Snowflake is continuously expanding our portfolio of Security & Compliance Reports as our customers request them. The following is the current list of reports available to all Customers and Prospects under NDA. Please contact Snowflake and fill out the form on the right by selecting ‘Security Information’ as Inquiry type, or reach out to your Account Team for copies of reports as applicable to your organization or to find out if a particular certification will soon be available.
SOC 2 Type II
The SOC (System and Organization Controls) 2 Type II report is an independent auditor’s attestation of the design and operating effectiveness of the security, availability, and confidentiality controls that Snowflake has had in place during the report’s coverage period. The framework was created by the American Institute of Certified Public Accountants (AICPA). The control criteria for a SOC 2 Type II certification are based on the AICPA Trust Service Principles.
SOC 1 Type II
The SOC (System Organization Controls) 1 Type II report is an independent auditor’s attestation of the design and operating effectiveness of internal controls over financial reporting that Snowflake has had in place during the report’s coverage period. The framework was created by the American Institute of Certified Public Accountants (AICPA).
PCI-DSS
The Payment Card Industry Data Security Standards are a set of requirements prescribed by the Payment Card Industry Security Standards Council. Snowflake is a Level 1 Service Provider compliant under PCI DSS version 3.2.1 and undergoes a third party assessment from a QSA (Qualified Security Assessor) on an annual basis. The AoC (Attestation of Compliance) is available upon request. Snowflake’s PCI DSS compliance allows customers to store, process, or transmit cardholder data utilizing the Snowflake Service. However, there are PCI compliance responsibilities that fall to customers outside of those managed by Snowflake, for a breakdown of these responsibilities customers can request the Snowflake PCI Shared Responsibility Matrix.
HITRUST:
The Health Information Trust Alliance Common Security Framework (HITRUST CSF) serves to unify security controls based on aspects of US federal law (such as HIPAA and HITECH), certain state-specific laws and other industry-standard compliance frameworks into a single comprehensive set of baseline security and privacy controls, built specifically for healthcare needs.
Snowflake participates in the HITRUST Shared Responsibility and Inheritance Program. With the Shared Responsibility Matrix (SRM), customers can now inherit Snowflake’s HITRUST CSF certification provided that customers apply the controls detailed in the HITRUST Alliance website. Customers should download the Snowflake Custom HITRUST Shared Responsibility Matrix to determine HITRUST controls that they are responsible for implementing as part of the shared responsibility model. Customers should refer to the HITRUST webpage for guidance on how to initiate an inheritance request.
CSA Star Level 1
Cloud Security Alliance (CSA) is a not-for-profit organization with a mission to “promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing.” Snowflake participates in the voluntary CSA Security, Trust & Assurance Registry (STAR) Self-Assessment to document our compliance with CSA-published best practices. The completed CSA Consensus Assessments Initiative Questionnaire (CAIQ) is found on the Cloud Security Alliance website.
ISO/IEC 27001, ISO 27017:2015 & ISO 27018:2019
FedRAMP
The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security. Snowflake SnowGov Regions have achieved FedRAMP Authorization.
Department of Defense (DoD) Impact Level 4 (IL4)
The U.S. military creates, stores, and operationalizes massive amounts of sensitive data. Protecting that data is a strategic priority and is the focus of the Department of Defense Impact Levels framework. This framework is used to categorize information systems and data and to indicate the security requirements that data is subject to. Snowflake has received Provisional Authorization (PA) by the Defense Information Systems Agency (DISA) at the U.S. Department of Defense (DoD) to operate at Impact Level 4 (IL4) on AWS GovCloud. Agencies may download Snowflake’s DoD package from eMASS.
StateRAMP
StateRAMP is a 501(c)6 nonprofit that standardizes security requirements for cloud offerings and verifies those cloud offerings for use by state and local governments and public education institutions through independent audits and continuous monitoring. The Snowflake offerings that are working towards or have achieved StateRAMP authorizations are included on the Authorized Product List.
Snowflake maintains 3 deployments that are currently authorized or under review by the StateRAMP PMO for authorization:
TX-RAMP
TX-RAMP provides a standardized approach for security assessment, authorization, and continuous monitoring of cloud computing services used by Texas state agencies. Texas state agencies can use Snowflake to comply with TX-RAMP.
Snowflake currently maintains 4 deployments that are TX-RAMP Authorized:
You can find an up-to-date list of authorized products on the TX-RAMP website.
GxP
GxP data integrity requirements (e.g.; 21 CFR 11) apply to life sciences organizations that produce regulated medical products including pharmaceuticals, medical devices, and mobile medical applications. Snowflake is GxP compatible, allowing life sciences customers to ensure data integrity and build GxP compliant solutions with the help of a secure, validated cloud data platform.
ITAR
International Traffic in Arms Regulations (ITAR) state that non-US persons are prohibited from physically or logically accessing the ITAR environment. A Third-Party Assessment Organization (3PAO) performed an audit to confirm that Snowflake’s Microsoft Azure Government (MAG) and AWS GovCloud deployments provide an environment compliant with ITAR.
IRAP (Protected)
The Infosec Registered Assessors Program, or IRAP, is a program governed by the Australian Signals Directorate (ASD) of the Australian Government which endorses suitably-qualified cyber security professionals to provide relevant services which aim to secure broader industry and Australian Government systems and data. IRAP provides a security framework and an assessment methodology that enables Australian Government agencies and their customers to validate Snowflake’s security control implementations and compliance against those requirements defined within the Australian Government Information Security Manual (ISM) developed by the Australian Signals Directorate (ASD). Snowflake employs IRAP assessors to validate Snowflake Australian systems effectiveness against the Information Security Manual at the Protected level.
CJIS
Snowflake’s SnowGov Regions are ready and able to support customer compliance with the FBI’s Criminal Justice Information Services (CJIS) Security Policy. The CJIS Security Policy provides federal and state agencies with a unified set of standards for the protection and safeguarding of Criminal Justice Information (CJI) in the cloud. Snowflake recognizes the importance of protecting CJI and works collaboratively with customers to satisfy CJIS requirements. Customers interested in learning more about how they can use Snowflake in connection with CJI can learn more here: Criminal Justice Information at Snowflake
IRS Publication 1075
Internal Revenue Service (IRS) Publication 1075 (IRS 1075) outlines the policies, practices, controls and safeguards to be employed by federal, state, and local agencies and contractors handling Federal Tax Information (FTI). Snowflake supports customer compliance with IRS 1075 in our FedRAMP-authorized SnowGov Regions. While there is no official certification for IRS 1075, Snowflake follows IRS Publication 1075 standards and works closely with our customers to meet the IRS’s stringent regulatory requirements for the protection and safeguarding of FTI. For more information, please visit the IRS Safeguards Program webpage on Cloud Computing.
TISAX (Assessment Level) AL 3
Developed by the ENX Association and published by the German Association of the Automotive Industry or VDA, Trusted Information Security Assessment Exchange or TISAX is a certification specifically designed to address the automotive industry’s cybersecurity requirements. TISAX focuses on the secure processing of information from business partners, the protection of prototypes and data protection in accordance with the General Data Protection Regulation (GDPR) for potential business transactions between automobile manufacturers and their service providers or suppliers. TISAX was established in 2017 by VDA and the ENX Association. All organizations involved in business with major German automotive industry partners must obtain a TISAX certification. Assessment Level 3 is required for data with a very high need for protection, such as data classified as confidential or secret. Snowflake’s TISAX is scoped to Information Security and Assessment Level 3.
For more information, please visit the Official TISAX website.
CE+ (Cyber Essentials Plus)
Cyber Essentials Plus (CE+) is a United Kingdom government supported framework that helps protect organizations, regardless of size, against a wide range of the most common cyber attacks. The CE+ certification is required for organizations that plan to bid for central government contracts which involve handling sensitive or personal information or the provision of certain technical products and services. CE+ certification is supported by industry, including the Federation of Small Businesses, the Confederation of British Industry and a number of insurance organizations that offer incentives for CSPs holding this certification. CE+ provides the necessary technical controls and a related assurance framework conducted via an annual external assessment conducted by an accredited assessor.
Achievement of the CE+ certification demonstrates Snowflake’s commitment to mitigate the risk from common Internet-based threats and cyber security best practices.
For more information, please visit the Cyber Essentials website.
You can view the current status of Snowflake’s CE+ certification on the IASME website.
C5 – Cloud Computing Compliance Controls Catalog
The Cloud Computing Compliance Controls Catalog (C5) is an audited standard establishing mandatory baselines for cloud security. The framework was created by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, or BSI). C5 was initially created for government agencies and organizations that work with the government to ensure that security baselines are met by their cloud service providers (CSPs). The private sector has also adopted this framework for evaluation of the security of their CSPs. The framework is based on ISO 27001, CSA, and BSI’s IT-Grundshutz catalogs. The certification can be obtained for either the Basic requirements or Basic + Additional Criteria. Snowflake’s C5 scope currently includes the Basic requirements.
K-FSI Cloud Service Provider Safety Evaluation and the Regulation on Supervision of Electronic Financial Transactions (RSEFT)
The Korean Financial Security Institute (K-FSI) performs the CSP Safety Evaluation in order to evaluate cloud service provider compliance with the Regulation on Supervision of Electronic Financial Transactions (RSEFT) regulation. They support the financial services industry in security assessments and assist in various areas that help create a secure environment for financial institutions. Snowflake’s CSP Safety Evaluation is scoped to SaaS service controls. If customers will store or process unique private information (UPI) or protected credit information (PCI) on Snowflake or safety/reliability of electronic financial transactions are materially impacted by using Snowflake, then customers must review the CSP Safety Evaluation results and perform an analysis of vendor risk and submit documentation to the Financial Supervisory Service prior to utilizing Snowflake for these types of data.
ISO 9001:2015 Quality Management System
ISO 9001 standard sets forth universally acknowledged benchmarks for quality management, shaping the foundation for Snowflake to enhance its operations. Implementing ISO 9001 not only improves overall performance but also enables Snowflake to surpass customer expectations. By adhering to its stringent requirements, Snowflake showcases an unwavering commitment to quality. ISO 9001 guides the establishment, implementation, maintenance, and continuous improvement of a robust Quality Management System (QMS) at Snowflake, solidifying Snowflake’s commitment to delivering exceptional quality.