Red Hat compliance certifications and attestations achieved

For nearly two decades, Red Hat has been helping both public and private entities adapt to changing IT security requirements and concerns. Red Hat achieves a wide range of cybersecurity validations and certifications for our products and services in global markets. Among these are some of the most well-known standards for information security management, safeguarding customer data and cloud security.

Red Hat Product Security recently achieved attestation and re-certification of  SOC 2 Type 2, PCI-DSS, ISO 27001, ISO 27017, and ISO 27018 certifications and attestations for the following:

• OpenShift Dedicated running on AWS
• OpenShift Dedicated running on GCP
• Red Hat OpenShift Service on AWS (ROSA)
• Red Hat OpenShift API Management (RHOAM)
• Red Hat OpenShift Apache Kafka (RHOSAK)
• Red Hat OpenShift Service Registry (RHOSR)
• Red Hat OpenShift Data Science (RHODS)
• Red Hat OpenShift Data Foundation (RHODF)

In addition, we have also achieved SOC 2 Type 2 attestation for the Customer Portal, User Groups Contacts (UGC) and Single Sign On (SSO) applications. 

Achieving these certifications and attestations indicates that our customer data is protected by a robust and compliant security structure that aligns with established  industry standards and showcases our commitment to IT security and privacy. 

Red Hat continues to attain these certifications due to the growing demands of customers, to stay secure and compliance-centric, and to provide assurance that customer’s data is safe.

Why SOC 2 Type 2?

System & Organization Controls (SOC), Trust Service Criteria and SSAE 18, in general, are derived from the COSO framework and principles that give us basic criteria and controls. SOC 2 Type 2 is preferred by vendor organizations as a tool to provide assurance to customers that their business and data is in safe hands.

The process of achieving these certifications and attestations involved extensive assessments and reviews of our security posture and collaboration with Engineering, Legal, Global Privacy, Information Security, Facilities, Human Resources, Infrastructure and Database teams, all working tirelessly to verify that we meet all of the stringent requirements set forth by industry standards.

The Product Security Compliance team would like to thank everyone who helped with this effort. Our team is committed to monitoring our controls and making improvements as necessary to ensure that our products continue to meet and exceed industry standards.

References

• Read about the availability of the customer portal lab
• Compliance Activities and Government Standards
• SOC 1 vs SOC 2 vs SOC 3