Palo Alto Networks, Inc.

“SOC 2+ represents an additional level of certification against an expanded control set, including control alignment against the HIPAA Security Rule, and additionally maps product controls to key controls for GDPR, PCI DSS, and UK NCSC Cloud Security Principles.”

“ISO certification(s) demonstrates to customers that Palo Alto Networks has been independently assessed to have appropriate processes in place to help ensure the security and reliability of sensitive customer data. Certified standards include ISO 27001 (Information Security Management System).”

“Palo Alto Networks holds ISO 27017 certification, which provides guidance on the information security aspects of cloud computing, recommending cloud-specific information security controls and implementation guidance specific to cloud service providers.”

“Palo Alto Networks holds ISO 27018 certification, a code of practice focusing on protection of personal data in the cloud, providing implementation guidance on controls applicable to public cloud PII.”

“Palo Alto Networks holds ISO 27701 certification, which specifies requirements for establishing a privacy information management system (PIMS) as an extension to ISO 27001.”

“Palo Alto Networks holds ISO 42001 certification — the first international management system standard for artificial intelligence. MSECB certificate PDF hosted at paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/technical-certifications/iso-42001.pdf. Confirmed on ISO certifications page listing ISO 42001 among held certs.”

“Palo Alto Networks holds ISO 22301 certification for Business Continuity Management System, supporting its Operational Resilience Program.”

“The Payment Card Industry Data Security Standards (PCI DSS) is a global information security standard designed to prevent fraud through increased control of credit card data. [Listed as held on Palo Alto Networks certifications page. SOC 2+ also maps controls to PCI DSS.]”

“Cortex has achieved FedRAMP High Authorization, marking a significant milestone for government security operations. As the first and only AI-driven SOC platform to secure FedRAMP High Authorization, Cortex empowers federal agencies with industry-leading capabilities. (Authorized January 30, 2025; covers Cortex XDR, XSIAM, XSOAR, Xpanse.)”

“Palo Alto Networks delivers the most comprehensive suite of AI-powered cybersecurity solutions authorized for use in federal networks at the Moderate and High Impact level, with 20+ FedRAMP Authorized solutions across network, cloud and security operations.”

“StateRAMP brings SLED customers together to develop standards for cloud security, educate on best practices, and recognize a common method for verifying the cloud security of service providers. [Listed as held on Palo Alto Networks certifications page.]”

“The CSA STAR (Security, Trust, Assurance, and Risk) Certification is a comprehensive security standard for cloud service providers. It evaluates the provider's security controls based on the Cloud Security Alliance's best practices, ensuring transparency, accountability, and trust in cloud environments. [Listed as held on Palo Alto Networks certifications page.]”

“SOC 2+ includes control alignment against the HIPAA Security Rule. Cortex XSIAM meets FedRAMP High, HIPAA, and ISO requirements from day one, with 35+ security and compliance certifications and prebuilt templates to keep you audit-ready. Note: HIPAA is a regulatory posture, not a standalone certification; explicit BAA availability not confirmed in public documentation.”

“The Data Processing Addendum reflects Palo Alto Networks' pledge to privacy, security, and responsibility for our global customers. Standard Contractual Clauses available for EEA transfers; GDPR user rights (access, portability, rectification, erasure, restriction) documented. SOC 2+ maps controls to GDPR key controls.”

“Cloud Computing Compliance Controls Catalog (C5) is a German Government-backed attestation scheme to help organizations demonstrate operational security against common cyber-attacks when using cloud services. [Listed as held on Palo Alto Networks certifications page.]”

“The Information Security Registered Assessors Program (IRAP) provides a framework for assessing the implementation and effectiveness of an organization's security controls against the Australian government's security requirements. [Listed as held on Palo Alto Networks certifications page.]”

“The Information System Security Management and Assessment Program (ISMAP) is a Japanese government initiative to evaluate and certify the security of cloud service providers. [Listed as held on Palo Alto Networks certifications page.]”

“The Trusted Information Security Assessment Exchange (TISAX) assessment is a European automotive industry-standard information security assessment catalog. [Listed as held on Palo Alto Networks certifications page.]”

“Common Criteria for Information Technology Security Evaluation is an international standard (ISO-IEC 15408) providing assurance that specification, implementation, and evaluation of security measures has been conducted in a rigorous, standardized, and repeatable manner. [Listed as held on Palo Alto Networks certifications page.]”

“The Federal Information Processing Standard (FIPS) 140 is a U.S. Government standard defining security requirements for cryptographic modules protecting sensitive information. [Listed as held on Palo Alto Networks certifications page.]”

“Palo Alto Networks is Esquema Nacional de Seguridad (ENS) High certified. The ENS accreditation scheme has been developed by the Ministry of Finance and Public Administration and the CCN (National Cryptologic Centre).”

“Cyber Essentials Plus is a UK government-backed, industry-supported scheme to help organizations protect themselves against common online threats. [Listed as held on Palo Alto Networks certifications page.]”

“The Canadian Centre for Cyber Security (CCCS) Protected B Medium Integrity Medium Availability (PBMM) assessment signifies an organization's adherence to stringent cybersecurity standards for protecting sensitive government information. [Listed as held on Palo Alto Networks certifications page.]”

“Unit 42 is one of few top-tier incident responders assured at the Enhanced level of the NCSC assured Cyber Incident Response (CIR) scheme, which gives clients confidence in providers that meet its rigorous standards for high quality cyber incident response.”

“Palo Alto Networks has been awarded the CIS Controls Accreditation which confirms the ability to provide CIS Critical Security Controls implementation, auditing, and/or assessment with the assurance that we have met the consistent and rigorous standards of CREST certification.”

“Palo Alto Networks has been certified to the Global Cross-Border Privacy Rules system.”

“Palo Alto Networks has been certified to the Global Privacy Recognition for Processors system.”

“The Top Level Certification from ANSSI (National Agency for Information Systems Security) is a French Government certification for information security products recognized by the French administration and operators of vital importance. [Listed as held on Palo Alto Networks certifications page.]”

“The Department of Defense Information Network Approved Products List (DODIN APL) includes products that have completed cybersecurity and interoperability requirements for sale to the U.S. Department of Defense. [Listed as held on Palo Alto Networks certifications page.]”

“The Commercial Solutions for Classified (CSfC) Program has been established by the U.S. National Security Agency (NSA). It enables organizations to transmit classified information using commercially available technology. [Listed as held on Palo Alto Networks certifications page.]”

“The Agenzia per la Cybersicurezza Nazionale (ACN) certification system is a key part of Italy's cybersecurity framework, designed to ensure the security and reliability of IT products and services used by the public administration and critical national infrastructure. [Listed as held on Palo Alto Networks certifications page.]”