microsoft Office 365 have implemented the security measures in the Argentina Personal Data Protection Act.
The My Number Act assigns a unique number to each resident of Japan. Companies using Microsoft cloud services can be assured that Microsoft does not have standing access to My Number data. Learn more (Japanese)Learn more (English)
Azure operated by 21Vianet in China has passed the Trusted Cloud Service certification developed by the Data Center Alliance and tested by the China Academy of Information and Communications Technology.
The Federation Against Copyright Theft in the UK developed a certification scheme based on ISO 27001 that focuses on physical and digital security to protect against theft of intellectual property. Microsoft Azure was the first multitenant public cloud to achieve FACT certification.
Spain's Esquema Nacional de Seguridad (National Security Framework) provides ICT security guidance to public administrations and cloud service providers (CSPs). Microsoft was the first hyperscale CSP to receive this ENS certification—for Microsoft Azure and Microsoft Office 365.
Customers can use the Azure, Azure Government, and Office 365 for applications that have requirements under Good Clinical, Laboratory and Manufacturing Practices (GxP) and US Food and Drug Administration CFR Title 21 Part 11.
