Question 1

Is Ellucian Company LP SOC 2 compliant?

Accepted Answer

Ellucian Company LP is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Ellucian Company LP ISO 27001 certified?

Accepted Answer

According to Ellucian Company LP's public trust center, Ellucian Company LP is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Ellucian Company LP NIST CSF compliant?

Accepted Answer

According to Ellucian Company LP's public trust center, Ellucian Company LP is NIST CSF compliant. On SOC2C this listing is Listed.

Question 4

Is Ellucian Company LP SOC 2 Type I or Type II?

Accepted Answer

Ellucian Company LP is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 5

Can I use Ellucian Company LP's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Ellucian Company LP's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 6

Is Ellucian Company LP penetration tested?

Accepted Answer

Ellucian Company LP hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 7

Is Ellucian Company LP secure?

Accepted Answer

Security isn't a single yes/no, but Ellucian Company LP is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, NIST CSF. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Ellucian Company LP have a bug bounty or vulnerability disclosure program?

Accepted Answer

Ellucian Company LP hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@ellucian.com or via a /security page.

Question 9

Who are Ellucian Company LP's subprocessors?

Accepted Answer

Ellucian Company LP's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Question 10

Where does Ellucian Company LP host or store data?

Accepted Answer

Ellucian Company LP's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Question 11

Where is Ellucian Company LP's trust center or security page?

Accepted Answer

Ellucian Company LP's trust center is at https://trust.ellucian.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 12

How does Ellucian leverage AI to support higher education institutions and enhance student success?

Accepted Answer

By integrating AI-driven tools into our platforms, Ellucian provides predictive analytics for enrollment and student retention, streamlines administrative processes, and offers personalized support through virtual advisors. These solutions empower institutions to make data-informed decisions and deliver tailored experiences for students, faculty, and staff.

Question 13

Does Ellucian have a comprehensive data governance framework to safeguard the quality, integrity, and security of data used in the development of AI systems?

Accepted Answer

Yes, Ellucian maintains a rigorous data governance process aligned with the NIST AI Risk Management Framework. This includes verifying data reliability, preserving its accuracy throughout the AI system development phases, and implementing robust access controls to prevent unauthorized modifications. We are committed to upholding high-quality data standards at every stage.

Question 14

How does Ellucian verify that its AI systems are securely and resiliently designed, developed, tested, implemented, and maintained to handle unexpected events while continuing to function effectively?

Accepted Answer

Ellucian incorporates security at every development lifecycle stage, including peer code reviews, static and dynamic code analysis, and penetration testing. To ensure resilience, we conduct adversarial testing to evaluate system performance under stress, review incident response processes, and adapt to changes in accuracy caused by unforeseen events. Additionally, we have established procedures for continuous monitoring and rapid system recovery in case of failures.

Question 15

How can I get a summary of Ellucian's external penetration testing?

Accepted Answer

Ellucian products undergo third-party manual and crowd-sourced penetration testing on an annual basis. Executive summaries can be made available for customers upon request. To request an executive summary, please reach out to Sales or your Customer Success Manager.

Question 16

Does Ellucian have an Incident Response Plan?

Accepted Answer

Ellucian's Threat and Incident Management (TIM) team utilizes a fully documented Incident Response Plan, aligned to NIST 800-61 and governed by Ellucian's Information Security Incident Management Standard. Processes and procedures for addressing security incidents align with the US Computer Emergency Readiness Team (US CERT) and the US Department of Justice.

Question 17

Does Ellucian have a Disaster Recovery Plan?

Accepted Answer

The Ellucian Cloud Disaster Recovery Plan (DRP) is a living document that is maintained and updated regularly. The DRP contains the overall recovery plan, the scope of the DRP, critical DR planning assumptions, and other information relevant to a DR scenario. The DRP documents Ellucian's capabilities to restore critical functions within our Cloud environments and is validated as part of the annual SOC 2, Type II audit.

Question 18

Is data encrypted at rest, in transit?

Accepted Answer

All customer data is encrypted in transit over public/untrusted networks with TLS. Customer data and environments are run with 256-bit Advanced Encryption Standard (AES-256) volume level encryption for data at rest.

Question 19

Are your backups securely stored and protected?

Accepted Answer

Backups are stored encrypted and immutable with AWS Backup Vault in AES-256 encrypted volumes.

Question 20

What are your vulnerability remediation timeframes?

Accepted Answer

Ellucian remediates identified vulnerabilities based on their severity, utilizing industry-standard scoring methodologies, such as the Common Vulnerability Scoring System (CVSS),and additional contextual risk factors. Remediation timelines begin upon initial identification or notification, whichever occurs first. Our standard remediation expectations are: • Zero-Day / Named Vulnerabilities (CVSS 10.0 or actively exploited): Remediated or mitigated as soon as a patch or compensating control becomes available. When no immediate fix exists, Ellucian prioritizes detection and alternative risk-reduction measures. • Critical Vulnerabilities (CVSS 9.0–9.9): Remediated or mitigated within 30 calendar days. Accelerated timelines may be required based on risk assessment and security leadership review. • High Vulnerabilities (CVSS 7.0–8.9): Remediated or mitigated within 30 calendar days, typically during a priority maintenance cycle. In certain circumstances, vulnerabilities may require shorter remediation timelines if they are deemed to pose a significant risk to the organization. Where immediate remediation is not feasible, Ellucian documents compensating controls and tracks formal risk exceptions through its established risk management process.

Question 21

Do you have a Responsible Disclosure Policy?

Accepted Answer

We value the assistance of security researchers and others in the community on keeping our systems secure. Ellucian's Responsible Disclosure Policy can be found at https://www.ellucian.com/responsible-disclosure.

Question 22

What type of security testing is performed on your products?

Accepted Answer

Ellucian has deployed enterprise class security platform tooling integrated into its workflows and automation pipelines for continuous security testing throughout the code and build process for Ellucian applications. Manual, peer code review, static & dynamic testing, composition analysis and vulnerability scanning are performed throughout the release process to validate applications and ensure that vulnerabilities and code flaws are remediated prior to any product release.

Question 23

What security frameworks and compliance standards does Ellucian follow for its cloud-based systems?

Accepted Answer

Ellucian's cloud offerings are hosted in the cloud via Amazon Web Services (AWS). Ellucian maintains operational control of customer data and systems, while AWS provides the storage, infrastructure, and the associated physical and environmental controls. These offerings are governed by Ellucian's Information Security Management System (ISMS) which is ISO 27001 certified. Each year, Ellucian retains an independent third-party to conduct its annual Service organization Control (SOC) audits. The SOC 1 report is published semi-annually, while the SOC 2 and SOC 3 reports are published annually. The SOC reports are available for review in Ellucian’s Trust Center. Additionally, Ellucian has mapped our ISMS to NIST 800-171 (a subset of NIST 800-53) and is available upon request.

Ellucian Company LP

About

Compliance & infrastructure

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Octopus Deploy

Ask Ai