Skip to content
Search to learn about InterSystems products and solutions, career opportunities, and more.

InterSystems Cybersecurity

Building Trust by Protecting Information

InterSystems Cybersecurity and You

Trust is fundamental to the success of any organisation. When it comes to technology, the cloud, or AI, customers, patients, consumers, clients, employees, or whoever demand that cybersecurity, privacy, data protection, and product security sit at the centre of that trust. At InterSystems, this means we look to meet or exceed the legal and regulatory requirements for privacy and security anywhere in the world. To do so, we focus on:

  • Supporting your commitment to your patients, customers, employees, and others that your organisation can be trusted with their information
  • Enhancing our cybersecurity, privacy, data protection, and product security efforts across our products and services
  • Delivering appropriate protections for cybersecurity and privacy when dealing with any personal information
  • Underscoring our dedication to deliver protected and secure products and services with relevant assurance, such as independent audit reports

InterSystems has earned and maintained the trust of our customers worldwide for almost 50 years. Our software technology and integrated solutions handle some of the most sensitive information in healthcare, financial services, government, and other industries—keeping it protected and secure.

Trust is at the core of our business philosophy, from delivering valuable solutions, to unwavering customer service, to secure and tested code. InterSystems Cybersecurity is how we deliver on our assurances.

The Framework

InterSystems Cybersecurity structures cybersecurity, privacy, data protection, and product security controls in a framework that can be applied consistently and reliably in any organization. In the framework, privacy and data protection concentrates on collection, use, and disclosure of information with a special focus on personal information. Cybersecurity and product security emphasizes confidentiality, integrity, and availability across our products and services.

global trust framework, structuring privacy and security controls that can be applied consistently and reliably in any organization

Privacy

Collection addresses how the enterprise gathers information. Use addresses how the enterprise processes the information. Disclosure addresses how the enterprise shares the information. In our solutions and services, we align these operations with current law and regulation for the industries where we operate, such as healthcare or financial services. In terms of implementation, we break the process down to effectively deploy people, processes, and technology to deliver the best results.

Security

Confidentiality addresses how the enterprise controls access to information. Integrity addresses how the enterprise maintains current and accurate information. Availability addresses how the enterprise ensures that information is available whenever it is needed. As with privacy, in our solutions and services we align these operations with current regulations in the industries where we operate. In terms of implementation, we also break the process down understanding the people, processes, and technology that best support our solutions and services.

Data Protection, Privacy & Security Policy

The InterSystems Data Protection, Privacy & Security Policy provides protections and safeguards through our people, processes, and technologies to ensure the legitimate use, proper disclosure, and minimal contact of any Personal, Sensitive, or Confidential Information. Under this policy, personal information includes all data that either (i) identifies or can be used to identify, contact or locate an individual, or (ii) relates to an individual, whose identity can be either directly or indirectly inferred, including any information that is linked or linkable to that individual regardless of any attributes or status of such individual. This policy reinforces our Cybersecurity processes whether InterSystems is a Covered Business, Personal Information Processor, Data Controller, Data Processor, Business Associate, or Covered Entity.

Data Protection, Privacy & Security Policy

Begin a Conversation

Cybersecurity and privacy are not tangible products. You cannot touch them or put them on a shelf, yet they are crucial to the success of your organisation. Cybersecurity and privacy are attitudes and approaches – the culture you establish—plus policies and procedures supported by necessary technology.

InterSystems invites you to begin a conversation on the culture and technology of InterSystems Cybersecurity by sending an email to Building.Trust@intersystems.com. Our Cybersecurity Department will be happy to discuss with you our approach to trust and how we can help you sustain it for your organisation.

Cybersecurity and You

Trust is at the core of our business philosophy, from delivering valuable solutions, to unwavering customer service, to secure and tested code.

Certifications

ISO 27001 Certificate
The InterSystems Information Security Management System is certified under ISO 27001 covers the provision of software products and services including sales (sales engineering and marketing), delivery (design and development, quality assurance, build and release engineering, training and documentation, and implementation), support, hosting (utilising third-party data centres and third-party cloud providers), and associated internal operations (including corporate IT) provided from United Kingdom and Ireland locations, from Spain and Portugal locations, and for Managed Services from Australia and New Zealand locations.

Learn More
ISO 22301 Certificate
The InterSystems Business Continuity Management System is certified under ISO 22301 covers the provision of software products and services including sales (sales engineering and marketing), delivery (design and development, quality assurance, build and release engineering, training and documentation, and implementation), support, hosting (utilising third-party data centres and third-party cloud providers), and associated internal operations (including corporate IT) provided from United Kingdom and Ireland locations, from Spain and Portugal locations, and for Managed Services from Australia and New Zealand locations.

Learn More
ISO 20000-1 Certificate
The InterSystems Service Management System is certified under ISO 20000-1 covers the provision of software products and services including sales (sales engineering and marketing), delivery (design and development, quality assurance, build and release engineering, training and documentation, and implementation), support, hosting (utilising third-party data centres and third-party cloud providers), and associated internal operations (including corporate IT) provided from United Kingdom and Ireland locations, from Spain and Portugal locations, and for Managed Services from Australia and New Zealand locations.

Learn More
SOC 3 Audit Report (Managed Services US)
The InterSystems Managed Services US operations are audited against the trust services criteria relevant to security, availability, and confidentiality (applicable trust services criteria) set forth in TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy)

Learn More
HITRUST Letter of Certification
The InterSystems Managed Services US operations are audited by an Authorized External Assessor to validate there were no material changes to the control environment that would result in InterSystems Corporation no longer meeting certification criteria of the and therefore continues to meet the HITRUST CSF® v11 Risk-based, 2-year (r2) certification criteria. (Note that as a 2-year certification the Letter of Certification in year one is followed by a Interim Letter in year-two)

Learn More
HITRUST Interim Letter
The InterSystems Managed Services US operations are audited by an Authorized External Assessor to validate there were no material changes to the control environment that would result in InterSystems Corporation no longer meeting certification criteria of the and therefore continues to meet the HITRUST CSF® v11 Risk-based, 2-year (r2) certification criteria. (Note that as a 2-year certification the Letter of Certification in year one is followed by a Interim Letter in year-two)

Learn More
Cyber Essentials Plus
InterSystems UK operations are audited to the United Kingdom National Cyber Security Center standard for Cyber Essentials Plus.


Learn More
NHS Data Security and Protection Toolkit
InterSystems UK operations are assessed through the Data Security and Protection Toolkit against the National Data Guardian’s 10 data security standards.


Learn More

Product Security

Secure Coding Practices Policy
This policy highlights specifics of our development and quality processes as they pertain to maintaining and delivering secure products.

Learn More
Secure Development Lifecycle Overview
The InterSystems Secure Development Lifecycle (SDLC) helps ensure secure products and services are delivered to customers and end-users.

Learn More
Reporting a Potential Security Vulnerability
InterSystems supplements and enhances our development and quality processes through a means to allow for the reporting of security/privacy vulnerabilities in our products.

Learn More
InterSystems Product Information & Release Notes
Information regarding current and previous releases of InterSystems products, including InterSystems IRIS®, Caché, Ensemble, and HealthShare

Learn More
Minimum Supported Product Version
This page details the minimum supported versions of InterSystems IRIS®, Caché, Ensemble, and HealthShare by platform.

Learn More
Security Vulnerability Handling Policy
This policy supplements InterSystems Minimum Supported Version statement to clarify how security corrections are released and how customers can receive information about security issues.

Learn More

Cybersecurity and Privacy

InterSystems Data Protection, Privacy & Security Policy
This policy highlights more specifics of our data protection, privacy, and security practices as they pertain to the InterSystems processes, products, and services.

Learn More
InterSystems GDPR Statement
This GDPR Statement will serve as an addendum to the License Agreements and any relevant service agreements for InterSystems products to ensure contractual compliance with the General Data Protection Regulation (GDPR) Regulation (EU) 2016/679.

Learn More
Information Sharing Terms
Information security and privacy are forefront concerns for InterSystems when interacting with our customers, partners, or other parties. The Information Sharing Terms apply to and parties disclosing or communicating information to InterSystems Corporation and its subsidiaries and affiliates.

Learn More
Managed Services Security Practices White Paper
This white paper highlights more specifics of our security practices as they pertain to the InterSystems Managed Services environment.

Learn More