Compliance Regular audits to ensure data security and privacy To maintain security and compliance on a continuous basis, we conform to the most stringent compliance frameworks.
ServiceNow Platform Compliance Certifications GDPR Resources
Alt
“ServiceNow pursues stringent industry certifications and attestations to show that we are dedicated to helping our customers by preserving their trust, reputation, safety and the integrity of their data”. John Castelly Chief Compliance Officer, ServiceNow
Global and regional compliance
Certifications and attestations
Certifications and attestations ServiceNow meets the highest security and privacy standards in all of our regions. Additionally, our applications allow organisations to meet your sectoral or regional requirements. See All
Customer compliance
Customer compliance Compliance certifications and attestations are critical. We make customer compliance processes easy via our technical capabilities, guidance documents and legal commitments. Discover More
Customer data privacy
Customer data privacy By providing customers with the tools to protect sensitive data, we reduce risk exposure in critical parts of their business.
Secure access control
Secure access control Prevent unauthorised account access and increase data security through multi-factor authentication (MFA). Read Blog
Transparency
Transparency Transparency earns trust. Our stringent terms and data protection agreements dictate how we process data, including policies for responding to government requests. Find Out How
We champion security and privacy initiatives We proactively monitor and adapt our security protocols to rapidly changing regulatory landscapes. Expand All Collapse All ISO/IEC 27017:2015

The ISO/IEC 27017:2015 standard is concerned with the implementation of the cloud-specific information security controls specified in ISO/IEC 27002.

The certification is gained by an annual independent audit and ServiceNow has been an ISO/IEC 27017:2015 certified organisation since 2018.
ISO/IEC 27001:2022

The ISO/IEC 27001:2022 certification specifies security management best practices and controls based on the ISO/IEC 27002 best practice guide. It ensures that our information security management system (ISMS) is fine-tuned to keep pace with changes to security threats, essential in the fast-paced world of IT security.

Re-certification is obtained by audit every three years, inclusive of an annual surveillance audit order to prove that ServiceNow:

  1. Has designed and implemented a comprehensive ISMS.
  2. Has adopted a continuous risk management process to ensure that the appropriate information security controls are in place to meet an evolving threat landscape and risks.
  3. Systematically evaluates information security risks appropriately, taking into account several factors, including the impact of company threats and vulnerabilities.

ServiceNow has been an ISO/IEC 27001 certified organisation since 2012 and the certificate is available here.
ISO/IEC 27018:2019

The ISO/IEC 27018:2019 is a code of practice based on ISO/IEC 27002 and is concerned with the protection of personally identifiable information (PII) in public clouds, in accordance with the privacy principles in ISO/IEC 29100.

The certification is gained by annual independent audit and ServiceNow has been an ISO/IEC 27018:2019 certified organisation since 2016.
ISO/IEC 27701:2019
This extension to ISO/IEC 27001 focuses on the establishment, and maintenance of a Privacy Information Management System (PIMS). This is relevant to ServiceNow as a processor of customer data which may contain Personally Identifiable Information (PII). ServiceNow received this certification in 2020.
SSAE 18 SOC 1 and SOC 2 Reports

The Service Organisational Control (SOC) framework is an attestation that ServiceNow meets the required standard regarding having controls in place to protect the confidentiality, integrity and availability of our customers' data in the cloud.

- SOC 1 focuses on the effectiveness of internal controls that affect the financial reports of customers

- SOC 2 evaluates controls that are relevant to availability, integrity, security, confidentiality, or privacy.

ServiceNow is audited by a third party and has maintained its SSAE 18 SOC 1 Type 2 attestation since 2011 (SSAE 18 superseded SSAE 16 in 2017). SSAE 18 is aligned with international standard ISAE3402 and replaced the now-deprecated SAS70.

ServiceNow's SOC 1 report covering the period from 1 October (of the previous calendar year) to 30 September (of the current calendar year) is available via ServiceNow CORE by the end of each calendar year (December).

The SOC 1 report covering the period from 1 April to 31 March is available via ServiceNow CORE by the end of each calendar Q2 (June).

ServiceNow has also undertaken an annual SOC 2 Type 2 attestation since 2013, relevant to security, availability and confidentiality controls listed in the AICPA Trust Services Criteria (TSC).

ServiceNow's SOC 2 report covers the period 1 October (of the prior calendar year) to 30 September (current calendar year) and is available via ServiceNow CORE by the end of each calendar year (December).

A Bridge Letter is provided between audit periods so that the company is covered for the entire year.

ServiceNow's SOC 1 bridge letter covering the period from 1 October (of the current calendar year) to 31 December (of the current calendar year) is available on ServiceNow CORE by the end of each calendar Q1 of following year.

The SOC 1 bridge letter covering the period from 1 April to 30 June is available via ServiceNow CORE by the end of each calendar Q3.

ServiceNow's SOC 2 bridge letter covers the period 1 October (current calendar year) to 31 December (current calendar year) and is available on ServiceNow CORE by the end of each calendar Q1 of next year.
BSI Cloud Computing Compliance Controls Catalogue (C5) Standard
C5 is a cloud-specific compliance controls catalogue developed by the German Federal Office for Information Security (BSI) and leveraged in both the public and private sectors. The C5 Attestation Report follows a similar process and schema as AICPA SOC 2 reports, and has a high overlap of requirements with the AICPA Trust Services Criteria, with the addition of specific cloud-focused requirements. ServiceNow received its C5 Attestation Report in 2020.
APEC Privacy Recognition for Processors (PRP)
The APEC PRP is a voluntary certification for data processors specific to the Asia-Pacific region, and developed by local members in the region. Certifications are renewed annually, but assessors are brought in potentially more frequently for any change that would have a significant impact on the Processor's Privacy processes and/or procedures.
ISMAP Cloud Service
The Information system Security Management and Assessment Programme (ISMAP) is a programme that aims to ensure the level of security in cloud service procurement by the Japanese government by evaluating and registering cloud services that meet the security requirements of the Japanese government.  ServiceNow's Now Platform was independently assessed by a registered ISMAP assessor to meet the Control Criteria of ISMAP controls and has been registered as ISMAP Cloud Service since March 2022.  ISMAP Cloud Service List is available here: https://www.ismap.go.jp/csm?id=cloud_service_list
CSA STAR Level 2: STAR Certification
The Cloud Controls Matrix ("CCM") is a framework of controls (policies and procedures) that are essential for cloud computing security. It is created and updated by the Cloud Security Alliance ("CSA") and aligned to CSA best practices. The CSA STAR Level 2 Certification is a rigorous third-party independent assessment of the security of a cloud service provider against the CSA Cloud Controls Matrix together with ISO/IEC 27001 requirements.
EU Cloud CoC

The EU Cloud Code of Conduct (EU Cloud CoC) is a set of control requirements designed to develop trust and transparency in the European cloud computing market and to simplify the risk assessment process of Cloud Service Providers (CSPs) for cloud customers. To demonstrate this compliance, ServiceNow performed an internal audit of over 80 EU Cloud CoC requirements and was subject to an external assessment of that audit effort. ServiceNow's external validation of adherence to the EU Cloud CoC speaks to our ongoing commitment to maintaining the highest privacy and security standards alongside our existing Security and Privacy certifications.

Services are verified compliant with the EU Cloud CoC, Verification-ID 2022LVL02SCOPE3113. For further information please visit https://eucoc.cloud/en/public-register.
FedRAMP High P-ATO For US Government Entities and Providers

ServiceNow's Government Community Cloud (GCC) offering currently maintains a Federal Risk and Authorization Management Program (FedRAMP) High Baseline Provisional Authority to Operate (P-ATO). This enables ServiceNow to accelerate the adoption of our secure cloud solutions by US federal agencies and providers and implement a standardised approach for assessing, monitoring and authorising cloud computing products and services under the Federal Information Security Management Act (FISMA).

GCC received the initial GCC FedRAMP High Provisional Authority to Operate (P-ATO) in August 2019. GCC also meets Department of Defense (DoD) Impact Level 4 (IL4) and CNSSI 1253F Privacy Overlay High PII + PHI control requirements.

Click here to see ServiceNow on the FedRAMP Marketplace
DoD IL4 PA For US DoD and IC Entities

ServiceNow's Government Community Cloud (GCC) offering currently maintains a Department of Defense (DoD) Impact Level 4 (IL4) Provisional Authorisation (PA). This facilitates the procurement of ServiceNow products by the US Department of Defense (DoD) and Intelligence Community (IC) and establishes a baseline standard defined by the DoD Cloud Computing (CC) Security Requirements Guide (SRG) developed by the Defense Information Systems Agency (DISA).

ServiceNow received its initial GCC DoD IL4 PA in October 2019. The DoD IL4 PA includes both FedRAMP High and DoD IL4 control requirements. ServiceNow's GCC offering also meets CNSSI 1253F Privacy Overlay High PII + PHI control requirements.

Click here to see ServiceNow on the DISA Storefront within the Standard Offering section
DoD IL5 for the National Security Cloud

ServiceNow has obtained a US Department of Defense (DoD) Impact Level 5 (IL5) Provisional Authorisation. This makes the ServiceNow National Security Cloud (NSC) one of the few software‑as‑a‑service and platform‑as‑a‑service (SaaS/PaaS) offerings built and authorised to meet the rigorous Department of Defense Cloud Computing Security Requirements Guide at Impact Level 5.

The IL5 Provisional Authorisation will accelerate the DoD's digital transformation, as it enables the DoD, its mission partners and selected federal agencies to move highly sensitive data, including Controlled Unclassified Information and Unclassified National Security Systems, to ServiceNow cloud‑based solutions hosted on Microsoft Azure Government.
Multi-Tier Cloud Security Standard for Singapore (MTCS) Level 3

MTCS Level 3 is a certification that ensures that ServiceNow meets standards regarding the confidentiality and integrity of our customers' data in the cloud for Singapore. It builds upon ISO/IEC 27001 and covers the sovereignty, retention, and availability of data, along with business continuity planning and disaster recovery.

ServiceNow is proud to have achieved MTCS Level 3, the highest level of certification available.
ASD IRAP assessed for OFFICIAL and PROTECTED cloud services

ServiceNow's Australian Platforms have been independently assessed by an endorsed IRAP assessor to meet the Australian ISM controls for OFFICIAL and PROTECTED data. The IRAP assessed OFFICIAL and PROTECTED Cloud Services provides Australian Government customers with trust and confidence in the NOW Platform and enables ServiceNow to effectively engage with Australian Government Agencies and Critical Infrastructure Providers.

Further details for Australian Regulated customers can be reviewed here: https://your.servicenow.com/microsoftregulatedindustries/australia
Government of Canada GC Cloud Provider
The Canadian Centre for Cyber Security (CCCS) has established a set of both physical and logical requirements that must be met to be a certified GC Cloud Provider. Cloud Providers must demonstrate compliance to CCCS personnel prior to approval as a GC Cloud Provider. GC is the government defined data classification level that is approved to be stored within the cloud.
AICPA SOC 2 TSC + HITRUST CSF
HITRUST was developed by the healthcare industry to standardise compliance objectives through their CSF Framework of controls, originally built on ISO27001. They have since incorporated and mapped to many common security standards, including NIST 800-53 and the AICPA SOC 2 Trust Services Criteria. The SOC 2 + HITRUST report is a collaboration between the AICPA and the HITRUST Alliance. It provides a mechanism for the service auditor to opine on the design and effectiveness of the Trust Services Criteria and the HITRUST CSF in the same report.
UK Cyber Essentials Plus Certification
Cyber Essentials Plus is a UK government-backed scheme that assists organisations in demonstrating risk mitigation and the assessment of cyber security threats to their IT systems. The scheme requires the implementation of various technical controls to ensure the best practices and the utmost security, conducted by an external auditor. Due to the regional focus of the scheme, the certification is scoped to the UK region.
PCI DSS Compliance
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express. Governed by the Payment Card Industry Security Standards Council (PCI SSC), the compliance requirements were created to secure credit and debit card transactions against data theft and fraud. This is relevant to ServiceNow as a processor of customer data which may contain credit card data. ServiceNow received this certification in 2023.
EU DSA Compliance

ServiceNow and the EU Digital Services Act (Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC):

Please direct any communications in accordance with the EU Digital Services Act to DSACompliance@ServiceNow.com.
Data Privacy Framework

ServiceNow is a Data Privacy Framework (DPF) Program participant. The EU-U.S. DPF, UK Extension to the EU-U.S. DPF and Swiss-U.S. DPF were respectively developed by the U.S. Department of Commerce and the European Commission, UK Government and Swiss Federal Administration to provide U.S. organisations with reliable mechanisms for personal data transfers to the United States from the European Union, United Kingdom and Switzerland while ensuring data protection that is consistent with EU, UK and Swiss law.

More information about the Data Privacy Framework Program can be found here (https://www.dataprivacyframework.gov/s/). ServiceNow's DPF Policy is available here (https://www.servicenow.com/data-privacy-framework.html).
GDPR compliance We help organisations to achieve GDPR compliance with solutions that make meeting requirements like greater data access and privacy by design a seamless part of daily operations.  Read More
Resources Statements ServiceNow Invests in EU Services International Data Transfers FAQ ServiceNow Security for the UK Public Sector Responsible AI Guidelines White Papers Data Encryption Securing the Now Platform Regulated Industries and Data Privacy Requirements (IDC)
Explore more ServiceNow helps customers to defend against security threats, protect their data and comply with evolving global mandates.   Learn How GDPR Privacy Security Compliance Now Platform