FIPS 140-2
Service Scope: VMware SD-WAN
FIPS 140-2 is a cryptographic module validation program, administered by the National Institute of Standards and Technology (NIST), that specifies the security requirements for cryptographic modules.
VMware SD-WAN Edges are FIPS 140-2 validated.
Status: Current
GDPR
Service Scope: VMware SD-WAN
The General Data Protection Regulation (Regulation [EU] 2016/679) is a regulation which will strengthen and unify data privacy rights for persons within the European Union (EU).
VMware can help to provide ubiquitous security from the hybrid cloud to the end user, and across the data lifecycle. We do this by embedding security into the hypervisor and extending that through to the end user, reducing the complexity of managing IT security. This approach gives you a powerful platform on which to build, run or manage any application, anywhere and for creating a more secure environment where you can compete while staying in compliance.
Status: Current
ICSA LABS
Service Scope: VMware SD-WAN Edges
For more than 30 years, ICSA Labs, an independent division of Verizon, has provided certification testing to increase user and enterprise trust in information security products and solutions. ICSA Labs tested and certified the VMware SD-WAN Edge series family by analyzing key firewall aspects including logging, administration, persistence, documentation, security testing, and the product’s ability to remain stateful while properly enforcing a particular security policy.
Status: Current
ISO
Service Scope: VMware SD-WAN
International Organization for Standardization (ISO) is an independent, non-governmental international organization with a membership of 165 national standards bodies. Through its members, it brings together experts to share knowledge and develop voluntary, consensus-based, market relevant international standards that support innovation and provide solutions to global challenges.
VMware has aligned our Cloud Services Information Security Management System (ISMS) to support the following standards:
ISO 27001 - Information Security Management
ISO 27017 - Cloud Specific Information Security Guidance
ISO 27018 - Cloud Specific Standard for Protecting Personally Identifiable Information (PII)
ISO certificate represents the achievement of ISO 27001, 27017 and 27018 standards.
Status: Current
PCI-DSS
Service Scope: VMware SD-WAN
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards that applies globally to entities that store, process, or transmit cardholder data or sensitive authentication data, including merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the PCI Security Standards Council.
Status: Current
SOC 2 TYPE 1
Service Scope: VMware SD-WAN
System and Organizational Controls (SOC) Reports are independent third-party examination reports that demonstrate how VMware meets compliance controls and objectives.
SOC reporting gives our customers and their auditors an understanding of how we manage and support security, operations and compliance at VMware.
The SOC 1 framework reports on internal controls over financial reporting for any service organization.
Status: Current
Contact your Account Representative for additional information related to SOC 1 and SOC 2 reports. Your account representative can assist with access to compliance reports that are not available for immediate download.
SOC 2 TYPE 2
Service Scope: VMware SD-WAN
System and Organizational Controls (SOC) Reports are independent third-party examination reports that demonstrate how VMware meets compliance controls and objectives.
SOC reporting gives our customers and their auditors an understanding of how we manage and support security, operations and compliance at VMware.
The SOC 2 framework reports on controls for a service organization relevant to security, availability, confidentiality, processing integrity, or privacy.
Status: Current
Contact your Account Representative for additional information related to SOC 1 and SOC 2 reports. Your account representative can assist with access to compliance reports that are not available for immediate download.
SOC 2 TYPE 3
Service Scope: VMware SD-WAN
SOC 3 reports are a shorter, less detailed version of SOC 2 reports, designed for a general audience. No NDA is required to review a SOC 3 report.
Status: Current
Contact your Account Representative for additional information related to SOC reports. Your account representative can assist with access to compliance reports that are not available for immediate download.
FedRAMP
High JAB P-ATO
Service Scope: VMware SD-WAN for GovCloud
FedRAMP is a U.S. government program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by the U.S. government. This security compliance framework aims to protect U.S. citizens’ data in the cloud.
Status: 3PAO Assessment (Third Party Assessment Organizations)
The Common Criteria
Service Scope: VMware SD-WAN for GovCloud
The Common Criteria enable an objective evaluation to validate that a particular product or system satisfies a defined set of security requirements. Although the focus of the Common Criteria is evaluation, it presents a standard that should be of interest to those who develop security requirements.
Contact your Account Representative for additional information related to VMware SD-WAN evaluation.
Status: In-Progress
Not all tests are built the same.
When evaluating third-party test results, watch out for:
- Vendors who only participate in sponsored testing, where they control the test
- Vendors who opt out of rigorous prevention tests such as NSS Labs AEP
- Vendors who do not adopt diversity in their testing strategy
- Tests that only exercise a limited portion of the attacker techniques across the entire killchain
Additional Compliance Information
Thank you for your interest in compliance at VMware.
Please contact your VMware Sales Representative if you need additional information about our compliance programs. Your account representative can also assist you in gaining access to compliance reports that are not available for immediate download.