Veeam is continuously investing, innovating, and adding to industry and regulatory credentials to help ensure your data is protected and secure. Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities.
![]() |
SOC 2 Type 2 reviews an organization’s design of internal controls to assess compliance posture and determine whether the implemented controls meet the framework's requirements. Check out the Compliance Portal for more details. Login required |
![]() |
ISO, the International Organization for Standardization, brings global experts together to agree on the best way of doing things – for anything from making a product to managing a process. ISO provides globally recognized frameworks, including for information security, cybersecurity, quality management, and data protection. These frameworks help organizations build robust security programs that align with industry and legal requirements. Check out the Compliance Portal for more details. Login required |
![]() |
HIPAA / HITECH Type 2 Attestations are an independent third-party assessment that evaluates an organization’s compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health At) security, privacy, and breach notification requirements over a specific period. Check out the Compliance Portal for more details. Login required |
![]() |
Veeam Backup & Replication v12.1 has obtained the Department of Defense Information Network Approved Products List (DoDIN APL) certification. This prestigious certification validates Veeam's commitment to meet the most stringent security, interoperability and supportability requirements of the Department of Defense's (DoD) complex network environments. |
![]() |
Common Criteria (CC) is an international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments. |
![]() |
Veeam aligns its cybersecurity program with the NIST Cybersecurity Framework (CSF), contributed to the NIST Special Publication 1800-11 (Data Integrity: Recovering from Ransomware and Other Destructive Events) and meets FIPS 140-2 compliance. |
![]() |
The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized approach to security authorizations for Cloud Service Offerings for the United States Federal Government. |
![]() |
Iron Bank is the U.S. Department of Defense’s central repository for hardened, containerized software artifacts that meet stringent cybersecurity standards. Being included in the repository demonstrates that Veeam Kasten solutions meet U.S. federal and defense security requirements, supporting secure deployment in government environments. |
![]() |
The Cloud Security Alliance (CSA) STAR Registry documents and validates the cloud security controls of service providers. Being included in the registry provides transparency and demonstrates Veeam’s commitment to industry-leading cloud security practices.
|
![]() |
Members of the Information Security Registered Assessors Program (IRAP) assess cloud services in compliance with Australian government cybersecurity standards. IRAP assessment enables Veeam to serve Australian government and public sector customers by meeting local regulatory requirements.
|
![]() |
The Cybersecurity Maturity Model Certification (CMMC) v2 Level 1 establishes foundational cyber hygiene for U.S. Department of Defense (DoD) contractors. Certification allows Veeam to participate in U.S. Department of Defense contracts, ensuring protection of federal information. Login required |
![]() |
Texas Risk and Authorization Management Program (Texas RAMP) certifies the security of cloud services used by Texas state agencies. Certification enables Veeam to provide compliant cloud solutions to Texas public sector organizations.
|
SOC 2 Type 2 reviews an organization’s design of internal controls to assess compliance posture and determine whether the implemented controls meet the framework's requirements. Check out the Compliance Portal for more details. Login required |
ISO, the International Organization for Standardization, brings global experts together to agree on the best way of doing things – for anything from making a product to managing a process. (ISO) provides globally recognized frameworks, including for information security, cybersecurity, quality management, and data protection. These frameworks help organizations build robust security programs that align with industry and legal requirements. Check out the Compliance Portal for more details. Login required |
HIPAA / HITECH Type 2 Attestations are an independent third-party assessment that evaluates an organization’s compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health At) security, privacy, and breach notification requirements over a specific period. Check out the Compliance Portal for more details. Login required |
Veeam Backup & Replication v12.1 has obtained the Department of Defense Information Network Approved Products List (DoDIN APL) certification. This prestigious certification validates Veeam's commitment to meet the most stringent security, interoperability and supportability requirements of the Department of Defense's (DoD) complex network environments. |
Common Criteria (CC) is an international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments. |
Veeam aligns its cybersecurity program with the NIST Cybersecurity Framework (CSF), contributed to the NIST Special Publication 1800-11 (Data Integrity: Recovering from Ransomware and Other Destructive Events) and meets FIPS 140-2 compliance. |
The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized approach to security authorizations for Cloud Service Offerings for the United States Federal Government. |
Iron Bank is the U.S. Department of Defense’s central repository for hardened, containerized software artifacts that meet stringent cybersecurity standards. Being included in the repository demonstrates that Veeam Kasten solutions meet U.S. federal and defense security requirements, supporting secure deployment in government environments. |
The Cloud Security Alliance (CSA) STAR Registry documents and validates the cloud security controls of service providers. Being included in the registry provides transparency and demonstrates Veeam’s commitment to industry-leading cloud security practices. |
Members of the Information Security Registered Assessors Program (IRAP) assess cloud services in compliance with Australian government cybersecurity standards. IRAP assessment enables Veeam to serve Australian government and public sector customers by meeting local regulatory requirements. |
The Cybersecurity Maturity Model Certification (CMMC) Level 1 establishes foundational cyber hygiene for U.S. Department of Defense (DoD) contractors. Certification allows Veeam to participate in U.S. Department of Defense contracts, ensuring protection of federal information. Login required |
Texas Risk and Authorization Management Program (Texas RAMP) certifies the security of cloud services used by Texas state agencies. Certification enables Veeam to provide compliant cloud solutions to Texas public sector organizations. |
Veeam is endlessly integrating security and risk management into every step of our business – so you can trust your data stays protected, always. Visit Veeam's Compliance Portal (login required) for a more in-depth look at our security and compliance controls, policies, and practices, along with evidence for your risk assessments and assurance activities.
![]() |
Products designed with Secure by Design principles prioritize the security of customers as a core business requirement, rather than merely treating it as a technical feature. Veeam has signed the Security by Design Pledge and affirmed our adherence to secure development practices. RSAA login required |
Products designed with Secure by Design principles prioritize the security of customers as a core business requirement, rather than merely treating it as a technical feature. Veeam has signed the Security by Design Pledge and affirmed our adherence to secure development practices. RSAA login required |
At Veeam, we recognize the critical importance of environmental stewardship, social responsibility, and effective governance in creating sustainable value for our stakeholders, customers, and Veeamers.
![]() |
Veeam's reporting aligns with key ESG frameworks and standards such as the Global Reporting Initiative (GRI), Sustainability Accounting Standards Board (SASB), and Task Force on Climate-related Financial Disclosures (TCFD). |
Veeam's reporting aligns with key ESG frameworks and standards such as the Global Reporting Initiative (GRI), Sustainability Accounting Standards Board (SASB), and Task Force on Climate-related Financial Disclosures (TCFD). |
Veeam partners with Level Access, a third-party service provider that helps make websites and digital tools easier for everyone to use, including people with disabilities. As a leader in digital accessibility, Level Access works with Veeam to check our websites and apps, fix problems, and teach our teams how to make these resources more accessible.
Veeam holds numerous certifications pertinent to data protection, including:
For more information on Veeam’s certifications and accreditations, see Veeam's Compliance Portal (login required).
At Veeam, we embrace the responsible use of AI in our products, services, and operations. We are committed to ensuring responsible AI deployment, focused on fairness, reliability, transparency, and accountability. Veeam integrates AI-powered assistants (Veeam Intelligence) within several on-premises and cloud products. These assistants help users with technical support, product configuration, and troubleshooting.
Veeam adheres to responsible AI best practices, including transparency, security, privacy, and human oversight, aligning with the NIST AI Risk Management Framework and Microsoft Responsible AI principles.
Veeam is committed to:
Responses from Veeam Intelligence are based on official Veeam documentation and Knowledge Base, with links provided for reference.
AI responses may not always be accurate; users should verify any recommendations before acting.
Veeam leverages third party services to answer customer queries. Use of Veeam Intelligence does not require the user to input personal data and Veeam advises users to not input any personal information unless relevant.
Veeam ensures compliance with AI regulatory frameworks, such as the EU AI Act, by prioritizing ethical AI practices and governance. We have established an internal responsible AI policy and an AI use governance process to assess and mitigate risks associated with AI deployment, including evaluating our use of AI systems against high-risk AI criteria outlined in the EU AI Act.
Veeam’s AI services do not rise to the level of a “Prohibited AI Activity” or “High Risk” under the EU AI Act. Our AI services are not intended to be used as a safety component of a product, nor are they covered by the EU’s harmonization legislation listed in Annex I or Annex III of the EU AI Act. As such, Veeam has Transparency obligations under Chapter IV, Article 50 of the EU AI Act. These obligations include notifying users when they are interacting with AI systems and providing clear instructions on the appropriate and intended use of AI systems.
For VDP and other on-premises products, since Veeam does not have access to your backups and therefore does not systematically process any personal data, a DPA is not required.
For VDC , a DPA is incorporated by reference into the VDC Service Agreement, which each customer reviews and agrees to during deployment.
2025 Risk to Resilience Report
Best practices for cyber resilience that all organizations should evaluate implementing to protect against ransomware.
Please, try again later.