{"id":86737,"date":"2018-11-26T10:15:17","date_gmt":"2018-11-26T18:15:17","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=86737"},"modified":"2023-05-15T23:03:26","modified_gmt":"2023-05-16T06:03:26","slug":"how-to-help-maintain-security-compliance","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/11\/26\/how-to-help-maintain-security-compliance\/","title":{"rendered":"How to help maintain security compliance"},"content":{"rendered":"
This is the last post in our eight-blog series on deploying Intelligent Security scenarios. To read the previous entries, check out the Deployment series page<\/a>.<\/em><\/p>\n <\/p>\n Your employees need to access, generate, and share organizational information ranging from extremely confidential to informal; you must ensure that all information and the movement of that information comply with industry standards without inhibiting workflow. Microsoft 365 security solutions can help you know what\u2019s happening with your data, set permissions and classifications, and discover and help prevent leaks.<\/p>\n To better manage compliance processes, the first thing you\u2019ll want to do is distribute the work out to compliance \u201cspecialists\u201d across your organization. The Microsoft 365 Security & Compliance Center<\/a> (Figure 1) makes this easy by providing a central location to assign people to specific compliance tasks, such as data loss prevention, eDiscovery, and data governance.<\/p>\n <\/p>\n Figure 1: The Microsoft 365 Security & Compliance Center Dashboard.<\/em><\/p>\n Next, you\u2019ll need to decide on your policies and data classifications that will allow you to take actions on data. To streamline this compliance task, Microsoft Advanced Data Governance<\/a> offers automatic data classification and proactive policy recommendations\u2014such as retention and deletion policies\u2014throughout the data lifecycle. You can enable default system alerts to identify data governance risks, for example, detecting an employee deleting a large volume of files. You can also create custom alerts by specifying alert-matching conditions, thresholds, or other activities that require admin attention.<\/p>\n The Microsoft Security Compliance Manager<\/a> (Figure 2) provides tools to proactively manage evolving data privacy regulations. You can perform ongoing risk assessments on security, compliance, and privacy controls across 11 assessments, including these standards:<\/p>\n Plus, regional standards and regulations, including:<\/p>\n As well as industry standards and regulations, such as:<\/p>\n Additionally, the Compliance Manager provides you with step-by-step guidance of how to implement controls to enhance your compliance posture and keep you updated with the current compliance landscape. In addition, built-in collaboration tools to help you assign, track, and record compliance activities to prepare for internal or external audits.<\/p>\n <\/p>\n Figure 2: Compliance Manager provides tools to proactively manage evolving data privacy regulations.<\/em><\/p>\n With employees, partners, and other users sharing your data over cloud services, mobile devices, and apps, you need solutions that understand what data is sensitive and automatically protect and govern that data. The unified labeling experience for Microsoft 365 in the Security & Compliance Center provides a tool that allows you to configure data sensitivity labels and protection policies across Azure Information Protection<\/a> and Office 365 in one location (Figure 3). You can create and customize labels that define the sensitivity of the data\u2014for example, a label of \u201cGeneral\u201d means the file doesn\u2019t contain sensitive information, while \u201cHighly Confidential\u201d means the file contains very sensitive information. For each label, you can configure protection settings, such as adding encryption and access restrictions, or adding visual markings such as watermarks or headers\/footers. To support data governance compliance, you can set policies for data retention, deletion, and disposition, and then automatically apply or publish these labels to users.<\/p>\n <\/p>\n Figure 3: Configure data sensitivity labels and protection policies across Azure Information Protection and Office 365 in one location.<\/em><\/p>\n There are over 85 built-in sensitive information types that you can use to automatically detect common sensitive data types that may be subject to compliance requirements, such as credit card information, bank account information, passport IDs, and other personal data types. You can also create your own custom sensitive information types (such as employee ID numbers) or upload your own dictionary of terms that you want to automatically detect in documents and emails.<\/p>\n Controlling privileged access can reduce the risk of data compromise and help meet compliance obligations regarding access to sensitive data. Privileged access management (PAM)<\/a> in Office 365 (Figure 4), available in the Microsoft 365 Admin Center<\/a>, allows you to enforce zero standing access for your privileged administrative accounts. Zero standing access means users don\u2019t have privileges by default. When permissions are provided, it\u2019s at the bare minimum with just enough access to perform the specific task. Users who need to perform a high-risk task must request permissions for access, and once received all activities are logged and auditable. It\u2019s the same principle that defines how Microsoft gives access to its datacenters and reduces the likelihood that a bad actor can gain access to your privileged accounts.<\/p>\n <\/p>\n Figure 4: Privileged access management allows you to enforce zero standing access for your privileged administrative accounts.<\/em><\/p>\n Plan for success with Microsoft FastTrack.<\/strong> FastTrack comes with your subscription at no additional charge. Whether you\u2019re planning your initial rollout, needing to onboard your product, or driving user adoption, FastTrack is your benefit service that is ready to assist you. Get started with FastTrack for Microsoft 365<\/a>.<\/p>\n For more information and guidance on this topic, check out the white paper Maintain compliance with controls and visibility that adhere to global standards<\/a>. You can find additional security resources on Microsoft.com<\/a>.<\/p>\n Coming Soon!<\/strong> Stay tuned for our new series: \u201cTop 10 actions you can take with Microsoft 365 Security.\u201d<\/p>\n More blog posts from the deploying intelligent security scenario series:<\/p>\n Other blog posts from the security deployment series:<\/p>\n This is the last post in our eight-blog series on deploying Intelligent Security scenarios. In this post, we explain how Microsoft 365 security solutions enable you to manage security compliance processes.<\/p>\n","protected":false},"author":61,"featured_media":85795,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3668],"products":[3690,3691,3692],"threat-intelligence":[],"tags":[3825,3809],"coauthors":[1868],"class_list":["post-86737","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-compliance","products-microsoft-defender","products-microsoft-defender-for-cloud","products-microsoft-defender-for-cloud-apps","tag-developers","tag-security-strategies"],"yoast_head":"\nHow can I make it easier to manage compliance processes?<\/h3>\n
How do I assess data protection controls in an ever-changing compliance landscape?<\/h3>\n
\n
\n
\n
How can I protect my data no matter where it lives or travels?<\/h3>\n
How can I help protect privileged accounts from compromise?<\/h3>\n
Want to learn more?<\/h3>\n
\n
\n