These technical and organizational measures describe the control areas used to protect personal data and support confidentiality, integrity, availability, and resilience.
Document precedence: The measures applicable to a specific processing activity depend on the contracted service, product architecture, customer environment, and current controlled DPA.
Pseudonymization and data minimization
Where appropriate, assignment information is separated or reduced and personal data is anonymized or pseudonymized when the purpose permits. Collection and access are limited to the information needed for the service.
Encryption and transmission
Systems storing or processing personal data use encryption appropriate to the service. Network transmission uses HTTPS or another approved protected channel. Key and secret handling follow restricted administrative processes.
Identity and access control
Access is role-based, limited to authorized personnel, and reviewed according to responsibility and risk. Strong authentication, least privilege, Microsoft identity controls, and administrative separation are used where the architecture supports them.
Confidentiality and personnel
Personnel with access to protected information are subject to confidentiality duties and receive security and data-protection guidance appropriate to their work. Access ends or changes when responsibilities change.
Integrity and secure change
Changes are managed through source control, review, testing, dependency management, deployment controls, and issue tracking appropriate to the product. Security findings are assessed and remediated according to risk.
Availability and recovery
Service architecture, monitoring, backup, release management, and recovery practices are selected according to the contracted service. Microsoft platform capabilities are used where the product runs in Microsoft or Azure.
Logging and incident management
Relevant administrative, security, and service events are logged where supported. Suspected incidents follow an investigation, containment, remediation, communication, and lessons-learned process.
Physical and cloud security
Cloud-hosted components rely on the physical and environmental controls of the contracted data-center provider. Customer-hosted components also depend on the customer tenant, subscription, device, and network controls.
Supplier and subprocessor management
Providers are assessed for the relevant service, bound by appropriate terms, and limited to the data and access necessary for their role. International-transfer safeguards are applied when required.
Deletion, retention, and review
Information is deleted or returned according to documented retention requirements, customer instructions, contract terms, and legal obligations. Measures are reviewed as architecture, threats, and services change.