Accelerate your compliance journey Key customer concerns Product value Last updated 1/31/2018 Unlocks creativity Built for teamwork Integrated for simplicity Intelligent security Accelerate your compliance journey General counsel (legal), Chief Compliance Officer, Privacy officer, CISO, LoB executive Buyers Key customer concerns Facing significant penalties for non-compliance Keeping up with enhanced personal privacy rights and changing regulations. For example, the General Data Protection Regulation (GDPR) in the EU provides individuals with more control over their personal data, ensures transparency about the use of data, and requires companies to manage and protect that data Increasing risk related to increasing amounts of complex electronic data Product value Customer value Compliance depends on people, process, and technology– not just products. Here are a few things in the technology to get you started on your journey towards GDPR compliance. Move to a trusted platform The Microsoft cloud offers compliance leadership including ISO 27001/27018, FedRAMP, FISMA, EU Model Clauses, plus the upcoming GDPR requirements Stay up-to-date with compliance standards Microsoft is an industry leader and offers the most comprehensive set of compliance certifications. Machine learning and analytics in Microsoft 365 helps automatically improve data management and protection. A single-stack solution with components that work well together and deliver ongoing innovation. Users are empowered to be compliant without affecting productivity. Assess compliance risk Deliver real-time risk assessment, actionable insights and a simplified compliance process (Compliance Manager) Manage and protect data Run large searches across all mailboxes and folders in Office 365 to identify where sensitive files are located (Content Search, eDiscovery) Automatically classify and protect sensitive data across cloud services and on-premises (Advanced Data Governance†, Azure Information Protection Premium, Azure Information Protection Scanner) Protect users’ identities and devices, and control access to valuable resources based on user risk level (Identity and Access Management-multiple capabilities highlighted in deck) Protect against advanced threats and recover quickly when attacked (Threat Protection- multiple capabilities highlighted in deck) Streamline the reporting process Produce reports that track sensitive data, where it’s been distributed, and whether access has been revoked (Azure Information Protection Premium) DIFFERENTIATOR Microsoft 365 can help customers streamline their compliance (including GDPR) through smart technology, innovation, and collaboration. †Microsoft 365 E5 required. Offer Prioritization Description Compelling Events Microsoft 365 E3 Built-in security and compliance controls across user’s identity, devices, documents, and emails with encryption and access control, a critical foundation in your GDPR journey GDPR Enforcement Begins: May 25, 2018 *Organizations affected by GDPR Offer goods and services to people in the European Union Collect and analyze data tied to EU residents—and it applies no matter where they are in the world Microsoft 365 E5 Builds on E3 and adds advanced information protection, data governance and security tools to help accelerate your GDPR compliance and more effectively meet your data subject and breach notification responsibilities with Microsoft’s industry leading risk and compliance expertise and machine learning Offer guidance Provide peace of mind with controls and visibility for industry-verified conformity with global standards in compliance. Support your organization with enhanced privacy and compliance with the General Data Protection Regulation (GDPR). VDW scenario FOR MICROSOFT PARTNER INTERNAL USE

Accelerate your compliance journey Sales Playcard – Compliance | Partner Version Accelerate your compliance journey Steps to sell Learn more about your customer’s regular processes of how it does things today, plus the risks, and regulations that concern it. Present the Microsoft 365 vision aligned with Trusted Cloud and our commitment to compliance requirements (such as GDPR). Show how the cloud can be a compliance-enabler. Leverage partner expertise to perform a GDPR Assessment and do a Pilot and/or a PoC. Build a business case to show cost savings and risk avoidance. Develop a high quality Customer Success Plan and engage partners. Discovery questions: 3Rs: What risks, regulations, and regular practices most concern you? How do you currently collect, store, and use personal information? DISCOVER ENVISION VALIDATE COMMIT ONBOARD REALIZE VALUE Microsoft 365 Partner Portal How Microsoft Supports GDPR GDPR Webinar Mechanics Practice Development Playbook GTM Resources Get GDPR compliant with Microsoft Beginning Your GDPR Journey Value Discovery Workshop GDPR webinar CIE GDPR Demos GDPR Detailed Assessment Customer Evidence Office 365 Info Protection for GDPR Offers & Incentives* Battlecards FastTrack and FastTrack Assets Compliance in the Trust Center Productivity Library GDPR partners *NOTE: Engage with your Territory Channel Manager for more information Learn what regulations are important to your customer– Find the customer’s concerns (risk, regulations, regular practices) to best position our solutions. For example, if GDPR is primary concern, understand Microsoft’s position and differentiation of services. Discussing how our product capabilities enable our customers is key for driving the right conversations with them. Tell the Trusted Cloud story in your customer’s terms– Lead with Microsoft 365 Conversation Starter: providing customers the most trusted, secure, and productive way to deliver the cloud. Communicate Microsoft’s commitment to compliance and helping them on their journey, focusing on regulations that affect them. Security controls are implemented to address a compliance requirement of some kind: Legal obligations (HIPAA) Regulatory obligations–industry regulation (PCI DSS) Company policies–internal policy Contractual requirements–B2C or B2B Best practices Guide the customer through four key steps– Provide recommended customer guidance in the journey to compliance: Discover, Manage, Protect, and Report.  Align with the right partner– Compliance may require additional support beyond the technology we provide. Learn which other partners are influencing decisions and align on a joint approach. Common regulations by industry – see Compliance offerings Communications & Media Education Financial Services Health MPAA CDSA FERPA SOC 1, 2, and 3 BASEL II GLBA HIPAA / HITECH HITRUST MARS-E Global Regulations ISO 27001 / ISO 27018 CSA STAR Attestation CSA STAR Certification CSA STAR Self-Assessment Hospitality & Transportation Manufacturing Public Sector Retail & Consumer Goods PCI-DSS FDA, CFR Title 21 Part 11 GxP FIPS FedRAMP ITAR Regional Regulations GDPR EU Model Clauses FOR MICROSOFT PARTNER INTERNAL USE