Embrace Zero Trust for Public Sector Cybersecurity

The entire Zscaler Zero Trust Exchange platform (including ZIA, ZPA, and ZDX) is FedRAMP Moderate and High Authorized.

Zscaler maintains compliance with Criminal Justice Information Services (CJIS), ensuring the protection of information as required by CJIS security policy.

Zscaler has achieved Level 2 certification under the U.S. Department of War’s (DoW) Cybersecurity Maturity Model Certification (CMMC) framework.

Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) are both JAB-High authorized. Also, ZIA is currently the only secure access service edge (SASE) Trusted Internet Connections (TIC) 3.0 solution with FedRAMP High authorization.

Government agencies such as the DoW can leverage our market-leading zero trust platform to take on the user experience and cost challenges of securing cloud-based application access for remote, on-premises, and hybrid users.

Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) have been FedRAMP Moderate authorized since 2018, allowing federal agencies, DoW commands, and federal contractors to take full advantage of the Zero Trust Exchange.
With ZIA and ZPA, agencies can reap the benefits of zero trust security to reduce overhead, streamline operations, and lower costs.

Zscaler is compliant with Federal Information Processing Standard (FIPS) 140-2, meeting NIST requirements for cryptographic modules. View certificates #3154 for Zscaler Mobile Cryptographic Module, #3159 for Zscaler Crypto Module, and #3188 for Zscaler Java Crypto.

Zscaler Internet Access (ZIA) Moderate Cloud has achieved GovRAMP Authorized status, demonstrating our commitment to securing state and local government employees and data.

Zscaler Private Access (ZPA) has achieved a Provisional Authorization (PA) at Impact Level 5 (IL5), as published in the DoW Cloud Computing Security Requirements Guide. This allows government agencies and their contractors to use the Zero Trust Exchange platform for systems that manage their most sensitive Controlled Unclassified Information (CUI) as well as unclassified National Security Systems (NSSs).

Zscaler Internet Access (ZIA) has achieved Authorization to Operate (ATO) at Impact Level 2 (IL2). The DoW’s Defense Innovation Unit has selected Zscaler to prototype ZPA and ZIA as secure access technologies.

Zscaler helps organizations protect federal tax information (FTI) managed on the Zscaler platform by aligning our implementations of NIST 800-53 and FedRAMP security controls with IRS Publication 1075 security requirements. Zscaler GovClouds (US) meet Publication 1075 requirements for storing and processing FTI.

Zscaler has achieved the ISO 27001 certificate, following the ISO/IEC 27002: 2013 best practice, attesting that our services are based on internationally recognized best practices for information security management and comprehensive security controls.
Read the full report

Zscaler adheres to National Institute of Standards and Technology (NIST) Special Publication 800-53, ensuring sufficient protection of confidentiality, integrity, and availability of information and information systems.

NIST Special Publication 800-63C provides requirements to identity providers (IdPs) and relying parties (RPs) of federated identity systems. Federation allows a given IdP to provide authentication attributes and (optionally) subscriber attributes to a number of separately administered RPs through the use of assertions. Similarly, RPs may use more than one IdP.

The SOC 2 Type II report provides independent validation that our security controls are in accordance with the American Institute of Certified Public Accountants’ applicable Trust Services Principles and Criteria.

Zscaler completed the Trusted Internet Connection (TIC) 3.0 Overlay review with the Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA).

Zscaler has achieved Texas Risk and Authorization Management Program (TX-RAMP) Level-2 authorization, enabling Zscaler to operate with confidential/regulated data in moderate or high-impact systems.

In recognition and support of the Electronic and Information Accessibility Standards defined by Section 508 of the Rehabilitation Act, we publish accessibility self-assessments of our products using Voluntary Product Accessibility Templates (VPATs).