Snapshot 172315
Normalized text
Scripts and page chrome removed; this is what change detection compares.
English (United States) English (United States) Deutsch (Deutschland) Español (América Latina) Français (France) 日本語 (機械翻訳) í•œêµì–´(대한민êµ) Skip to main contentSkip to search Powered by Zoomin Software. For more details please contactZoomin Tanium Cloud User Guide Tanium Cloud Trust Center Save PDF Save selected topicSave selected topic and subtopicsSave all topics Share Share to emailCopy topic URL Print Tanium Cloud home Overview Getting started Requirements Tanium Cloud Trust Center Configuring your identity provider for Tanium Cloud Configuring Entra ID for Tanium Cloud Configuring Okta for Tanium Cloud Configuring AD FS for Tanium Cloud Configuring Oracle IDCS or OCI IAM for Tanium Cloud Configuring PingFederate for Tanium Cloud Configuring Google Cloud Identity for Tanium Cloud Configuring Salesforce for Tanium Cloud Managing existing identity provider configurations Configuring user provisioning Managing your Tanium Account View information and manage the maintenance windows and notifications Configuring network egress for Tanium Cloud Manage Tanium Console local users for evaluation or demonstration Managing organizations Troubleshooting Reference: Default solution configurations HomeTanium Cloud User GuideTanium Cloud Trust CenterCurrent page Table of Contents Security is mission-critical for Tanium customers, and it is of paramount importance at Tanium. Tanium is proud to have created an industry-leading security program to facilitate the development of secure code and to protect customers' data. Secure service design and operation is the foundation of any cloud service offering. Tanium has built Tanium Cloud services from the ground up with the highest standards of security, resiliency and operational efficacy in mind. This section provides details about how Tanium operates its cloud services aligned with internationally recognized standards. Tanium Cloud artifacts Besides the security and compliance information provided in this document, Tanium makes various artifacts available to you directly within your Tanium Account. Among the available artifacts are third-party penetration test reports, security policies, insurance certificates, and compliance certificates Tanium Account users with the Admin or Artifacts User role can access these artifacts. To access Tanium Cloud artifacts: Sign in to your Tanium Account as a user with the Administrator or Artifacts User role. From the Tanium Account Main menu, go to Artifacts . To download one of the available documents, click Download beside that document. Compliance Tanium routinely engages with external professional audit entities to perform audits against the Tanium Cloud Information Security Management Service (ISMS), to help ensure our security and operational practices follow globally recognized standards. Links are provided to publicly available compliance information in the following table. Prospects without an NDA in place can freely download and review any of the artifacts here. Confidential compliance artifacts, such as summary assessment reports, can be found in the Artifacts section of your Tanium Account, as noted in the following table. In addition to Tanium Cloud security and compliance certifications, Tanium maintains compliance with additional controls. For more information, see Security at Tanium. Tanium Cloud compliance offerings Compliance Offering Description Tanium Cloud Tanium Cloud for U.S. Government SOC 2 Type II* Tanium is certified to be SOC 2 compliant by an independent auditor, using the criteria defined by the American Institute of Certified Public Accountants (AICPA) for System and Organization Controls (SOC) to produce a SOC 2 Type II report that verifies the operational effectiveness of Tanium's systems to handle customer data. This report is intended to help you examine services provided by Tanium so that you can assess and address the risks associated with using these services. ISO 27001* Tanium and Tanium Cloud are ISO 27001:2022 certified, proving our expertise in securely managing information technology systems. The Tanium ISO Certification can be verified in the BSI certificate directory (the third-party assessor), by searching for Tanium Inc as the organization. ISO 27017* ISO/IEC 27017:2015 provides guidance on the information security aspects of cloud computing, recommending the implementation of cloud-specific information security controls that supplement the guidance of the ISO/IEC 27002 and ISO/IEC 27001 standards. Tanium has been assessed by an independent third party for compliance with ISO 27017:2015. ISO 27018* ISO/IEC 27018:2019 provides guidance on the protection of personally identifiable information (PII) in cloud computing, specifically addressing how cloud service providers (CSPs) must handle personal data securely to comply with privacy regulations. It is based on the ISO/IEC 27002 standard. Tanium has been assessed by an independent third party for compliance with ISO 27018:2019. Canada Protected B The Canadian Government's security guidance for cloud environments, known as the Security Control Profile for Cloud-based GC Services, outlines security controls and profiles from the IT Security Risk Management: A Lifecycle Approach (ITSG-33) publication. The ITSG-33 publication has made Protected B Medium Integrity Medium Availability (PBMM) a key compliance measure for the Canadian Government and Crown Corporations. Tanium Cloud has been compliant with Protected B since 2023. Esquema Nacional de Seguridad (ENS) Alta (High) Esquema Nacional de Seguridad (ENS) Alta is a high-assurance certification aligned to Spain's National Security Framework for public-sector and critical-service providers. It gives customers in Spain, and those supporting Spanish public-sector workloads, independent assurance that Tanium Cloud meets strict security and operational requirements. PCI-DSS Self-Assessment* The Payment Card Industry (PCI) Data Security Standards (DSS) is a global information security standard designed to prevent fraud through increased control of credit card data. Tanium has completed a PCI-DSS self-assessment, including a Self-Assessment Questionnaire (SAQ D) and Attestation of Compliance. The self-assessment is available for review, as well as summary reports from quarterly external vulnerability scans. FedRAMP Moderate The US Federal Risk and Authorization Management Program (FedRAMP) was established in December 2011 to provide a standardized approach for assessing, monitoring, and authorizing cloud computing products and services under the Federal Information Security Management Act (FISMA), and to accelerate the adoption of secure cloud solutions by US federal agencies. Tanium Clouds for U.S. Government has been FedRAMP Authorized at the Moderate level since 2023. FIPS Validated 140-3 Tanium platform software uses Federal Information Processing Standard (FIPS) 140-3 validated cryptography modules that are approved for FedRAMP use. To learn more about FIPS, see NIST Cryptographic Module Validation Program: Certificate #4926. GovRAMP Moderate GovRAMP (formerly StateRAMP) is a cybersecurity program established in 2021 to address the needs of procurement and security officials with state and local governments in the United States. Tanium Cloud for U.S. Government has been StateRAMP Authorized since 2023. TX-RAMP Level 2 The Texas Department of Information Resources administers the Texas Risk and Authorization Management Program (TX-RAMP) to provide standards for security assessment, certification, and continuous monitoring of cloud computing services that process the data of Texas state agencies. Tanium Cloud for U.S. Government has been TX-RAMP Level 2 Certified since 2023. * Compliance artifacts are available in your Tanium Account. For more information, see Tanium Cloud artifacts. Privacy Data privacy and Tanium For more information about Tanium’s role in processing customer personal data, including its role as a data processor under the GDPR, see the Tanium Data Processing Addendum (DPA). Additionally, the Tanium Privacy Policy details privacy practices at Tanium when processing personal data as a data controller. For more information about how individual Tanium products process personal data, see Tanium Privacy Datasheets. Security Customer data Customer Data is data or data files of any type that a customer uploads or to which a customer grants access when using the Tanium Cloud service. The customer, as the data owner and controller, decides which types of data are sent to Tanium Cloud as a data processor by their configuration and use of the service. For more information about Customer Data and how it may be used, see the Tanium Cloud Subscription Agreement Data regions Tanium enables customers to choose one of the predefined Tanium Cloud data host regions for Customer Data. The customer makes this choice before the onboarding process begins. After onboarding, the Customer Data cannot be relocated to a different region. Some Tanium AI features require access to AI services hosted in specific cloud regions. If an eligible customer enables cross-region AI routing, Tanium uses a secure communication channel to route AI requests to a Tanium-designated region (currently United States and subject to change) to fulfill the AI request. Customer Data might be included in AI request data. This setting is disabled by default. A Tanium Account Admin can enable the setting and can disable it at any time. For more information, see Tanium Atlas User Guide: Enable or disable Atlas. Customer Data, its backups, and its data-at-rest encryption keys are securely stored by Tanium within this region, using redundant infrastructure and hosting within its sub-processors. Customer Data leaves Tanium Cloud only when accessed or requested by the customer. Tanium currently supports the following regions for hosting Tanium Cloud and Tanium Cloud for U.S. Government service instances: Tanium Cloud data host regions Tanium Cloud data host regions United States (USA) European Union (EU)1 Japan Canada United Kingdom (UK) Australia South America Tanium Cloud for U.S. Government data host region United States (USA) 1 The European Union (EU) Data Boundary uses datacenters in member states of the EU or of the European Free Trade Association (EFTA) to provide service within the EU Data Boundary. If a Tanium Account Admin enables cross-region AI routing, AI request data is encrypted in transit and routed to the United States (USA) to fulfill AI requests. Responses are returned to the customer's selected Tanium Cloud data host region, and Customer Data is not retained in persistent storage outside the customer's selected Tanium Cloud data host region. Tanium Clients request packages from the nearest-edge point of presence (PoP) in Tanium’s global Content Distribution Network (CDN). Each request uses the Tanium Protocol for encrypted communication and a secure token for access. When a Tanium Client requests a package, the CDN temporarily caches the package for distribution. For more information about file distribution and CDN downloads, see Tanium Client Management User Guide: File distribution. Regulatory information International Traffic in Arms Regulations The set of International Traffic in Arms Regulations (ITAR) is directed to the export of defense-related articles. There is no formal ITAR certification and Tanium products are not subject to ITAR. For companies that manage ITAR compliance, Tanium Cloud for U.S. Government (TC-USG) provides an environment that is physically located in the U.S. and that is audited by U.S. federal government agencies for use by U.S. government customers. Access is limited to U.S. Citizens, and TC-USG can be used to transmit, process, and store protected articles and data. For more information, see the Solution Brief for Tanium Cloud for U.S. Government. Digital Operational Resilience Act For companies that manage compliance with the Digital Operational Resilience Act (DORA), Tanium implements additional Technical and Organizational Measures (TOMs) to ensure the operational resilience of its services. These measures include enhanced risk management protocols, regular testing and assessment of Information and Communications Technology (ICT) systems, and oversight of third-party service providers. Tanium ensures that all relevant documentation, processes, and controls are in place to meet the requirements set forth by DORA, thereby safeguarding the integrity, availability, and confidentiality of customer data and systems. HIPAA and Business Associate Agreements Under the U.S. Health Insurance Portability and Accountability Act (HIPAA), a Business Associate is someone who stores, processes, analyzes or otherwise handles Protected Health Information (PHI) for any healthcare provider, insurer or other entity subject to the regulation (Covered Entity). Business Associates generally include entities that handle PHI on behalf of a Covered Entity for claims processing, billing, or other administrative services. Tanium does not qualify as a Business Associate because Tanium does not process or analyze PHI on behalf of any Covered Entity, nor does Tanium store any PHI in Tanium Cloud. By design, any PHI data remains solely on customer endpoints (such as individual devices) and is not stored on Tanium servers (cloud or on-premises). Accordingly, Tanium does not enter into Business Associate Agreements with its customers. EU Cyber Resilience Act The EU Cyber Resilience Act (CRA) sets essential cybersecurity requirements for “products with digital elementsâ€� that are placed on the EU market, covering secure-by-design engineering, vulnerability handling, and incident reporting obligations across the product lifecycle. Tanium develops and provides software with digital elements and, on that basis, treats itself as a manufacturer within the meaning of the CRA. The existing comprehensive Tanium Cloud security program, including its certifications under ISO/IEC 27001, 27017, and 27018, SOC 2 Type II, and NIST SP 800-53-aligned controls, addresses the CRA’s essential cybersecurity requirements. Tanium is also an officially recognized CVE Numbering Authority (CNA) under the CVE Program, which enables Tanium to directly assign CVE identifiers to vulnerabilities in its own products in support of the CRA’s vulnerability handling and disclosure obligations. Tanium is positioned to meet the CRA’s phased obligations relating to vulnerability and incident reporting, conformity assessments, technical documentation, and CE marking. Payment Card Industry Data Security Standard Tanium is a Payment Card Industry Data Security Standard (PCI DSS) Level 2 Service Provider. Tanium is not a merchant, payment processor, or gateway, and Tanium Cloud is not intended to directly store or process Cardholder Data (CHD) as defined under PCI DSS. Tanium maintains an active PCI DSS compliance program that addresses its role as a service provider that might affect the security of a customer’s Cardholder Data Environment (CDE), including an annually reviewed Self-Assessment Questionnaire (SAQ-D) and Attestation of Compliance (AoC), and quarterly external vulnerability scans performed by an Approved Scanning Vendor (ASV). Where a Tanium product can identify payment card data on customer-managed endpoints, the underlying data remains on the endpoint and is not stored in or retained by Tanium Cloud, as described in the applicable Tanium Privacy Datasheets. The Tanium PCI DSS Charter, AoC, most recent ASV scan report, and PCI DSS Customer Responsibility Matrix, which maps each requirement to Tanium, the customer, or both, are available as Tanium Cloud artifacts within your Tanium Account. Sub-processors Tanium uses sub-processors to host and help provide our services. For more information, see Tanium: List of Sub-Processors. Security policies Tanium operates both of its cloud services in conformance with NIST 800-53 controls. The Tanium Cloud Information Security Management System (ISMS) includes, among others, the following control set families. The Tanium Cloud security policies are available for review as Tanium Cloud artifacts within your Tanium Account. AC – Access Control Policy AT – Awareness and Training Policy AU – Audit and Accountability Policy CA – Security Assessment and Authorization Policy CM – Configuration Management Policy CP – Contingency Planning Policy GP – Governance Policy IA – Identification and Authentication Policy IR – Incident Response Policy MA – Maintenance Policy MP – Media Protection Policy PE – Physical and Environmental Policy PL – Planning Policy PS – Personnel Security Policy RA – Risk Assessment Policy SA – System and Services Acquisition Policy SC – System and Communications Protection Policy SI – System and Information Integrity Policy SR – Supply Chain Risk Management Policy Security measures Logical access controls: Tanium employs the principles of least privilege and need-to-know to control access to Confidential Information and Customer Personal Data. User access privileges are restricted based on business need and job responsibilities, allowing only the minimum necessary access for users to accomplish their job functions. User access is revoked upon termination of employment or termination of relevant job duties, and owners of critical applications or systems are required to perform periodic privileged access reviews to ensure access is still required to perform current job duties. In addition, Tanium protects against unauthorized access by ensuring unique user IDs and passwords are in use. Tanium appropriately manages passwords including enforcing password complexity and by (a) requiring a password length of no less than 14 characters, (b) utilizing expiring first-time log-in temporary passwords, (c) requiring passwords to expire every 90 days, (d) limiting failed attempts before account lockout, (e) not allowing clear text on password entry, and (f) prohibiting password resets that are not subject to confirming credentials. Customer Confidential Information is retained in accordance with Tanium’s Record Retention and Destruction Policy, and the period of retention depends on the nature of the information. Customer Personal Data is retained in accordance with the terms of the Customer’s License Agreement. Information system access control: Access is strictly controlled by a formal provisioning cycle. Information systems are password-protected and have an owner responsible for managing and controlling access. Tanium controls access to the service through authentication that requires a unique user ID and password, and access is logged and audited. In addition, access to the service requires customers to provide their own unique user IDs and passwords with multifactor authentication, which is the responsibility of the customer to manage. Physical access control: Tanium and its sub-processors secure their physical facilities with appropriate environmental and physical controls and restrict access to only authorized personnel. Tanium and its sub-processors maintain visitor access logs, appropriately credential and authenticate employees and visitors, and limit access to physical areas of facilities on a need-to-have basis. Tanium and its sub-processors store Customer Personal Data on secure servers maintained and protected in locked data cabinets within a secure facility. Tanium relies on sub-processor data centers that incorporate physical protection against environmental risks. Physical protection against environmental risks has been validated by an independent auditor engaged by each sub-processor and has been certified as being in alignment with ISO 27001 best practices. Tanium hosts Customer Personal Data in one of the regions offered by Tanium and selected by the Customer. Encryption: Customer Personal Data used within the service is encrypted in transit and at rest using industry-accepted encryption standards. The service encrypts using Transport Layer Security (TLS) 1.3 by default (with a minimum of TLS 1.2 where compatibility requires), with 256-bit encryption, which is required when accessing the service and the API using HTTPS and for all client-to-client and client-to-server communications that use the Tanium-proprietary protocol. Tanium uses modern encryption standards and ciphers to encrypt all network traffic and requires all requests to be authenticated to its service. Furthermore, the Tanium-proprietary protocol digitally signs messages for authenticity, transmits hashed message responses for integrity, and uses mutual Transport Layer Security (mTLS) to authenticate all communications. For all infrastructure that Tanium manages on behalf of customers as part of the Service, Tanium manages the security of service instances using public key infrastructure (PKI) and data at rest encryption (DARE). Tanium leverages a sub-processor Key Management Service (KMS) to generate, manage, use, and annually rotate encryption keys following industry best practices, including using modern standards, ciphers, and strengths. Encryption keys for DARE for the service are used to perform storage-level encryption by the KMS of sub-processor data services, which includes operating system disks and data backups, using,at a minimum, Advanced Encryption Standard (AES) 256-bit encryption. Tanium recommends that customers use secure protocols that offer authentication and confidentiality, such as TLS, to reduce the risk of data tampering or loss when exporting data from the Service. Availability control: Tanium has adopted and maintains a Business Continuity and Disaster Recovery Plan to help ensure continuation of its business and ability to support its customers in fulfillment of its contractual obligations in the event of a disaster. Tanium conducts annual assessments to test the adequacy and operability of its plans, taking measures to update the plan whenever deficiencies are discovered. In addition, the Service is architected for high availability across multiple availability zones within a region. Lastly, Tanium has a documented process to restore customer environments in case of a prolonged outage that is outside of established or expected down times. Data access Tanium Cloud Customer Data resides within the Tanium Cloud boundary. By design and technical enforcement, data is not permitted to leave this boundary. Within the Tanium Cloud boundary, customer data is logically separated using techniques such as labeling, namespacing and unique encryption keys per service instance, helping to ensure that a cloud customer can see the data only from that customer's specific service instance. Tanium automates most management operations while intentionally limiting its own access to the Tanium Cloud service instances. On rare occasions, a Tanium engineer may need limited and logged access to a customer's Tanium environment, including its data, for a brief duration, and only when necessary for normal service operations and troubleshooting, and only when approved by a senior member of the Engineering Team at Tanium. This access by Tanium engineers is restricted by the security and compliance controls for the Tanium Cloud service data region. Tanium requires each Tanium Cloud customer to bring its own SAML2-compliant Identity Provider. This gives the customer complete control over access, authentication, password policies, and procedures for access to Tanium Cloud service. Network ingress The following Tanium Cloud components are directly exposed to the public Internet: Tanium Cloud Client Edge: necessary for Tanium Client communication from endpoints to the service. This traffic is always and only initiated by the Tanium Client, outbound to the Tanium Cloud service. Tanium Account: authenticated with organization-provided identity provider, following identity provider setup For more detailed information on Tanium Cloud network requirements, see Host and network security requirements. In Tanium Cloud, Tanium Console and the Tanium API have an upstream redirect to verify authentication against the organization-provided identity service before reaching these services. Therefore, no unauthenticated internet traffic reaches Tanium Console or the Tanium API. Network egress Most Tanium solutions are configured to fully function by default in Tanium Cloud. However, with certain Tanium solutions, such as Tanium Connect, all possible destinations cannot be predicted. Approved external destinations are listed in the Network Egress Allow List page in your Tanium Account. Destinations in the customer endpoint environment or otherwise external to Tanium Cloud must allow traffic from the egress IPs listed on that page. You can add your own rules to the network egress allow list directly in your Tanium Account. For more information, see Configuring network egress for Tanium Cloud. Tanium does not support sending data over TCP ports 22, 25, 111, 3128, 3129, 3130, 4000, 5000, 6000, 8181, 9091, 9191, 9100, 9301, 9302, 9901, or 9902. Use encrypted communication ports TCP 465 or TCP 587 instead. If you create a rule with external access for an SMTP email server destination (default TCP port 465 or TCP port 587), you can associate the port with only one FQDN. Data retention While most of an organization’s data stays on the endpoints installed with Tanium Clients and is queried in real-time by Tanium Cloud users and services, Customer Data that is processed in use of its service, unless otherwise stated by Tanium, may be retained by Tanium within Tanium Cloud until the customer’s subscription agreement ends. Upon the termination or expiration of the Tanium Cloud agreement, aside from archived backups kept until they are purged by the backup system or where data retention is mandated by law, Customer Data will be automatically destroyed 30 days after the agreement ends. Customers must notify Tanium within these 30 days if they elect for a copy of their data to be returned via a Tanium Cloud supported destination before automatic data destruction. Tanium maintains a policy for retaining and deleting records, information, and data possessed by Tanium personnel that requires Tanium personnel to retain and delete records in compliance with applicable laws and only for as long as needed for business purposes, while minimizing accidental deletion and optimizing storage space. With respect to customer records provided to Tanium for support purposes (for example, support diagnostic files and support bundles), the policy includes retention periods that range from 90 days to one year from the end of a business relationship, depending on the type of customer record and the purpose for which it was provided to Tanium. Service availability Tanium designs the Tanium Cloud service environment to operate across multiple availability zones within the customer-specified data hosting region. Tanium Cloud monitors, alerts, updates, and scales all aspects of the Tanium Core Platform, solutions, and operating environment to ensure availability, security, maintenance, and performance of the service. Through this monitoring and automation, the service aims to achieve 99.9% uptime (SLO). Tanium Cloud uses a combination of high-availability and data replication within multiple availability zones to ensure recoverability of the service in the rare event of an outage or a data loss event. These snapshots are encrypted and occur up to every 24 hours and are stored for up to 30 days within the source data region, for recovery within the sub-processor data services . In addition, Tanium performs regular tests of service backup and recovery processes, at least annually, as evidenced in our external security control assessments. For more information about contingency planning, including RTO and RPO targets, see our policy documents in the artifacts in your Tanium Account. In This Topic Tanium Cloud artifacts Compliance Privacy Security