Information Security Compliance

Overview

Payment Card Industry Data Security Standard (PCI DSS) compliance is required for any business that stores, processes, or transmits payment card data. Developed by the major credit card companies, the PCI DSS defines measures for ensuring data protection and consistent security processes and procedures around online financial transactions. As formulated by the PCI Security Standards Council, the mandate of PCI DSS compliance includes:

• Developing and maintaining a security policy that covers all aspects of the business
• Installing firewalls to protect data
• Encrypting cardholder data that is transmitted over public networks
• Using antivirus software and updating it regularly
• Establishing strong passwords and other cybersecurity protocols
• Enforcing rigid access controls and monitoring access to account data

For large merchants and service providers that process high volumes of online financial transactions, PCI DSS compliance is enforced by annual validations performed by an independent Qualified Security Assessor (QSA). 

Resources

PCI Security

Akamai Certification

Akamai’s Attestation of Compliance (AoC) serves as evidence for our customers that our in-scope services are compliant with the PCI DSS v3.2.1 security standard.

In connection with our PCI DSS compliance, Akamai performs a quarterly third-party external penetration test of the systems included in the scope of our assessment. Results of these quarterly penetration tests, and compliance documentation and/or certification, are available for customers under nondisclosure agreement (NDA).

Downloads / Links

• Attestation of Compliance
• Responsibility Matrix
• Responsibility Matrix (Cloud Computing Services)
• Akamai’s listing on the Visa Global Registry of Service Providers
• List of Mastercard Compliant Service Providers (including Akamai)

Applicable Akamai Services

• Secure CDN with Enhanced TLS (Secure CDN), and the services running on it
• Edge Delivery products such as Ion, API Acceleration, and Adaptive Media Delivery, when running on the Secure CDN
• EdgeWorkers, when running on the Secure CDN
• mPulse digital performance management services
• App and API security products such as App & API Protector (including the Malware Protection add-on), Account Protector, Kona Site Defender, and Bot Manager (Standard and Premier), when running on the Secure CDN
• In-browser protections, including Client-side Protection & Compliance and Audience Hijacking Protector
• Secure Internet Access Enterprise (formerly known as Enterprise Threat Protector)
• Akamai MFA
• The following cloud computing solutions: Dedicated CPU, Shared CPU, and High Memory

Q&A

Is Akamai PCI DSS Certified?

Yes, Akamai is certified as a PCI DSS Level 1 Service Provider, the highest level of assessment available. The PCI DSS Attestation of Compliance and Responsibility Matrices are publicly available at the links above.

If my website is using Akamai, how can I be sure that it is PCI DSS compliant?

Customers are responsible for their own PCI DSS certification and should engage a Qualified Security Assessor (QSA) to validate their controls and obtain certification. Customers and their QSAs may rely on Akamai’s Attestation of Compliance for the portion of their cardholder data environment to use Akamai’s PCI DSS compliant services. Akamai’s PCI DSS Responsibility Matrices (see links above) spell out the responsibilities of Akamai and our customers with respect to each of the PCI DSS requirements. Your account team may provide you with our PCI DSS Customer Configuration Guide, which provides more details. 

Is Akamai listed on the Visa Global Registry of Service Providers and the Mastercard Compliant Service Provider List?
Yes. Akamai is listed on the lists provided by both Visa and Mastercard. This shows that Akamai has met all applicable program requirements of these major payment card companies.  

Can I review an executive summary of Akamai’s quarterly Approved Scanning Vendor (ASV) vulnerability scans and external penetration tests?
Yes. Your account team may provide this information subject to standard nondisclosure agreement (NDA).

Overview

SOC (System and Organization Controls) is a security standard promulgated by the American Institute of Certified Public Accountants (AICPA) that reports on controls that directly relate to the security, availability, processing integrity, confidentiality, and privacy at a service organization.

Resources

AICPA SOC Suite of Services

Akamai Certification

Akamai receives annual SOC 2 Type 2 reports, which demonstrate that our security controls are continuously audited over the course of the year.

Applicable Akamai Services

Akamai’s primary SOC 2 Type 2 report covers the Security and Availability Trust Services Criteria. The Akamai services in scope for this report are as follows:

• Secure CDN with Enhanced TLS
• Prolexic DDoS mitigation services
• Akamai Control Center customer portal
• Additional systems supporting access management, key management, and other infrastructural systems

Akamai Connected Cloud comprises many different distributed systems that serve a variety of purposes, and support our various products and services. The Secure CDN with Enhanced TLS and the supporting systems covered by the report are the distributed servers and systems used to deliver and protect web properties that transit or process sensitive end-user information. Akamai services running on the Secure CDN with Enhanced TLS leverage all of the security and availability controls tested in the primary SOC 2 Type 2 report. Examples of such services that may run on the Secure CDN with Enhanced TLS include:

• Edge Delivery products such as Ion and Dynamic Site Delivery, when running on the Secure CDN with Enhanced TLS
• App and API security products such as App & API Protector, Kona Site Defender, Kona DDoS Defender, Web Application Protector, and Bot Manager Standard, when running on the Secure CDN with Enhanced TLS

Akamai has an additional SOC 2 Type 2 report covering the Security and Availability Trust Service Criteria with respect to the following solutions:

• Bot Manager Premier
• Account Protector

Akamai’s SOC 2 Type 2 report for the Akamai Guardicore Segmentation service covers the Security, Availability, and Confidentiality Trust Services Criteria.

Akamai’s SOC 2 Type 2 report for the Akamai Identity Cloud service covers all five Trust Services Criteria.

Akamai also has a SOC 2 Type 1 report covering the Security and Availability Trust Services Criteria with respect to the following cloud computing services:

• Compute:
  • Dedicated CPU Compute
  • Shared CPU Compute
  • High Memory Compute
  • GPU Compute
  • Linode Kubernetes Engine
• Storage:
  • Object Storage
  • Block Storage
  • Backups
• Networking:
  • Cloud Firewalls
  • DDoS Protection
  • NodeBalancers
• Developer Tools:
  • API
• Cloud Manager

Q&A

How do I get a copy of the SOC 2 report?
Your Akamai account team can provide you with a copy. 

What regions are covered?
Akamai’s SOC 2 reports cover Akamai’s services as a whole, and are not limited to particular regions.

Do you have a bridge letter covering the period since the last covered period?
Your account team can provide you with a bridge letter covering the period since the last issued report.  

Does Akamai have a certificate of SOC 2 compliance?
SOC 2 does not offer a certificate of compliance. Instead, qualified third-party assessors produce a report on compliance for the assessed organization, discussing its system description, scope, control descriptions for meeting common criteria, evidence, and suitability of the organization’s descriptions and evidence. 

Why are there multiple SOC 2 reports for Akamai?
Akamai now has SOC 2 reports covering the Identity Cloud, Akamai Guardicore Segmentation, and cloud computing services. These services were a result of recent acquisitions by Akamai. For the time being, Akamai has chosen to keep these reports separate.  

Does Akamai have a SOC 1 report?
Akamai does not undergo a SOC 1 audit. The purpose of a SOC 1 report is to address a service provider’s internal controls that may impact their customers’ financial reporting. Akamai’s customers do not outsource to Akamai business processes that are critical to their financial reporting, so a SOC 1 audit is not relevant to the services that Akamai provides.

Overview

ISO 27001 is an international standard for information security management systems (ISMS). It provides a framework for organizations to manage their sensitive information and data in a secure manner, protecting it against unauthorized access, disclosure, destruction, or loss. The standard is risk-based and outlines a set of best practices, controls, and processes for ensuring information security. It is widely adopted by organizations around the world, and is often used as a benchmark for information security management.

Resources

ISO/IEC 27001:2013

Applicable Akamai Services

• Ion (when configured to run on Akamai’s Secure CDN with Enhanced TLS)
• Dynamic Site Accelerator (when configured to run on Akamai’s Secure CDN with Enhanced TLS)
• App & API Protector (when configured to run on Akamai’s Secure CDN with Enhanced TLS)
• Global Traffic Management 
• Edge DNS
• Secure Internet Access Enterprise (formerly known as Enterprise Threat Protector)
• Akamai Control Center portal
• Guardicore Segmentation
• Akamai Identity Cloud
• Secure Internet Access IoT Private Access
• Secure Internet Access Mobile Platform
• Secure Internet Access Mobile Private Access
• Secure Internet Access Mobile Standard
• Compute
  • Dedicated CPU Plans
  • Shared CPU Plans
  • High Memory Plans
  • GPU Plans
  • Linode Kubernetes Engine (LKE)
• Storage
  • Object Storage
  • Block Storage
  • Images
  • Backups
• Networking
  • NodeBalancers
• Free bundled cloud computing services
  • No-cost security, networking, maintenance, and monitoring solutions
• Cloud Manager Portal

Q&A

Why are there multiple ISO 27001 reports for Akamai?
In addition to the primary ISO 27001 certification, Akamai’s additional certifications arose out of Akamai’s acquisitions of Janrain, Inc., Asavie, Inc., and Guardicore, Inc. At this point, Akamai manages the certifications for the services that arose from these acquisitions separately. 

How do I obtain a copy of Akamai’s ISO 27001 certifications?
Your account team can provide these certifications to you.

Overview

ISO/IEC 27017:2015 gives guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance and controls to supplement those used for ISO 27001 and specifically tailored to cloud service providers and cloud service customers.

Resources

ISO/IEC 27017:2015

Applicable Akamai Services

• Compute
  • Dedicated CPU Plans
  • Shared CPU Plans
  • High Memory Plans
  • GPU Plans
  • Linode Kubernetes Engine (LKE)
• Storage
  • Object Storage
  • Block Storage
  • Images
  • Backups
• Networking
  • NodeBalancers
• Free bundled cloud computing services 
  • No-cost security, networking, maintenance, and monitoring solutions
• Cloud Manager Portal

How do I obtain a copy of Akamai’s ISO 27017 certification?

Your account team can provide these certifications to you.

Overview

This standard provides guidance aimed at ensuring that cloud service providers offer suitable information security controls to protect the privacy of their customers’ clients by securing the personally identifiable information (PII) entrusted to them.

The standard serves as a reference for selecting PII protection controls when implementing a cloud computing information security management system based on ISO/IEC 27018. It also provides guidance on implementing PII protection controls.

Resources

ISO/IEC 27018

Applicable Akamai Services

• Akamai Identity Cloud
• Compute 
  • Dedicated CPU Plans
  • Shared CPU Plans
  • High Memory Plans
  • GPU Plans
  • Linode Kubernetes Engine (LKE)
• Storage
  • Object Storage
  • Block Storage
  • Images
  • Backups
• Networking
  • NodeBalancers
• Free bundled cloud computing services 
  • No-cost security, networking, maintenance, and monitoring solutions
• Cloud Manager Portal

Q&A

How do I obtain a copy of Akamai’s ISO 27018 certification?

Your account team can provide these certifications to you.

Overview

ISO/IEC 27701:2019 is an information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC) to expand the information security management system (ISMS) of ISO/IEC 27001 to further address protection of privacy in the context of the processing of PII through a privacy information management system (PIMS). An organization complying with the requirements of ISO/IEC 27701 must generate documentary evidence of how it handles the processing of PII as a processor and/or as a controller.

Resources

• About ISO
• ISO 27001

Applicable Akamai Services

• Ion (when configured to run on Akamai’s Secure CDN with Enhanced TLS)
• Dynamic Site Accelerator (when configured to run on Akamai’s Secure CDN with Enhanced TLS)
• App & API Protector (when configured to run on Akamai’s Secure CDN with Enhanced TLS)
• Global Traffic Management 
• Edge DNS
• Secure Internet Access Enterprise (formerly known as Enterprise Threat Protector)
• Compute 
  • Dedicated CPU Plans
  • Shared CPU Plans
  • High Memory Plans
  • GPU Plans
  • Linode Kubernetes Engine (LKE)
• Storage
  • Object Storage
  • Block Storage
  • Images
  • Backups
• Networking
  • NodeBalancers
• Free bundled cloud computing services 
  • No-cost security, networking, maintenance, and monitoring solutions
• Cloud Manager Portal

Auditor

A-LIGN Assurance provides Akamai’s ISO 27701 certification.

Q&A

Can I obtain a copy of the certificate?

Your account team can provide you with our ISO 27701 certificate.

Overview

A U.S. government compliance program, the Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

FedRAMP created and manages a core set of processes to ensure effective and repeatable cloud security for the U.S. government. It established a mature marketplace to increase utilization and familiarity with cloud services.

Resources

FedRAMP

Akamai Certification

Since 2013, Akamai has a FedRAMP Joint Authorization Board (JAB) Provisional Authorization to Operate (ATO) for a moderate baseline, as an infrastructure as a service (IaaS) provider.

Downloads / Links

Akamai’s FedRAMP Marketplace page

Applicable Akamai Services

• Akamai’s content delivery network for HTTP and HTTPS delivery (known as the ESSL and FreeFlow Networks) and services running on them
• Web Application Edge Protection such as App & API Protector and Kona Site Defender
• Edge DNS (with DNSSEC)
• NetStorage
• Media streaming services
• Akamai Control Center
• Global Traffic Management

Q&A

How do I access Akamai’s FedRAMP documentation?

Customers can get the “Package Access Request Form” from the FedRAMP Marketplace website. 

What is Akamai’s FedRAMP Impact level? 

Akamai’s FedRAMP authorization is at the Moderate Impact level. According to FedRAMP, a Moderate Impact system comprises “nearly 80% of CSP applications that receive FedRAMP authorization and is most appropriate for CSOs where the loss of confidentiality, integrity, and availability would result in serious adverse effects on an agency’s operations, assets, or individuals. Serious adverse effects could include significant operational damage to agency assets, financial loss, or individual harm that is not loss of life or physical.”

At this time, Akamai has not sought FedRAMP authorization for the High Impact level.

Overview

The U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) set forth the requirements for the processing of individually identifiable health information by healthcare service and insurance providers. 

The Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) defines access rights to health data and mechanisms for patients to maintain control over their data. It expands HIPAA to cover the exchange of electronic protected health information (ePHI) as well as the scope of privacy and security protections under HIPAA. 

Resources

• HIPAA Security Rule
• HITECH Act

Akamai Compliance

Where Akamai is engaged by its healthcare customers to process healthcare data, it may be considered a Business Associate, and a Business Associate Agreement might be required between Akamai and the healthcare customer. A copy of Akamai’s standard Business Associate Agreement is available upon request.

Akamai undergoes regular third-party assessments in accordance with the HIPAA Security Rule, which requires that business associates “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability” of ePHI held by the business associate. The Executive Summary of our most recent assessment and/or the related letter by the assessors is available to Akamai customers and partners subject to nondisclosure agreement (NDA). 

Downloads / Links

Akamai’s HIPAA and HITECH Act Compliance Statement

Applicable Akamai Services

• Secure CDN with Enhanced TLS (Secure CDN), and the services running on it
• Edge Delivery products such as Ion, API Acceleration, and Adaptive Media Delivery, when running on the Secure CDN
• App and API security products such as App & API Protector, Account Protector, Kona Site Defender, and Bot Manager (Standard and Premier), when running on the Secure CDN
• Enterprise Application Access
• Akamai Identity Cloud
• Akamai Control Center
• Compute 
  • Dedicated CPU Plans
  • Shared CPU Plans
  • High Memory Plans
  • GPU Plans
  • Linode Kubernetes Engine (LKE)
• Storage
  • Object Storage
  • Block Storage
  • Images
  • Backups
• Networking
  • NodeBalancers
• Free bundled cloud computing services 
  • No-cost security, networking, maintenance, and monitoring solutions
• Cloud Manager Portal