Microsoft wants ISO security certification for its Cloud services

External validation could bolster market confidence in hosted services

Microsoft wants to get its suite of hosted messaging and collaboration products certified to the ISO 27001 international information security standard, part of an effort to try and assure customers about the security of its cloud computing services. It comes amid broad and continuing doubts about the ability of cloud vendors in general to properly secure their services.

Google, which has made no secret of its ambitions in the cloud computing arena, is currently working on getting its services certified to the government's Federal Information Security Management Act (FISMA) standards for much the same reason.

It's unclear how much value customers of either company will attach to the certifications, particularly because they were not designed specifically to audit cloud computing environments. Even so, the external validation offered by the standards is likely to put both companies in a better position to sell to the U.S. government market.

Speaking with Computerworld this week, Bill Billings, chief security officer of Microsoft Federal, said the company is currently in the process of taking its Business Productivity Online Suite through the ISO 27011 certification process. The hosted service includes Exchange Online, SharePoint Online, Office Live Meeting and Office Communications Online. He declined to say just when Microsoft hopes to achieve the certification.

The goal is to offer customers, particularly in the government, a higher level of assurance about Microsoft's cloud services than FISMA-certification alone provides, said Teresa Carlson, vice president of Microsoft Federal.

"FISMA is outdated. It is largely a paper-based exercise. We want to take it up a notch" by getting ISO 27011 certification, Carlson said. At the same time, Microsoft is also working to get its cloud services certified to the standards prescribed under FISMA; it hopes to complete the task by year's end, Carlson said.

The ISO 27001 standard is managed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission. To get certified under the standard, Microsoft will need to show that its physical, logical, process and management controls for protecting its suite of cloud services meet a rigorous set of audit criteria.

Though the ISO 27011 standard is widely recognized internationally, it has failed to gain much traction in the U.S., said Chenxi Wang, an analyst with Forrester Research in Cambridge, Mass. "Most U.S. companies don't pay much attention to ISO 27001. They don't know quite what to make of it."

Even so, in the absence of any cloud-specific certification standard, ISO 27001 remains one of the best security benchmarks available. "There's nothing specific to cloud-computing in it. But it has been used in traditional outsourcing for years and is the best standard there is" for information security, she said.

Salesforce.com last year became one of the first vendors of hosted applications to become certified under ISO 27001 standards. It's unclear how much that certification has helped the company acquire new customers, Wang said. But it has certainly played a role in reinforcing Salesforce.com's message about the security and reliability of its products.

News about Microsoft's plans to acquire ISO 2700 certification comes amid persisting concerns about cloud security. The concerns have been fueled by high-profile incidents such as the recent chaotic outage of Microsoft's Sidekick T-Mobile and one in July involving Twitter and Google Apps.

Though the vendors themselves and many analysts have insisted the incidents had nothing to do with cloud security failures, the perception about the cloud being vulnerable to security failures has continued to persist. It is for those reasons that certifications such as ISO 27001and FISMA are important, especially in government, Billing said.

"Within the federal market, it is a cultural issue," Billings said. "This is really about making them feel comfortable about their partnership" with Microsoft.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags MicrosoftGoogleISO 27001

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Bitdefender 2019

This Holiday Season, protect yourself and your loved ones with the best. Buy now for Holiday Savings!

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?