Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm unclear on how to properly word our security status. The data center our hosted IFD CRM instance is running on has not paid for these audits. However, the Microsoft literature suggests that CRM Online (which is hosted on MS servers) has these certifications and the certifications are growing with each service update.

If our CRM on-premise software is up-to-date, is it safe to say that the CRM on-premise software itself meets the standards outlined in here, but the data center has not been "certified" by an auditor?

  • ISO 27001
  • SAS70 Type II
  • Sarbanes–Oxley
  • Microsoft Dynamics CRM Online Service Safe Harbor
  • ISO 27001
  • SSAE 16 SOC1 (Type II)
  • Data Processing Agreement (DPA)
  • EU Model Clauses
  • Business Associates Agreement - enables a company to be Health Insurance Portability and Accountability Act (HIPAA) compliant
share|improve this question
up vote 2 down vote accepted

This is a tricky question that's not always taken for granted by many vendors (sometimes at their own peril).

Many of the audits listed are validation against management practices and controls. Specifically, ISO 27001, SAS70/SSAE16, SOX 404, and HIPAA are more controls based than technology based (i.e. FIPS 140-2, CC EAL, ICSA Labs product certifications). Fundamentally, when you take a piece of software and move it to another environment, you'd have to have the entire environment re-audited to be able to assert that you have controls in place and that you practice management according to acceptable practices.

With that said, I'd suggest you consult with an attorney/accredited auditor to determine what claim you can make relative to the standards. I say "accredited auditor" because many of the compliance programs require auditors maintain specific qualifications (i.e. ISO auditors have to be "Accredited Registrars," SOX auditors are often accounting firms).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.