Security and Compliance

SOC2 (Service Organisation Control 2) compliance is an internationally recognised security standard that helps organisations, including cloud service providers, protect customer data and demonstrate compliance with applicable regulations. The standard was developed by the American Institute of Certified Public Accountants (AICPA) and is based on the AICPA's Trust Services Criteria. SOC2 compliance requires organisations to meet specific security and privacy requirements related to data storage, processing, and transmission. Compliance involves the implementation of appropriate technical, physical, and administrative controls that are monitored on an ongoing basis.

ISO/IEC 27001 (International Organisation for Standardisation / International Electrotechnical Commission) is an international standard that outlines the requirements for an information security management system (ISMS). It provides a framework of security controls to help organisations manage their information security risks. It is designed to help protect organisations from security threats, such as data breaches, malicious software, and cyber-attacks. ISO/IEC 27001 is a widely recognised standard for information security management and is accepted by many organisations around the world.

FedRamp (Federal Risk and Authorization Management Programme) is a government-wide programme that provides a standardised approach to security assessment, authorization, and continuous monitoring for cloud products and services. It is designed to help agencies assess and authorise cloud products and services more efficiently and cost-effectively. FedRamp was developed by the General Services Administration (GSA) in collaboration with the Department of Homeland Security (DHS), Department of Defence (DoD), National Institute of Standards and Technology (NIST), and other federal agencies.

Authorization to Operate (ATO) is the security approval required to launch a new IT system in the federal government. Government agencies determine whether to grant an information system authorization to operate for a period of time by evaluating if the security risk is acceptable.
Ivanti has received ATOs from the Air Force, Army, Department of Defence (DoD), Defence Health Agency (DHA), Department of Homeland Security (DHS), National Guard, Navy, Pacific Air Forces (PACAF), United States Special Operations Command (SOCOM), and U.S Strategic Command (STRATCOM).

The NIS 2 Directive, an EU-wide legislation aimed at bolstering network and information system security across member states, establishes a framework for achieving higher levels of security. For organisations striving to comply with these regulations, understanding how cybersecurity controls map to NIS 2 is essential. Ivanti is committed to supporting its customers in their cybersecurity endeavours. For a brief list of ISO 27001 control articles covered by Ivanti, please click here. The complete list can be viewed on our Trust Center.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) (DORA) represents a step change in EU financial regulation, designed to achieve a high common level of digital operational resilience across the EU’s financial sector through the establishment of uniform requirements for financial entities’ cybersecurity measures. Following the introduction of DORA, financial institutions are required to follow stringent rules for safeguarding against ICT-related incidents. DORA introduces guidelines for ICT risk management, incident reporting, operational resilience testing and oversight of ICT third-party risks.

As Common Criteria Compliance is a set of standards that are used to evaluate the security of IT products and services. It provides a common framework for organisations to measure and compare the security features of different IT products and services. The standards are established by an international committee and are used by organisations to evaluate the security of IT products and services they are considering for procurement. The standards cover areas such as authentication, authorization, encryption, audit, and other security-related topics.

508 VPATs (Voluntary Product Accessibility Template) are documents that provide detailed information on how accessible a product or service is to people with disabilities. The documents are developed in accordance with Section 508 of the U.S. Rehabilitation Act of 1973, which requires federal agencies to ensure that their electronic and information technology is accessible to people with disabilities. VPATs are often used by government agencies when procuring software, hardware, and other technology products and services.

As of 2014, the United Kingdom has required suppliers that handle certain kinds sensitive and personal information for the central UK government to obtain Cybersecurity Essentials certification. This certification assures customers that Ivanti has an understanding of our cyber security level that we work to secure our IT against cyber attack. You can search for our up-to-date certification by visiting the IASME site and searching for "Ivanti".

The Australian Information Security Registered Assessors Programme (IRAP) assessment reviews ICT systems against the Australian Government’s strict cyber security standards.

The assessment process uses the security guidance detailed in Australian Attorney-General’s Department’s (AGD) Protective Security Policy Framework (PSPF), the Australian Government Information Security Manual (ISM), produced by the Australian Cyber Security Centre (ACSC), and the Digital Transformation Agency’s (DTA) Secure Cloud Strategy and other cyber security guidance. The assessment covers the modular components of Ivanti ITSM and complementary SaaS services.

The assessment and corresponding report provide an overview of the effectiveness of the implementation of security controls, necessary for authorising systems to hold, process and communicate Australian government information classified up to and including PROTECTED.