Confidence Through Compliance

Zscaler has achieved the ISO 27001 certificate, following the ISO/IEC 27002: 2013 best practice, attesting that our services are based on internationally recognized best practices for information security management and comprehensive security controls.

Zscaler has achieved the ISO 27001 certificate, including the ISO 27701 extension, attesting that our services are based on internationally recognized best practices for both information security management and privacy information management systems.

ISO/IEC 27018:2014 is a code of practice that focuses on protection of personal data in the cloud. Based on ISO/IEC information security standard 27002, it provides implementation guidance on ISO/IEC 27002 controls applicable to public cloud personally identifiable information (PII).

Zscaler has achieved the ISO 27017 certificate for addressing cloud-specific information security risks and threats referring to the controls from clauses 5-18 in the ISO/IEC 27002: 2013 and ISO/IEC 27001 standards. This certification attests that our services are based on internationally recognized best practices for both cloud service providers and cloud service customers.

The SOC 2, Type II report provides independent validation that our security controls are in accordance with the American Institute of Certified Public Accountants’ applicable Trust Services Principles and Criteria.

Zscaler System and Organization Controls (SOC) Reports are independent third-party examination reports that demonstrate how Zscaler achieves key compliance controls and objectives. The SOC 3 is a public report depicting internal controls over security, availability, processing integrity, and confidentiality. SSAE 18 / ISAE 3402 Type II.

Zscaler has achieved Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Level 2 Certification at the Gold level.

Zscaler is committed to handling our global customers' and partners' data in accordance with security and privacy best practices. We have created this assessment for informational purposes only to help organizations understand how we handle sensitive data with respect to Zscaler services and products.

The Deutsche Cyber-Sicherheitsorganisation (DCSO), the German cybersecurity competence center, was founded in 2015 by the Allianz, BASF, Bayer, and Volkswagen groups to combat organized cybercrime and industrial espionage. The DCSO wants to bring companies, authorities, and institutions together and create a space for trusted data exchange among them. The DCSO Cloud Vendor Assessment Service assesses the security level of cloud service providers.

The Trusted Information Security Assessment Exchange (TISAX®) enables mutual acceptance of information security assessments in the automotive industry and provides a common assessment and exchange mechanism, ensuring secure sharing of sensitive information to partner companies to inspire trust throughout the automotive supply chain. Zscaler has completed a TISAX assessment.

Internal Revenue Service Publication 1075 (“IRS 1075”) sets standards for information security, guidelines, and agreements for protecting US government agencies and their agents that access federal tax information (FTI). While the IRS does not publish an official designation or certification for compliance with Pub 1075, Zscaler supports organizations to protect FTI managed on the Zscaler Platform by aligning our implementations of NIST 800-53 and FedRAMP security controls with the respective IRS Pub 1075 security requirements. Zscaler has worked closely with the IRS to ensure that our GovClouds (US) meet Pub 1075 requirements for storing and processing FTI.

Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) are both JAB-High authorized. What’s more, ZIA is currently the only Secure Access Service Edge (SASE) Trusted Internet Connections (TIC) 3.0 solution that has achieved FedRAMP’s highest authorization.

Government agencies such as the DoD can leverage our market-leading zero trust platforms to take on the user experience and cost challenges of securing cloud-based application access for remote and hybrid users.

Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) have maintained the FedRAMP Moderate level authorization since 2018, allowing federal agencies, DoD commands, and federal contractors to take full advantage of the Zscaler Zero Trust Exchange.

With ZIA and ZPA in hand, agencies can reap the benefits of zero trust security to reduce overhead, streamline operations, and lower costs.

Zscaler Private Access (ZPA) has achieved a Provisional Authorization to Operate (P-ATO) at Impact Level 5 (IL5), as published in the Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG). This allows government agencies and their contractors to use the Zscaler Zero Trust Exchange platform for systems that manage their most sensitive Controlled Unclassified Information (CUI) as well as unclassified National Security Systems (NSSs). Zscaler Internet Access (ZIA) has achieved Authorization to Operate (ATO) at Impact level 2 (IL2). The DoD’s Defense Innovation Unit (DIU) has selected Zscaler to prototype ZPA and ZIA as secure access technologies.

Zscaler is compliant with the Federal Information Processing Standard (FIPS 140-2), meeting NIST requirements for cryptographic modules. View certificates #3154 for Zscaler Mobile Cryptographic Module, #3159 for Zscaler Crypto Module, and #3188 for Zscaler Java Crypto.

Zscaler Private Access (ZPA) and Zscaler Internet Access (ZIA) have been audited by a certified IRAP auditor. The report demonstrates that Zscaler complies with related Australian government standards.

The International Traffic in Arms Regulations (ITAR) report provides for its Zscaler Private Access (ZPA) and Zscaler Internet Access (ZIA) Government Cloud (“GovCloud”) platforms.

Zscaler maintains compliance with Criminal Justice Information Services, ensuring the protection of information as required by CJIS Security Policy.

In recognition and support of the “Electronic and Information Accessibility Standards” defined by Section 508 of the Rehabilitation Act, we publish accessibility self-assessments of Zscaler products using Voluntary Product Accessibility Templates (VPATs). Section 508 was enacted to eliminate barriers in information technology, to make new opportunities available for people with disabilities, and encourage the development of technologies that will help achieve these goals.

Zscaler has achieved the National Cyber Security Centre (NCSC) Cyber Security Essentials certification in the UK. The NCSC certification enables us to be a provider on the Commercial Crown Services contract supporting UK government agencies. The NCSC certification has been required for suppliers to UK government agencies that handle certain types of sensitive and personal information.

Zscaler completed the Trusted Internet Connection (TIC) 3.0 Overlay review with the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). TIC is a federal cybersecurity initiative intended to enhance network and perimeter security across the federal government. The goal of TIC 3.0 is to secure federal data, networks, and boundaries while providing visibility into agency traffic, including cloud communications.

National Institute of Standards and Technology (NIST) Special Publication 800-63C provides requirements to identity providers (IdPs) and relying parties (RPs) of federated identity systems. Federation allows a given IdP to provide authentication attributes and (optionally) subscriber attributes to a number of separately administered RPs through the use of assertions. Similarly, RPs may use more than one IdP.

The National Institute of Standards and Technology (NIST) 800-53 creates standards and guidelines pertaining to information security that are generally applicable to US Federal Information Systems. Zscaler adheres to the Nist 800-53 ensuring sufficient protection of confidentiality, integrity, and availability of information and information systems.

StateRAMP is a cybersecurity program that addresses the needs of procurement and security officials with state and local governments (SLGs) in the United States. Zscaler Internet Access (ZIA) Moderate Cloud has achieved the StateRAMP AUTHORIZED status demonstrating Zscaler’s commitment towards securing state and local government employees and data.

The Texas Risk and Authorization Management Program (TX-RAMP)provides a standardized approach for security assessment, continuous monitoring, and authorization of third-party vendors that process the data of a state agency or public higher education institution in the State of Texas (agencies). Zscaler has achieved the TX-RAMP Level-2 Authorisation that enables Zscaler to operate with confidential/regulated data in moderate or high-impact systems. 

Cloud Computing Compliance Controls Catalog (C5) is a German government-backed attestation scheme introduced in Germany by the Federal Office for Information Security (BSI). C5 helps organizations demonstrate operational security against common cyberattacks when using cloud services within the context of the German government's Security Recommendations for Cloud Providers.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to individually identified health information that relates to an individual’s past, present, or future physical or mental health condition or any other identifying information that can be used to identify the individual. HIPAA was expanded in 2009 by the Health Information Technology for Economic and Clinical Health (HITECH) Act. As stated by the U.S. Department of Health and Human Services, the HIPAA Privacy Rule establishes national standards for the protection of certain health information.

The Payment Card Industry Data Security Standard (PCI DSS) exists to protect against credit card fraud, security threats, and vulnerabilities. PCI is a governing body established in September 2006 as a joint venture by MasterCard, American Express, Visa, JCB International, and Discover Financial Services.

The Australian Prudential Regulation Authority (APRA) is the primary financial regulator in Australia that describes its purpose as the prudential regulation of Australia’s financial institutions. APRA oversees banks, credit unions, building societies, general insurance and reinsurance companies, life insurance, private health insurance, friendly societies, and most members of the superannuation industry promoting the financial safety of institutions and the stability of the Australian financial system. This white paper outlines general information for financial institutions looking to use Zscaler services.

Zscaler is committed to acting ethically and with integrity in all our business relationships and to promoting a workplace and supply chain free from modern slavery and human trafficking, where workers are treated with respect and dignity.

Zscaler runs the world’s largest cloud security platform. The Zscaler cloud operations team strives to ensure the platform's resilience in the face of any natural or manmade disaster or other unplanned emergency.

Supervisory Statement 2/21 (SS 2/21 titled “Outsourcing and third party risk management” (2021) governs financial institutions from the United Kingdom’s activities for supplier management. The Prudential Regulation Authority (PRA) is a part of the Bank of England and is responsible for prudential regulation in the UK. As Zscaler is not a UK financial institution it does not fall directly under the prevue of SS 2/21. The purpose of the attestation report is to provide context for how Zscaler meets the relevant data security requirements within Chapter 7 of the standard.