Operating in compliance with national and international information security and engineering standards.

pyramid, cylinder, sphare, cube balanced

Service Organization Controls (SOC) 2 Reports

An independent third-party auditor has affirmed that NetApp in-scope cloud and managed services have achieved SOC 2 Type 1 reports based on applicable Trust Services criteria.

About SOC 2 reports

In alignment with the International Standard on Assurance Engagements (ISAE No. 3402), the American Institute of Certified Public Accountants (AICPA) developed the Service Organization Controls (SOC) reporting suite of services with three types of reports: SOC 1, SOC 2, and SOC 3. The SOC 2 report is intended to provide information about a service organization’s system relevant to select AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, or privacy), to enable report users to assess and address potential risks related to their relationship with that organization.

A SOC 2 report reflects a service auditor's attestation (opinion) regarding a service organization’s description of its system and the suitability of the design of its controls with respect to applicable Trust Services Criteria. A SOC 2 examination results in a report that provides a useful and standard way of understanding an organization’s oversight, corporate governance, supply chain management, and risk management processes. SOC 2 reports provide assurance to service organizations and users that system controls reasonably protect the confidentiality and privacy of user information processed by the system.

There are two types of SOC 2 examinations and related reports:

  • A Type I report is a service auditor’s "point in time" opinion of whether a service organization's description accurately represents its system design and implementation, and whether its controls are suitably designed to meet service commitments and system requirements.
  • A Type 2 report addresses the operational effectiveness of controls over a specified review period in addition to the system description and suitability of control design.
NetApp in-scope services and SOC 2 reports

An independent certified public accountant firm and services auditor examined the following NetApp cloud and managed services and affirmed that they have achieved SOC 2 Type 1 reports based on the applicable Trust Services Criteria.

  • Cloud Insights
  • Managed Services in the Americas
  • SaaS Backup
  • Cloud Volume Services on AWS
Audits, reports, and certificates

NetApp products and services are audited regularly against the SOC 2 (AT Section 101) standard by an independent third-party auditor. For information on these NetApp SOC 2 reports, please contact your NetApp account manager.

  • Cloud Insights SOC 2 Type 1 Security Report
  • Managed Services in the Americas SOC 2 Type 1 Security Report
  • SaaS Backup SOC 2 Type 1 Security, Availability, Confidentiality, and Processing Integrity Report
NetApp as a service provider

NetApp is audited as a service provider because we provide information and data services, both internally within our corporate information services and externally through services to our customers. NetApp therefore pursues audit certifications as evidence that these services follow processes designed to protect information in accordance with common industry standards.

purple rounded square container stacked