Acronis Trust Center

Acronis operates an ISMS aligned with ISO/IEC 27001:2022 and certified by independent third-party auditors. We continuously improve our security posture in line with current best practices.

Acronis is also certified against ISO 27017:2015 for cloud-specific security controls and ISO 27018:2019 for protection of personally identifiable information in public cloud environments.

ISO 9001 is an international standard for quality management systems and part of the ISO 9000 family. It emphasizes leadership, employee engagement and evidence-based decision-making.

Acronis’ ISO 9001 certification reflects our commitment to quality, consistent processes and continuous improvement.

Acronis achieved SOC 2 Type 2 compliance for Acronis Cyber Platform services. The report applies trust services criteria for organizations that manage customer data and covers controls for security, availability, confidentiality and processing integrity.

The link opens an NDA for signature via DocuSign. Once signed, the executed NDA and the Acronis SOC report will be sent to the email address entered in the first step. For questions, contact your account manager or support.

The Cloud Security Alliance (CSA) Security Trust, Assurance and Risk (STAR) Program is a leading cloud security assurance program.

Since May 2020, Acronis has been listed as a Trusted Cloud Provider. CSA STAR Level 1 was achieved through the CAIQ self-assessment of Acronis Cyber Platform security controls, and CSA STAR Level 2 through an independent audit based on the CCM and aligned with ISO/IEC 27001.

Acronis is certified to IEC 62443-4-1: Secure Product Development Lifecycle (SSDLC) for its secure development lifecycle, a standard increasingly recognized as a best practice for secure software development.

This certification confirms that Acronis applies security practices throughout the product lifecycle, from design and development to testing and maintenance.

The Data Privacy Framework (DPF) Program is a personal data transfer mechanism recognized by the European Commission as providing an adequate level of protection for transfers from the EU/EEA, the U.K. and Switzerland to the United States, consistent with EU, U.K. and Swiss law.

Acronis has self-certified compliance with the DPF principles to the U.S. Department of Commerce.

Acronis passed an independent audit against the Payment Card Industry (PCI) Data Security Standard (PCI DSS). A Qualified Security Assessor validated Acronis compliance with PCI DSS 4.0 as a Level 1 Service Provider.

This certification confirms that Acronis applies security controls to support PCI DSS compliance.

IT-Grundschutz (IT Baseline Protection) is a framework developed by the German Federal Office for Information Security (BSI) to support effective information security management.

Acronis has developed a security concept based on BSI IT-Grundschutz and supported by ISO/IEC 27001 certification. It strengthens our security posture through risk analysis, technical, organizational and personnel safeguards, and continuous improvement.

Cyber Essentials is a U.K. government-backed certification scheme based on basic technical controls to help organizations protect against common online threats.

Acronis has earned its Cyber Essentials certificate, demonstrating implementation of these baseline security measures.

The Esquema Nacional de Seguridad (ENS) is a Spanish government cybersecurity framework for protecting sensitive information and critical infrastructure in public administrations.

Acronis achieved ENS certification at the High / Alta level through an independent third-party audit. Compliance with ENS aligns with the objectives of the NIS 2 Directive and supports cybersecurity resilience in Spain and the E.U.

The Cloud Italia qualification process, managed by ACN, Agenzia Cybersicurezza Nazionale (National Cybersecurity Agency), helps ensure the security and reliability of cloud services offered to Italy’s public sector. Aligned with the NIS 2 Directive, it sets requirements for providers.

Acronis has successfully passed the qualification process and is listed in the Cloud Italia Marketplace.

Independent third-party HDS certification confirms that Acronis applies technical and governance measures under French law to protect Personal Health Data and ensure its confidentiality, integrity and availability.

If you plan to use Acronis products in compliance with HDS requirements, an HDS Addendum is required. Personal Health Data is strongly encrypted and is not transferred outside the European Economic Area.

NEN 7510 is the Dutch healthcare information security standard. Mandatory in the Netherlands since 2018 and based on ISO 27001:2022, it adds healthcare-specific controls and compliance measures.

Although Acronis is not directly subject to NEN 7510, our ISO 27001 certification supports most applicable controls, and our products can help Dutch healthcare organizations meet NEN 7510 requirements.

The UAE Information Assurance Regulation (UAE IAR), issued by the UAE Telecommunication and Digital Government Regulatory Authority, establishes information security controls and best practices to protect information assets and digital infrastructure.

Acronis passed an independent third-party audit against the UAE IA Regulation for Acronis Cyber Platform services.

Acronis Cyber Platform includes FIPS 140-2–validated encryption libraries to help MSPs meet compliance requirements in regulated industries. This native support protects sensitive data and aligns with regulations such as FISMA, CJIS and HIPAA.

It helps MSPs deliver secure, compliant cyber protection in regulated markets without added complexity or cost.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act are U.S. laws that protect the privacy and security of medical information, with growing relevance due to the rise in healthcare cyberattacks and data breaches.

There is no official HIPAA certification; compliance is ongoing and supported by administrative, technical and physical safeguards. Use of Acronis products in compliance with HIPAA requirements requires a Business Associate Agreement (BAA).

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies federally, while the Personal Health Information Protection Act (PHIPA) is Ontario’s health-specific privacy law for personal health information (PHI).

PHIPA has no formal certification process, but Acronis has assessed its data processing practices against PHIPA requirements. PHIPA-compliant use of Acronis products is a shared responsibility between Acronis and customers.

In Japan, systems that process or store personally identifiable medical information (medical PII) must follow two safety management guidelines issued by the Ministry of Health, Labour and Welfare (MHLW), the Ministry of Economy, Trade and Industry (METI) and the Ministry of Internal Affairs and Communications (MIC), together known as the ‘Two Guidelines from Three Ministries’ (2G3M).

Compliance with 2G3M is primarily based on voluntary self-regulation by healthcare providers, although serious violations may lead to administrative penalties.