SolarWinds Trust Center

ISO/IEC 27001 is a specification for an information security management system (ISMS), which is a framework for an organization's information risk management processes.

This certification covers all our products, major locations supporting the development, maintenance, operations, support, and services in the following locations:

System and Organization Controls (SOC 2) is a regularly refreshed report that focuses on non-financial reporting controls as they relate to security, availability, and confidentiality of a cloud service.

We currently offer SOC2/Type 2 reports for:

We have made information security and data privacy foundational principles of everything we do, and we recognize the importance of passing regulations to advance information security and data privacy for citizens of the EU and elsewhere in the world. By designing products with privacy and security in mind, we are able to provide you with products that help you meet various aspects of these compliance regimes and to support you in creating a more secure environment.

Learn More

The Federal government is an important customer to SolarWinds, and we’re committed to meeting your product certification needs. You can learn more here:

Learn More

The Sarbanes-Oxley Act (commonly referred to as SOX) establishes a stricter protocol for internal controls that affect financial reporting and security within publicly traded companies. As SolarWinds is a publicly created company, it needs to comply with these regulations.

Learn More

The Common Criteria for Information Technology Services Evaluation (“Common Criteria”) is the ISO/IEC 15408 international standard for Information Technology Security Evaluation. It is the result of an initiative to develop common requirements for an international standard and method for evaluating the security properties of IT products and systems.

SolarWinds Observability Self-Hosted (formerly known as Hybrid Cloud Observability) for Federal Government v2022.4.1 is certified for Common Criteria by the Netherlands Scheme for Certification in the Area of IT Security (NSCIB), an international standard for computer security achieved by national laboratory testing and evaluation for evaluation assurance level (EAL) 2+.

Click here and search “SolarWinds” to review the NSCIB Certificate

The Trade Agreement Act (TAA) is a federal law that requires the U.S. government to procure products and services only from countries that have reciprocal trade agreements with the U.S. The TAA aims to promote fair and open international trade and support U.S. economic and security interests.

Click here to contact our Federal team for a copy of the SolarWinds Trade Agreements Certificate with a complete list of SolarWinds products that have been reviewed and meet the standards for being classified as a U.S.-made or designated country end product, as defined in FAR 52.225-5 entitled “Trade Agreements”.

The Secure Software Development Attestation Form is part of a comprehensive Department of Homeland Security strategy to fortify the software supply chain, promote transparent information-sharing between the public and private sectors, and encourage a proactive community approach to cyber threats to safeguard the Nation’s digital infrastructure.

SolarWinds Secure Software Development Attestation Form is available to be downloaded at the CISA Repository for Software Attestations and Artifacts.

FIPS are standards and guidelines for federal computer systems that are developed by the National Institute of Standards and Technology (NIST) in accordance with the Federal Information Security Management Act (FISMA) and approved by the Secretary of Commerce. The FIPS 140 publications define security requirements for cryptographic modules, including approved security functions.

Click here to receive a complete listing of our products’ use of FIPS-certified cryptographic modules and functions when run on systems configured for FIPS mode.

Section 508 of the Rehabilitation Act of 1973 requires federal agencies to make electronic and information technology accessible to people with disabilities. It requires government agencies to:

An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships.

At SolarWinds, all data in the build environment is encrypted at rest, including build agents, artifact stores, and storage services, and all communication in and out is encrypted in transit when we provide a final SBOM in CycloneDX format to the customer.

Utilizing the SBOM data in conjunction with the VEX, customers can gain a comprehensive picture of their environment, allowing them to make decisions based on the security intelligence provided in the data.

Click here to receive a machine-readable SBOM and VEX