Compliance & Certifications

Certifications, Regulations, and Standards

Our dedicated Information Security and Privacy teams are responsible for maintaining McAfee's compliance to a variety of laws, standards, and frameworks, including:

ISO 27001

Information technology - Security techniques - Information Security Management Systems – Requirements

ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in ISO/IEC 27001:2013 are generic and are intended to be applicable to all organizations, regardless of type, size or nature.

ISO 27001 Certificate >

To verify our certification, please visit:
https://www.schellman.com/certificate-directory

ISO 27701

Information Technology - Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines

ISO 27701 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization.

ISO 27701 specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing.

ISO 27701 Certificate >

To verify our certification, please visit:
https://www.schellman.com/certificate-directory

ISO 27017

Information technology - Security techniques - Code of practice for information security controls based on ISO/IEC 27002 for cloud services

ISO/IEC 27017 gives guidelines for information security controls applicable to the provision and use of cloud services by providing:

Additional implementation guidance for relevant controls specified in ISO/IEC 27002
Additional controls with implementation guidance that specifically relate to cloud services

ISO 27017 Certificate >

To verify our certification, please visit:
https://www.schellman.com/certificate-directory

ISO 27018

Information technology - Security techniques - Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services.

ISO 27018 Certificate >

To verify our certification, please visit:
https://www.schellman.com/certificate-directory

PCI DSS

PCI DSS v3.2.1 - PCI Data Security Standard Requirements and Security Assessment Procedures

The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect account data. PCI DSS applies to all entities involved in payment card processing - including merchants, processors, acquirers, issuers, and service providers. PCI DSS also applies to all other entities that store, process or transmit cardholder data (CHD) and/or sensitive authentication data (SAD).

PCI DSS Certificate >

Transparency Reports

McAfee is committed to publishing data regarding requests or demands for customer data received from law enforcement and national security agencies

McAfee shall publish this data twice per year (covering a reporting period of either January-to-June or July-to-December). Said reports are published six months after the end of a given reporting period in compliance with restrictions on the timing of such reports.

Transparency Reports >

Contact Us