Office 365 and Compliance Standards

Customers may need to work with Microsoft to assess their information security and privacy rights and limitations in Office 365.

Microsoft has worked with auditors to attest to the service’s compliance with certain privacy and security standards including the following:

• E.U. Model Clauses, which address international transfers of data
• Family Educational Rights and Privacy Act (FERPA), which addresses use and disclosure restrictions related to student data and nonuse of e-mail and document scanning for advertising purposes
• Federal Information Security Management Act (FISMA), which attests that the service conforms to security processes required by U.S. federal agencies
• Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement (BAA), which addresses the safeguarding of health information in the United States
• ISO 27001, a security benchmark attesting that the service meets a set of physical, logical, and process management controls.

Microsoft can provide tenants with a signed copy of these standards for their reference and archival.