TO: AC Transit Board of Directors
FROM: Michael A. Hursh, General Manager
SUBJECT: Security of Microsoft Office 365 Applications
BRIEFING ITEM
RECOMMENDED ACTION(S):
Title
Consider receiving a report on the security of the Microsoft Office 365 cloud applications. [Requested by Director Peeples - 7/22/20].
Body
STRATEGIC IMPORTANCE:
Goal - Safe and Secure Operations
Initiative - Service Quality
The District is committed to maintaining best practices to secure personally identifiable information maintained in the Districts' Systems of records. Allegations have been made that Microsoft might be collecting and selling personal information without permission. This briefing item provides information regarding Microsoft Corporation's data security policy, including an audit of the Microsoft 365 (formerly Office 365) platform, and the security and privacy of customer and staff data in Microsoft 365.
BUDGETARY/FISCAL IMPACT:
There is no fiscal impact associated with this report.
BACKGROUND/RATIONALE:
The District subscribes to Microsoft 365 U.S. Government G3 plan, a cloud-based technology, as its main communication and collaboration application. The subscription includes applications such as Word, Excel, PowerPoint, OneNote, Outlook, Publisher, Access and services such as Exchange, OneDrive, SharePoint and Teams.
In 2014, the District decided to move email from on-premise Microsoft Exchange servers to cloud based Office 365 now known as Microsoft 365. This decision was made because of disk storage limitations, system reliability, server availability, system redundancy and resiliency. In November 2019, the District implemented Microsoft Teams to allow voice and text communications from employees' desktops and mobile devices. In March 2020, the District started moving user and shared documents from the on-premises network servers to cloud based Microsoft OneDrive and SharePoint collaboration platforms. COVID-19 was the driving force behind this decisio...
Click here for full text