--- title: Acronis Trust Center description: To ensure that customers can trust our commitment to secure, private, professional product development, Acronis is constantly pursuing confirmation by independent third-party audits on our internal processes and extending the list of our certifications. canonical_url: https://www.acronis.com/en/trust-center/compliance/ locale: en last_updated: 2026-10-27 --- # Acronis Trust Center ## Commitment to compliance To ensure that customers can trust our commitment to secure, private, professional product development, Acronis is constantly pursuing confirmation by independent third-party audits on our internal processes and extending the list of our certifications. ### ISO/IEC 27000 series ISO/IEC 27000 series Acronis implements Information Security Management System (ISMS) in accordance with the ISO/IEC [27001:2022](https://www.iso.org/standard/54534.html) framework for information security, which has become an industry gold standard. Acronis has been certified by the independent third-party auditors of the British Standards Institution ([BSI](https://www.bsigroup.com/)). Acronis is dedicated to continually improving its security posture by enhancing and maturing our ISMS based on latest best practices. Additionally, Acronis has obtained two certifications which extend general ISO 27001 requirements to: Information security controls for cloud services ([ISO 27017:2015](https://www.iso.org/standard/43757.html)); and Protection of personally identifiable information (PII) in cloud ([ISO 27018:2019](https://www.iso.org/standard/76559.html)). * [ISO/IEC 27001:2022 PDF, 0.9 MB](https://staticfiles.acronis.com/downloads/a01c78e334f7cdaf2cbc320c1640f965 "ISO/IEC 27001:2022") * [ISO/IEC 27017:2015 PDF, 0.7 MB](https://staticfiles.acronis.com/downloads/cea2a3de16c59623155a451ae868d778 "ISO/IEC 27017:2015") * [ISO/IEC 27018:2019 PDF, 0.7 MB](https://staticfiles.acronis.com/downloads/59e78b51bf45b4a934b7cffcd0c73dd7 "ISO/IEC 27018:2019") ![Image 2: ISO/IEC 27000 series](https://staticfiles.acronis.com/images/content/c9b8de3e11cb3fb93acad7e059a0c8df.png) ### ISO 9001 ISO 9001 [ISO 9001](https://www.iso.org/standard/62085.html) is an international standard for quality management systems (QMSs). It is part of the [ISO 9000 family of standards](https://www.iso.org/standards/popular/iso-9000-family), addressing various quality management aspects. The ISO 9001 standard provides organizations with a framework to establish and maintain an effective quality management system, ensuring that their products or services consistently meet customers’ requirements and regulatory standards. ISO 9001 emphasizes key principles such as leadership, employee engagement and evidence-based decision making. Being the most widely used quality management standard in the world, Acronis ISO 9001 certification demonstrates our robust commitment to quality and increasing partners' trust. This framework ensures both the consistency of core Acronis processes and services, but also positions us for continuous improvement and adaptability in an ever-evolving business landscape. * [ISO 9001 certificate PDF, 0.9 MB](https://dl.acronis.com/u/rc/Certificate-FS-801213-001-19-Dec-2026.pdf "ISO 9001 certificate") ![Image 3: ISO 9001](https://staticfiles.acronis.com/images/content/6e096ca1a121d6c5713dc6d400a3bb2a.png) ### SOC 2 SOC 2 Acronis has pursued obtaining the System and Organization Controls 2 (SOC 2®) report for service organizations. The standard applies trust services criteria and requirements for organizations, which manage customers’ data. Acronis obtained SOC 2 Type 2 compliance for the services we provide through the Acronis Cyber Cloud platform. Acronis is implementing controls for preserving the security, availability, confidentiality and processing integrity of the information. If you want to get our current SOC 2 report, please [click here*](https://go.acronis.com/soc2-report). _* The link prompts NDA signing via DocuSign. You need to fill in full name and email address of the signee and proceed to the NDA text. After signing, you will get the executed NDA and Acronis SOC report to the email you've entered on the first step. If you have any questions, please contact your account manager or [support](https://support.acronis.com/)._ ![Image 4: SOC 2](https://staticfiles.acronis.com/images/content/c5da6a0438e6130492ff4392a7459ce0.png) ### PCI DSS PCI DSS Acronis has successfully passed an independent audit against the [Payment Card Industry (PCI) Data Security Standards (DSS)](https://www.pcisecuritystandards.org/). The Qualified Security Assessor has validated Acronis compliance with the PCI DSS 4.0 for Level 1 Service Provider. The current scope of the attestation covers Acronis Cyber Platform operating in [Compliance mode](https://www.acronis.com/support/documentation/CyberProtectionService/index.html#compliance-mode.html) in several data centers in U.S. and EMEA. * [Acronis PCI DSS AOC report PDF, 0.4 MB](https://staticfiles.acronis.com/downloads/ead25c0abbab96208082f794fbf63f63 "Acronis PCI DSS AOC report") ![Image 5: PCI DSS](https://staticfiles.acronis.com/images/content/8a7ca363295a4a5add0797b5bbe33f38.png) ### IEC 62443-4-1 IEC 62443-4-1 **IEC 62443-4-1: Secure Product Development Lifecycle (SSDLC)** Acronis has achieved certification for its secure development lifecycle in accordance with **IEC 62443-4-1**, an international standard originally developed for industrial automation and control systems (IACS/OT), but increasingly recognized as a best practice for secure software development in IT environments as well. With this certification, Acronis confirms the application of rigorous security practices throughout the entire product development lifecycle — from design and implementation to testing and maintenance — ensuring that security is embedded by design. The scope of this certification includes **Acronis Cyber Protect products**, covering both **Cloud** and **supported on-premises versions**. * [Acronis IEC 62443-4-1 certificate PDF, 0.8 MB](https://staticfiles.acronis.com/downloads/caca1ea2e00c74fcb6130c4434a3185a "Acronis IEC 62443-4-1 certificate") ![Image 6: IEC 62443-4-1](https://staticfiles.acronis.com/images/content/19a3099598aa4f055c551ec16cdfccc4.png) ### IT-Grundschutz IT-Grundschutz IT-Grundschutz (translated as IT Baseline Protection) is a comprehensive framework developed by the German Federal Office for Information Security (BSI) to help organizations implement effective information security management. Acronis has developed a security concept based on the BSI IT-Grundschutz methodology, ensuring a robust and systematic approach to information security. Our compliance is built upon the foundation of our ISO/IEC 27001 certification, which demonstrates our commitment to international standards for information security management. By integrating IT-Grundschutz principles, we have strengthened our security posture through: * Comprehensive risk analysis and protection needs assessment. * Implementation of technical, organizational and personnel safeguards. * Continuous improvement and monitoring of security measures. ![Image 7: IT-Grundschutz](https://staticfiles.acronis.com/images/content/c50d97df65aec382e05c44ec799782ff.png) ### Cyber Essentials Cyber Essentials Cyber Essentials is a government-backed scheme that is applicable to organizations operating in the United Kingdom. It includes a set of basic technical controls which organizations have to implement to protect themselves against common online security threats. Acronis successfully earned its Cyber Essentials certificate. You can additionally check the certificate at [https://iasme.co.uk/cyber-essentials/ncsc-certificate-search/](https://iasme.co.uk/cyber-essentials/ncsc-certificate-search/). * [Acronis Cyber Essentials certificate PDF, 284 KB](https://staticfiles.acronis.com/downloads/302b722992afae932befcd22abb0173a "Acronis Cyber Essentials certificate") ![Image 8: Cyber Essentials](https://staticfiles.acronis.com/images/content/9f8d2db4ed8356055d6e654ec8a9ae2c.png) ### ENS ENS [The Esquema Nacional de Seguridad (ENS)](https://ens.ccn.cni.es/en/) is a cybersecurity framework established by the Spanish government to ensure the protection of sensitive information and critical infrastructure within public administrations. It defines a set of security measures and guidelines that organizations must adhere to in order to mitigate cyberthreats and safeguard data. ENS certification is required for public administrations' suppliers to demonstrate their compliance with established security standards and ensure the integrity, confidentiality, availability, authenticity and traceability of information systems. Acronis has successfully passed an independent third-party audit to achieve ENS certification for the High / Alta level of security, ensuring robust protection measures are in place. Compliance with ENS aligns with the objectives of the NIS 2 Directive, contributing to the overall cybersecurity resilience of Spain and the European Union. * [Acronis Cyber Platform – NIS 2 briefing for MSPs PDF, 1.7 MB](https://dl.acronis.com/u/rc/White-paper-Acronis-Cyber-Protect-Cloud-NIS-2-Directive-EN-EU-240228.pdf "Acronis Cyber Platform – NIS 2 briefing for MSPs") ![Image 9: Acronis](https://staticfiles.acronis.com/images/content/a4f64dd70c17e8349137317a33744587.png) [Acronis ENS certificate](https://staticfiles.acronis.com/downloads/e2015d8ab14a62141fdbc7c2aa65382e) ### Cloud Italia Cloud Italia [The Cloud Italia qualification process](https://cloud.italia.it/), managed by [ACN, Agenzia Cybersicurezza Nazionale (National Cybersecurity Agency)](https://www.acn.gov.it/), plays a vital role in ensuring the security and reliability of cloud services offered to Italy's public sector. Aligned with the NIS 2 Directive, it imposes stringent criteria on providers, including compliance with data protection regulations and cybersecurity standards. By meeting these requirements, providers contribute to the resilience of critical digital infrastructure and services. The qualification process fosters trust in cloud solutions, facilitating their adoption across government agencies and organizations. Acronis, having successfully passed through the qualification process, is present in the [Cloud Italia Marketplace](https://www.acn.gov.it/portale/w/sa-3698), offering trusted cloud services. This not only modernizes public services, but also enhances digital transformation and cybersecurity cooperation at the European level, in line with broader E.U. directives and initiatives. ![Image 10: Cloud Italia](https://staticfiles.acronis.com/images/content/01794404f0fa1a72da99fb37ebbab7da.png) ### FIPS 140-2 FIPS 140-2 Acronis Cyber Platform includes FIPS 140-2–validated encryption libraries, ensuring MSPs meet strict compliance requirements set by government agencies, healthcare providers, financial institutions, and other security-conscious customers. This native support safeguards sensitive data using proven encryption methods, aligning with demanding regulations such as FISMA, CJIS, and HIPAA. By adopting Acronis Cyber Platform with FIPS 140-2 compliance, you gain a competitive advantage in regulated markets and confidently provide secure, compliant cyber protection without adding extra complexity or cost ![Image 11: FIPS 140-2](https://staticfiles.acronis.com/images/content/303e63b879f07d697c1c1685d717df44.png) ### UAE IAR UAE IAR The UAE Information Assurance Regulation, issued by the UAE Telecommunication and Digital Government Regulatory Authority, establishes a comprehensive framework for safeguarding the nation's information and digital infrastructure. UAE IAR sets out management and technical information security controls and best practices for entities to ensure the confidentiality, integrity and availability of information assets. Acronis has successfully passed an independent third-party audit against UAE IA Regulation for the services we provide through the Acronis Cyber Cloud platform. If you wish to receive our UAE IAR report, please contact your account manager or [support](https://support.acronis.com/). ![Image 12: UAE IAR](https://staticfiles.acronis.com/images/content/cd80cd9d35e00bd60bdf70c7c4b8c757.png) ### HIPAA HIPAA The [Health Insurance Portability and Accountability Act of 1996 (HIPAA)](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html) and the subsequent [Health Information Technology for Economic and Clinical (HITECH) Act of 2009](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/omnibus-hipaa-rulemaking/index.html) are US regulations aimed at protecting the privacy and security of medical information. The HIPAA rules requirements have emerged into greater prominence in recent times with the proliferation of health data breaches caused by cyberattacks and ransomware attacks on health insurers and providers. There is no official, legally recognized HIPAA compliance certification process or accreditation. HIPAA compliance resides on an ongoing commitment, which includes the implementation of different administrative, technical, and physical safeguards. Acronis supports multiple services (or products). Individual [Acronis service functions and HIPAA compliance status](https://kb.acronis.com/hipaa) can vary depending on the service and data center used. Please speak with your account manager to clarify the compliance status of particular services and data centers. ![Image 13: HIPAA](https://staticfiles.acronis.com/images/content/29dd4779586fdbcdaf6d5916c820ff7e.png) ### PHIPA PHIPA There are several regulations that protect health information in Canada. As on the federal level, [the Personal Information Protection and Electronic Documents Act (PIPEDA)](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/) applies to health care data, and [the Personal Health Information Protection Act (PHIPA)](https://www.ontario.ca/laws/statute/04p03) is Ontario's health-specific privacy legislation that has established general principles for the collection, use and disclosure of personal health information (PHI). PHIPA has no officially recognized certification or accreditation process; nevertheless, Acronis has assessed its data processing practices against PHIPA requirements. Note that using Acronis products in a PHIPA-compliant way is the shared responsibility of Acronis and its customers. Please read Acronis PHIPA white paper below to check the shared responsibilities model we use to ensure fulfillment of PHIPA obligations. * [PHIPA Whitepaper PDF, 0.5 MB](https://staticfiles.acronis.com/downloads/ffe0f2fcf6ce576ef758988d52eb5354 "PHIPA Whitepaper") ![Image 14: PHIPA](https://staticfiles.acronis.com/images/content/15000770804bd83895e6e606263fde2c.png) ### HDS HDS Acronis is HDS certified for its cloud services in France and Germany. Compliance with HDS requirements demonstrates that we provide a framework for technical and governance measures to secure and protect Personal Health Data, as governed by the French law. The HDS certification from an independent third-party auditor validated that Acronis ensures data confidentiality, integrity and availability to its customers and partners. The following activities are included in the certification scope: * The provision and maintenance in operational condition of physical sites for hosting the hardware infrastructure of the information system used to process the Personal Health Data. * The provision and maintenance in operational condition of the hardware infrastructure of the information system used to process the Personal Health Data. * The provision and maintenance in operational condition of the virtual infrastructure of the information system used to process the Personal Health Data. * The provision and maintenance in operational condition of the platform for hosting information system applications. * The management and operation of the information system containing the Personal Health Data. * Backing up Personal Health Data. Personal Health Data protected by the strong encryption. Acronis does not transfer any Personal Health Data to a country outside the European Economic Area. **Note**: If you plan to use Acronis products in accordance with HDS requirements and you need to sign an HDS Addendum, please contact your account manager. * [Acronis HDS certificate PDF, 0.8 MB](https://staticfiles.acronis.com/downloads/077db65e9cb5760c32a948737bc90213 "Acronis HDS certificate") ![Image 15: HDS](https://staticfiles.acronis.com/images/content/ff09f42bb17863571af7668f567855ae.png) ### NEN 7510 NEN 7510 NEN 7510 is the official Dutch standard for setting up and implementing information security management systems for organizations working with patients’ data in the health care industry. The standard became mandatory for health care organizations in the Netherlands in 2018, offering further interpretation and accountability of the General Data Protection Regulation (GDPR). NEN 7510 is based on ISO 27001:2022; however, it introduces three additional controls and some specific compliance measures that supplement the ISO standard. Acronis itself is not subject to NEN 7510, but by being ISO 27001 certified, we implement most of the applicable controls. Also, Acronis products can help Dutch health care organizations with their NEN 7510 compliance requirements. ![Image 16: NEN 7510](https://staticfiles.acronis.com/images/content/c9f838fc4c0cb4c46151a44d84964c3c.png) ### 2G3M 2G3M In Japan, systems that process and / or store personally identifiable medical information (Medical PII) must adhere to two key guidelines: * The Guideline for Safety Management of Medical Information Systems by the Ministry of Health, Labor and Welfare (MHLW). * The Safety Management Guideline for Information Systems and Service Providers Handling Medical Information by the Ministry of Economy Trade & Industry (METI) and the Ministry of Internal Affairs and Communications (MIC). Together, these guidelines are commonly known as the 'Two Guidelines from Three Ministries' (2G3M). Compliance with the 2G3M standards in Japan is primarily driven by voluntary self-regulation among health care providers, although serious violations may result in administrative penalties being incurred. Acronis is dedicated to supporting customers in fulfilling their obligations under 2G3M. Our 2G3M white paper and the associated controls matrix describe how Acronis complies with 2G3M requirements and delineate how customers can use Acronis Cyber Platform to fulfill their own obligations in handling medical information according to Japanese government requirements. * [Acronis 2G3M Guidelines (English)PDF, 6.0 MB](https://staticfiles.acronis.com/downloads/56cf491539ee937739239a31f2a6b645 "Acronis 2G3M Guidelines (English)") * [Acronis 2G3M White paper (English)PDF, 3.0 MB](https://staticfiles.acronis.com/downloads/70a84f07cda76add1af2cd83e4528ab6 "Acronis 2G3M White paper (English)") * [Acronis 2G3M Guidelines (Japanese)PDF, 6.0 MB](https://staticfiles.acronis.com/downloads/1619ef572ad63f60c525d6cb9243171d "Acronis 2G3M Guidelines (Japanese)") * [Acronis 2G3M White paper (Japanese)PDF, 3.0 MB](https://staticfiles.acronis.com/downloads/3afd1ded4fe0bdcb81a2dcd4ca731d13 "Acronis 2G3M White paper (Japanese)") ![Image 17: 2G3M](https://staticfiles.acronis.com/images/content/12caaafc4336584badb4d6421a5ed83b.png) ### DPF Data Privacy Framework Program (DPF) [The Data Privacy Framework (DPF) Program](https://www.dataprivacyframework.gov/) is a personal data transfer mechanism, recognized by the European Commission as providing [adequate level of protection](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). The DPF was developed to facilitate transatlantic commerce by providing U.S. organizations with a means for personal data transfers to the United States from the European Union / European Economic Area, the United Kingdom (and Gibraltar) and Switzerland, that are consistent with EU, U.K., and Swiss law. The DPF consists of: * The EU–U.S. Data Privacy Framework (EU–U.S. DPF). * The U.K. Extension to the EU–US Data Privacy Framework (U.K. Extension to the EU–U.S. DPF). * The Swiss–U.S. Data Privacy Framework (Swiss–U.S. DPF). Acronis has self-certified its compliance with all DPF principles to the U.S. Department of Commerce. You can see the full profile of Acronis under DPF Active Participants’ list at: [https://www.dataprivacyframework.gov/list](https://www.dataprivacyframework.gov/list). ![Image 18: DPF](https://staticfiles.acronis.com/images/content/849a0f05abcbdbb89c91a2bd3fdebf32.png) ### STAR Level 2 STAR Level 2 **The Cloud Security Alliance (CSA) Security Trust, Assurance and Risk (STAR) Program** is the industry’s most powerful program for security assurance in the cloud. Since May 2020, Acronis has been listed as a **Trusted Cloud Provider**, complying with **CSA STAR Level 1** through the submission of the **Consensus Assessments Initiative Questionnaire (CAIQ)**, which provides a detailed self-assessment of Acronis Cyber Platform security controls. In addition, **CSA STAR Level 2 Certification** has been obtained through an independent third-party audit based on the **Cloud Controls Matrix (CCM)** and aligned with **ISO/IEC 27001**, validating the effectiveness of our cloud-specific security practices. The **CAIQ questionnaire, Level 1 attestation** and **Level 2 certification** are publicly available in the [CSA STAR Registry](https://cloudsecurityalliance.org/star/registry/acronis-international-gmbh/services/acronis-cyber-protect-cloud). * [Acronis CSA STAR certification PDF, 1.5 MB](https://staticfiles.acronis.com/downloads/85414a25da2f15b03dbed19841dc998e "Acronis CSA STAR certification") ![Image 19: Cloud Security Alliance (CSA)](https://staticfiles.acronis.com/images/content/82231b57d6c5f9da30594b6653fabd8e.png) ## Resources * [White paper Acronis Cloud Data Centers ‒ a Primer on Security, Privacy, and Compliance](https://www.acronis.com/en/resource-center/resource/355/) * [White paper Comply with HIPAA Using Acronis Solutions](https://www.acronis.com/en/resource-center/resource/383/) * [White paper Comply with PHIPA Using Acronis Solutions](https://staticfiles.acronis.com/downloads/ffe0f2fcf6ce576ef758988d52eb5354) * [White paper Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) – NIS 2 briefing for 21,000+ MSPs](https://www.acronis.com/en/resource-center/resource/nis-2-directive-on-cybersecurity-for-msps/) * [White paper Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) – NIS 2 briefing for 750 000 Businesses](https://www.acronis.com/en/resource-center/resource/nis-2-briefing-for-businesses/) * [White paper BCDR and Compliance Ecosystem](https://www.acronis.com/en/resource-center/resource/711/) Cyber threats insights Technical details into the latest malware, vulnerabilities, and cyberattacks [Explore](https://www.acronis.com/en/tru/ "Explore") Latest news [05 May 2026 MSP cyber protection news, May 5, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-may-5-2026/) [27 April 2026 MSP cyber protection news, April 27, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-april-27-2026/) [20 April 2026 MSP cyber protection news, April 20, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-april-20-2026/) [16 March 2026 MSP cybersecurity news digest, March 16, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-march-16-2026/)