What’s New in Version 9 of Microsoft’s DPR

When Microsoft released version 9 of their Data Protection Requirements (DPR) back in October 2023, the new framework contained several important updates, as well as a few brand new requirements, including the addition of new considerations for suppliers processing protected health information (PHI).

As a preferred assessor associated with the SSPA program for several years, we’ve familiarized ourselves with the new version of the DPR and want to offer some insight.

In this article, we’ll briefly overview the DPR before getting into the updates in version 9—including a thorough detailing of the new PHI requirements—so that you can pivot to cover these developments more easily and maintain your relationship with Microsoft.

What is Microsoft’s DPR?

For anyone wanting to do business with Microsoft, you’ll first have to implement the tech giant’s DPR—a set of guidelines designed to help suppliers establish a tailored data protection framework that is meant to:

• Ensure the security, privacy, and compliance of data across Microsoft’s cloud services through protection measures and privacy safeguards
• Standardize data handling through a framework for data classification and required access controls
• Guarantee incident response and management through the establishment of risk management practices and procedures in the event of a data breach
• Provide further support for healthcare data protection through specific guidelines regarding the safeguarding of PHI at rest and when shared

 To achieve all that, the DPR outlines necessary security practices and compliance measures suppliers must implement, including controls around:

• Data encryption
• Access management
• Data retention and deletion
• Third-party management
• Mandatory training and awareness

Once you’ve implemented those measures, suppliers must undergo the Supplier Security and Privacy Assurance (SSPA) process to validate their security efforts and the effectiveness of controls. To ease the experience, Microsoft has made the following documents available:

What’s New in Version 9 of Microsoft’s DPR?

So then, what’s been updated in the latest version of Microsoft’s DPR? Some new additions include (but are not limited to):

• Appropriate sanctions will be applied to employees who fail to comply with requisite privacy and security policies.
• Suppliers must now maintain any data set from Microsoft with reduced identifiability—e.g., de-identified data—in the state in which it was received.
• Suppliers must now conduct vulnerability scans every month and complete a high-level compliance report summarizing the prior 12 months.
• Suppliers must now perform regular patching and updating of anti-virus and anti-malware software.

New Requirements for the Handling of PHI

Amidst those smaller updates, the biggest change to version 9 of the DPR involves the addition of new requirements to account for the protection of PHI.

Not only does v9 now require suppliers to have a Business Associates Agreement in place with Microsoft if they are involved in the processing of protected health information—that is, if they don’t have one already—but these suppliers must also perform HIPAA training, as well as periodic technical and non-technical evaluations of their PHI security.

Aside from mandatory training and awareness, here are some of the other updates in version 9 of the DPR that were made for more robust protection of PHI:

• Enhanced requirements for:
  • Anonymization: When using personal health information in development or test environments, suppliers must make sure that the anonymization techniques they use meet the HIPAA de-identification standard.
  • Training: In addition to the standard security awareness training requirements, Microsoft now also expects suppliers to pay increased attention to security reminders, log-in monitoring, and the safeguarding of passwords for PHI.
• A new focus on the security of PHI:
  • On top of the existing requirements for establishing, implementing, and maintaining an information security program, any suppliers processing PHI must also perform periodic technical and non-technical evaluations of its controls in response to changes to ensure that the supplier’s policies and procedures continue to meet the requirements of the HIPAA Security Rule.
• Improved vendor management:
  • As part of the new, firmer requirements regarding the assessment and management of risks associated with your supply chain, specific clauses related to PHI protection must be included in your agreements with third parties (business associate agreements).

New Carve Out for HITRUST Certification

Given all this, it likely comes as no shock that V9 also promotes enhanced alignment with the HIPAA Privacy and Security Rules, but at the same time, it’s important to note that given these new specific mentions of PHI within the DPR, Microsoft has also updated their SSPA Program Guide to include carve-outs for HITRUST certification.

Previously, carve-outs for the Microsoft DPR were limited to:

• ISO 27001;
• ISO 27701; and
• PCI assessments (though these only sufficed for requirements related to Payment Card Industry assurance).

That is, until now.

If you’re a covered entity or healthcare service provider in the U.S.—which you must be to qualify for this avenue—and you find that your organization falls into supplier profile #8 of the SSPA program guide as per the type(s) of processing you perform for Microsoft, you can now submit your HITRUST certification in lieu of going through any additional independent assessment related to the Microsoft DPR.

What is Microsoft’s DPR V9.1?

In addition to the standard updates that were made to what is now V9 back in 2023, Microsoft issued an emergency update in May 2024—Version 9.1—due to a recent privacy and security incident sparked when a supplier developed a small-scale application for Microsoft but negligently left credentials in the software’s code.

In light of this, Microsoft added requirement #53, which states that suppliers must “ensure that secrets are not embedded or hardcoded in the software at any stage of the development process.” To assist suppliers with proving their compliance, Microsoft also included guidance regarding acceptable potential evidence, which includes but is not limited to:

• Use of a supported and current version of a credential exposure prevention tool such as GitHub Advanced Security (GHAS)) or similar service or tool.

• Assurance that if source or configuration files did mistakenly include secrets, those secrets were documented as revoked upon discovery.

• Assurance that any replacement or secondary credential was not pushed back into code.

• Documentation of any false positives and their remediation.

Moving Forward with the Latest Version of Microsoft’s DPR

While the new requirements outlined above may not cause too much heartburn for existing suppliers, it’ll be important to make sure that you’ve covered them so that you can maintain your organization’s green status in Microsoft’s supplier portal.

If your organization is required to go through an independent assessment of your compliance with the DPR this year, or if you have any inquiries as they relate to the updated requirements, please contact Schellman’s privacy team at sspa@schellman.com.