NOTE: You May Not Distribute This SOC 2 Report For

NOTE: You may not distribute this SOC 2 report for Microsoft Azure to other parties, except where Microsoft Azure is a component of the services you deliver to your customers. In this circumstance, you may distribute this SOC 2 report to current and prospective customers / users of your own services. You must provide recipients of this SOC 2 report written documentation of the function that Azure provides as it relates to your services. You must keep a complete and accurate record of entities and the personnel of such entities to whom this SOC 2 report is provided. You must promptly provide copies of such records to Microsoft or Deloitte & Touche LLP upon request. You must display or deliver the language in this paragraph or language that is substantially equivalent to this paragraph to recipients of this SOC 2 report for Microsoft Azure. Microsoft Corporation - Microsoft Azure (Azure & Azure Government) Service Organization Controls (SOC) 2 Report April 1, 2017 - March 31, 2018 Table of contents Executive Summary 1 Section I: Independent Service Auditors’ Report for the Security, Availability, Processing Integrity, and Confidentiality Principles and CCM Criteria 4 Section II: Management’s Assertion 8 Section III: Description of Microsoft Azure System 11 Section IV: Information Provided by Independent Service Auditor Except for Control Activities and Criteria Mappings 65 Section V: Supplemental Information Provided by Microsoft Azure 216 Executive Summary Microsoft Azure Scope Microsoft Azure and Microsoft Datacenters Period of Examination April 1, 2017 to March 31, 2018 Applicable Trust Principle(s) Security, Availability, Processing Integrity, and Confidentiality • Phoenix, AZ (PHX20) • Amsterdam, Netherlands • Santa Clara, CA (AM1/2/3, (BY1/2/3/4/21/22) AMS04/05/06/20) • Des Moines, IA (DM1/2/3, • Durham, United Kingdom DSM05) (MME20) • Chicago, IL (CH1/3, CHI20) • Chessington, United Kingdom (LON20) • San Antonio, TX (SN1/2/3/4/5/6) • London, United Kingdom (LON21) • Ashburn, VA (BL2/3/5/7) • Cardiff, United Kingdom • Boydton, VA (BN1/3/4/6) (CWL20) • Dallas, TX (DAL) • Dublin, Ireland (DB3/4/5, • Bristow, VA (BLU) DUB06/07/20) • Reston, VA (BL4/6/30) • Paris, France • Tukwila, WA (TK5) (PAR02/20/21/22) Location(s) • Quincy, WA (CO1/2, MWH01) • Marseille, France (MRS20) • Cheyenne, WY (CYS01/04) • Copenhagen, Denmark • San Jose, CA (SJC31) (CPH30) • New York, NY (NYC) • Milan, Italy (MIL30) • Stirling, VA (BL20) • Stockholm, Sweden (STO) • Toronto, Canada (YTO20, • Hong Kong (HK1/2, YTO01) HKG20) • Quebec City, Canada (YQB20) • Mumbai, India (BOM01) • Mexico City, Mexico (MEX30) • Dighi, India (PNQ01) • Macquarie Park, Australia • Ambattur, India (MAA01) (SYD03) • Osaka, Japan • Melbourne, Australia (MEL01) (OSA01/02/20) • Campinas, Brazil (CPQ01/02) • Tokyo, Japan (KAW, • Fortaleza, Brazil (FOR01) TYO01/21/22) • Rio de Janeiro, Brazil (RIO01) 1 Microsoft Azure • Sao Paulo, Brazil (GRU) • Cyberjaya, Malaysia • Santiago, Chile (SCL01) (KUL01) • Humacao, Puerto Rico (PR1) • Singapore (SG1/2/3, SIN20) • Vienna, Austria (VIE) • Busan, South Korea • Vantaa, Finland (HEL01) (PUS01, PUS20) • Seoul, South Korea (SEL20) Subservice Providers N/A Opinion Result Unqualified Testing Exceptions 5 2 Section I: Independent Service Auditors’ Report for the Security, Availability, Processing Integrity, and Confidentiality Principles and CCM Criteria Deloitte & Touche LLP 925 Fourth Avenue, Suite 3300 Seattle, WA 98104-1126 Tel: +1 206 716 7000 Section I: Independent Service Auditors’ Report for the Security, Availability, Processing Integrity, and Confidentiality Principles and CCM Criteria Microsoft Corporation One Microsoft Way Redmond, WA, 98052-6399 Scope We have examined the description of the system of Microsoft Azure and Microsoft datacenters (the “Service Organization” or “Azure”) in Section III of this Service Organization Controls Report (the “Report”), related to Azure’s in-scope services, for Azure and Azure Government cloud environments1 for the period April 1, 2017 to March 31, 2018 (the “Description”) based on the criteria set forth in the American Institute of Certified Public Accountants (“AICPA”) DC section 200A, 2015 Description Criteria for a Description of a Service Organization’s System in a SOC 2® Report (“description criteria”) and the suitability of the design and operating effectiveness of controls described therein to meet the criteria for the security, availability, processing integrity, and confidentiality principles (“applicable trust services criteria”)2 set forth in the 2016 edition of TSP section 100A, Trust Services Principles and Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Principles and Criteria), throughout the period April 1, 2017 to March 31, 2018. We have also examined the suitability of the design and operating effectiveness of controls to meet the requirements set forth in the Cloud Security Alliance’s (CSA’s) Cloud Controls Matrix (CCM) Version 3.0.1 control specifications (“CCM criteria”). The information included in Section V of the Report, “Supplemental Information Provided by Microsoft Azure” in the Report is presented by management of Azure to provide additional information and is not a part of the Description. The information about Service Organization’s Azure Compliance, Infrastructure Redundancy and Data Durability, Data Backup and Recovery, Microsoft Azure E.U. Data Protection Directive, Additional Resources, Management’s Response to Exceptions Noted, and User Entity Responsibilities, has not been subjected to our procedures applied in the examination of the Description and of the suitability of the design and operating effectiveness of the controls to meet the applicable trust services criteria and the CCM criteria, and, accordingly, we express no opinion on it. Service Organization’s Responsibilities In Section II of the Report, Azure has provided an assertion about the fairness of the presentation of the Description based on the description criteria and suitability of design and operating effectiveness of the controls 1 In-scope services and coverage periods are defined in the Azure and Azure Government Report Scope Boundary and Azure Supporting Infrastructure Services subsections in Section III of this SOC 2 report. Applicability of the Processing Integrity Trust Services Principle is defined in the Azure and Azure Government Report Scope Boundary subsection. In-scope datacenters and coverage periods are defined in the Locations Covered by this Report subsection in Section III of this SOC 2 report. 2 Applicable Trust Services Principles for Microsoft datacenters are Security and Availability. 4 described therein to meet the applicable trust services criteria and the CCM criteria. Azure is responsible for preparing the Description and assertion, including the completeness, accuracy, and method of presentation of the Description and assertion; providing the services covered by the Description; identifying the risks that would prevent the applicable trust services criteria and the CCM criteria from being met; designing, implementing, and documenting controls to meet the applicable trust services criteria and the CCM criteria; and specifying the controls that meet the applicable trust services criteria and the CCM criteria and stating them in the Description. Service Auditors’ Responsibilities Our responsibility is to express an opinion on the fairness of the presentation of the Description and on the suitability of the design and operating effectiveness of the controls described therein to meet the applicable trust services criteria and the CCM criteria, based on our examination. Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants and, accordingly, included procedures that we considered necessary in the circumstances. Those standards require that we plan and perform our examination to obtain reasonable assurance about whether, in all material respects, the Description is fairly presented based on the description criteria, and the controls were suitably designed and operating effectively to meet the applicable trust services criteria and the CCM criteria throughout the period April 1, 2017 to March 31, 2018. We believe that the evidence we obtained is sufficient and appropriate to provide a reasonable basis for our opinion. An examination of the description of a service organization’s system and the suitability of the design and operating effectiveness of those controls to meet the applicable trust services criteria and the CCM criteria involves: • Performing procedures to obtain evidence about whether the Description is fairly presented based on the description criteria and the controls were suitably designed and operating effectively to meet the applicable trust services criteria and the CCM criteria throughout the period April 1, 2017 to March 31, 2018. • Assessing the risks that the Description is not fairly presented and that the controls were not suitably designed or operating effectively to meet the applicable trust services criteria and the CCM criteria. • Testing the operating effectiveness of those controls to provide reasonable assurance that the applicable trust services criteria and the CCM criteria were met. • Evaluating the overall presentation of the Description. Inherent Limitations The Description is prepared to meet the common needs of a broad range of users and may not, therefore, include every aspect of the

Load more