Product certifications and compliance

Certifications and Audits

• SOC 2® Type 2:
  Citrix SecurAccess ZTNA is covered under Citrix’s SOC 2 Type 2 audit program.
  SOC 2 Type 2 audits have evaluated the security, availability, confidentiality, processing integrity, and privacy controls applicable to Citrix Cloud services, including Citrix SecurAccess ZTNA.
• ISO 27001 & ISO 27701:
  Citrix SecurAccess ZTNA is included within Citrix’s ISO 27001 (Information Security Management) and ISO 27701 (Privacy Information Management) certified service portfolio.
  These globally recognized certifications affirm that security and privacy management practices are formally established, documented, and continuously improved.
• HIPAA:
  Citrix SecurAccess ZTNA is suitable for use in environments that require HIPAA compliance when configured and contracted appropriately. Citrix’s cloud compliance documentation indicates HIPAA applicability for Citrix SecurAccess ZTNA.
• PCI DSS 4.0:
  Citrix SecurAccess ZTNA is included within Citrix’s annual PCI DSS assessments for applicable cloud services. Customers deploying Citrix SecurAccess ZTNA in PCI-scoped environments might need to implement additional controls to meet PCI requirements. PCI DSS compliance follows a shared responsibility model between Citrix and the customer.
• FIPS / Common Criteria:
  Citrix SecurAccess ZTNA can be deployed as part of a FIPS-compliant solution when paired with FIPS-certified or FIPS-enabled NetScaler platforms and the FIPS-certified Citrix CryptoKit used by Citrix Workspace app.
  For Common Criteria, Citrix SecurAccess ZTNA integrates with Common Criteria (NDcPP) certified NetScaler platforms and Common Criteria certified Citrix Workspace app, enabling deployments that align with Common Criteria requirements at the solution level.
• Australia IRAP (Information Security Registered Assessors Program):
  Citrix SecurAccess ZTNA is included within Citrix’s cloud services that undergo IRAP assessments by accredited Australian Government assessors.
  IRAP provides independent validation that Citrix Cloud services align with the Australian Government Information Security Manual (ISM) security controls.

Certificates and audit reports