Security compliance and certifications
Sophos continuously monitors evolving regulatory standards around the globe. We incorporate the latest relevant controls into our organization, products, and technology to help our customers meet their compliance obligations.
22 Compliance frameworks
SOC 2
Validates how we manage customer data across security, availability, confidentiality, and privacy.
ACCREDITATION
*Request access to report
ISO 27001:2022
Demonstrates integration of security, privacy, and ongoing improvement into our daily operations.
ACCREDITATION
Sophos certificate (PDF)
Statement of Applicability (PDF)
RESOURCES
Compliance guide (PDF)
ISO 27017:2015
Establishes information security controls that are specific to public cloud environments.
ACCREDITATION
Sophos certificate (PDF)
Statement of Applicability (PDF)
ISO 27018:2019
Establishes information security controls for protecting personally identifiable information (PII) data in public cloud environments.
ACCREDITATION
Sophos certificate (PDF)
Statement of Applicability (PDF)
PCI DSS
Protects credit card data by ensuring secure storage, transmission, and handling of payment info.
ACCREDITATION
*Request access to report
RESOURCES
See how we help
Compliance guide (PDF)
C5 Germany
Established by the German Federal Office for Information Security (BSI) to define a comprehensive set of security and compliance requirements for cloud service providers.
ACCREDITATION
*Request access to report
HIPAA
Protects the privacy and security of medical records and health information in the U.S. healthcare industry.
ACCREDITATION
*Request access to report
GDPR
Ensures data protection and privacy for individuals in the EU and EEA, including data transfers beyond these regions.
CPRA
Expands California consumer privacy rights and protections, with new enforcement through the CPPA.
RESOURCES
Compliance guide (PDF)
NIST SP800-171
Outlines safeguards for controlled unclassified information in non-federal systems.
RESOURCES
Compliance guide (PDF)
HITRUST CSF
Combines multiple standards to manage risk and ensure compliance across the healthcare industry.
RESOURCES
Compliance guide (PDF)
NIS2
Sets stricter cybersecurity rules across the EU for infrastructure and digital service providers.
RESOURCES
See how we help
Read the whitepaper
Compliance guide (PDF)
Digital Operational Resilience Act (DORA 2022/2554)
The EU’s Digital Operational Resilience Act (DORA 2022/2554) regulates financial entities through contractual requirements with technology providers, including cybersecurity.
RESOURCES
See how we help
Whitepaper
SOX
US federal law enacted to improve corporate governance and provide more transparency for investors.
CIPA
Establishes technologic requirements to protect children from harmful content online.
NIS Directive
The first piece of EU-wide legislation on cybersecurity, it provides legal measures to boost the overall level of cybersecurity in the EU.
RESOURCES
Compliance guide (PDF)
POPI
South African data protection law designed to safeguard personal information and establishes rights for individuals to have control over their personal data.
RESOURCES
Compliance guide (PDF)
NIST CSF
Framework based on five core functions to manage cybersecurity risks: identify, protect, detect, respond, and recover.
RESOURCES
Compliance guide (PDF)
NYDFS
The New York State Department of Financial Services (NYDFS) regulates financial institutions and services operating in New York State.
RESOURCES
Compliance guide (PDF)
Ohio DPA
State-level legislation designed to protect Ohioans’ sensitive personal information and establishes cybersecurity standards for organizations to follow.
RESOURCES
Compliance guide (PDF)
ASD
Data sovereignty and security solutions for organizations in Australia that have strict national or local regulatory or policy requirements
RESOURCES
Compliance guide (PDF)
CIS Controls
Set of best practices and cybersecurity requirements developed by the Center of Internet Security (CIS)
*Reports available to interested parties once an NDA has been signed. Please contact your account manager or Sophos sales to request a copy.