Commvault

Commvault is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to Commvault's public trust center, Commvault is ISO 27001 certified. On SOC2C this listing is Listed.

According to Commvault's public trust center, Commvault is FedRAMP compliant. On SOC2C this listing is Listed.

According to Commvault's public trust center, Commvault is NIST CSF compliant. On SOC2C this listing is Listed.

According to Commvault's public trust center, Commvault is PCI DSS compliant. On SOC2C this listing is Listed.

Commvault operates a global data privacy program designed around the principles of the GDPR, serving as a foundation to address privacy requirements across different regions. This program is tailored to meet the specific requirements of local regulations, such as the CCPA/CPRA in California, PIPEDA in Canada, and India’s DPDP Act. Our approach emphasizes strong data governance, transparency, and accountability, incorporating measures such as encryption, access controls, and tools to support data subject rights management. We actively monitor and adapt to changes in privacy laws worldwide, aligning our practices with evolving standards. In addition, our dedicated compliance team works closely with customers to provide guidance and solutions that support their compliance efforts, helping them navigate complex regulatory landscapes while maintaining robust data protection practices. For further information about Commvault's compliance with the GDPR and/or privacy laws, please contact [privacy@commvault.com](mailto:privacy@commvault.com).

Commvault adheres to emerging AI regulatory frameworks, such as the EU AI Act, by prioritizing ethical AI practices and governance. We have established internal policies to assess and mitigate risks associated with AI deployment, including evaluating our systems against high-risk AI criteria outlined in the EU AI Act. Our approach integrates principles from the U.S. Executive Order on AI, which emphasizes transparency, privacy protections, and security, as well as the NIST AI Risk Management Framework (RMF), which guides organizations in managing AI risks through fairness, robustness, and accountability. These frameworks complement our global governance efforts and help ensure our AI solutions remain effective, responsible, and compliant. We also monitor developments in other jurisdictions, such as the UK's principles-based approach to AI regulation and similar initiatives in Canada, aligning our practices with emerging standards worldwide. These measures are integrated into our broader compliance and risk management programs, enabling us to provide AI services that are not only innovative but also aligned with customer expectations and regulatory requirements. For further information about Commvault's compliance with the EU AI Act and how our solutions can assist with your obligations, please contact [compliance@commvault.com](mailto:compliance@commvault.com).

As an essential entity under the EU Network and Information Systems Directive (NIS2), Commvault is committed to aligning with all applicable requirements of the directive while supporting our customers in meeting their cybersecurity obligations. Our global compliance team has proactively reviewed and adapted our existing frameworks to align with NIS2 requirements, including measures for cybersecurity risk management, corporate governance, incident reporting, and business continuity planning. These efforts are supported by our adherence to recognized security standards, such as ISO/IEC 27001:2022, SOC 2 Type 2, and FIPS 140-2 certifications, which provide a robust foundation for compliance. Additionally, our preparations are designed to anticipate and align with related EU regulations, such as the Digital Operational Resilience Act (DORA). We actively monitor guidance from EU member states to ensure our compliance approach remains comprehensive and adaptable as national implementation progresses. As a trusted provider of data protection solutions, we leverage our expertise and tools to protect critical systems from evolving cyber threats while empowering our customers to fulfill their own NIS2 obligations. For further information about Commvault's compliance with NIS2 and how our solutions can assist with your obligations, please contact compliance@commvault.com.

Commvault is committed to meeting the requirements of the Digital Operational Resilience Act (DORA) by maintaining a strong operational resilience framework. This includes implementing advanced monitoring and incident response mechanisms, ensuring continuous availability of critical services, and regularly testing the integrity and reliability of our systems. We adhere to industry standards, such as ISO 27001 and SOC 2, which provide a foundation for resilience against cyber threats. Customers and partners subject to The Digital Operational Resilience Act (DORA) may request to sign the financial sector addendum by emailing [corporatetrustops@commvault.com](mailto:corporatetrustops@commvault.com "mailto:corporatetrustops@commvault.com"). Commvault's Legal Entity Identifier (LEI) code is 65T5VRP62VXG39YFML83. For further information about Commvault's compliance with DORA and how our solutions can assist with your obligations, please contact [compliance@commvault.com](mailto:compliance@commvault.com "mailto:compliance@commvault.com").

Commvault Cloud complies with FedRAMP standards to ensure the highest levels of security and regulatory compliance for our federal customers. To verify the current status of Commvault Cloud’s FedRAMP authorization, you can visit the official FedRAMP Marketplace here: https://marketplace.fedramp.gov/products/FR2115384377.