Rubrik Compliance Program

The Federal Risk and Authorization Management Program is a United States federal government-wide compliance program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. Rubrik Security Cloud-Government (RSC-G) has achieved FedRAMP Moderate authorization. 

GovRAMP promotes cybersecurity best practices through education and policy development to improve the cyber posture of public institutions and the citizens they serve. GovRAMP’s governance committees adopt policies and procedures that standardize security requirements for providers. GovRAMP’s Program Management Office then verifies that those cloud offerings utilized by government satisfy adopted security requirements through independent audits and continuous monitoring. Products that are working towards or have achieved GovRAMP Authorizations are included on the GovRAMP Authorized Products List. Rubrik Security Cloud - Government (RSC-G) has achieved a Moderate level authorization. The list of participating governments is growing.

The Texas Risk and Authorization Management Program (TX-RAMP) is a program that provides review of security measures taken by cloud products and services that transmit data to Texas state agencies. Cloud service providers like Rubrik must demonstrate compliance with the security criteria to receive and maintain a TX-RAMP certification for a cloud computing service. Rubrik Security Cloud - Government (RSC-G) has achieved a Level 2 authorization.

The U.S Federal Government’s Criminal Justice Information Services (CJIS) Security Policy provides participating Criminal Justice Agencies (CJA) and Noncriminal Justice Agencies (NJCA) with a minimum set of security requirements for access to FBI CJIS systems, and information requirements for the protection and safeguarding of CJI. Rubrik’s third-party Attestation confirms that Rubrik Security Cloud - Government (RSC-G) is maintaining a cyber security program consistent with the applicable federal and state laws, regulations, and standards. States wishing to ensure their full compliance with CJIS policy must also execute an Information Agreement and CJIS Security Addendum between their state’s CJIS Authority and Rubrik.

Rubrik is a Business Associate to Covered Entity Customers under the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is focused on ensuring the privacy and security of protected health information of individuals. Rubrik Security Cloud - Government (RSC-G) has a third party Attestation of Compliance with HIPAA Requirements covering HIPAA’s Privacy, Security, and Breach Notification Rules. 

The U.S Federal Government’s Family Education Rights and Privacy Act (FERPA) refers to requirements that U.S. academic institutions must adhere to when handling sensitive student data, including educational information and PII. These requirements cover cybersecurity, administrative privacy measures, and disclosures of rights to parents and students.

To the extent Rubrik handles student education records within Rubrik Security Cloud - Government (RSC-G), our cloud service aligns to the limitations and requirements imposed by 34 CFR 99.33(a).

The Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC) establishes software conformance to the NIST 800-171 standard (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). Rubrik Security Cloud - Government has a third party Attestation for CMMC L2.  Rubrik Security Cloud - Private / CDM has a Controls Analysis Summary against the CMMC L2 controls set.

The Department of Defense Information Network (DoDIN) Approved Product List (APL) provides a consolidated list of products that are approved for purchase by the U.S. Department of Defense (DOD), including Rubrik Security Cloud - Private (RSC-P) and Cloud Data Management (CDM).

Common Criteria is an internationally recognized set of guidelines that define a framework for evaluating security features and capabilities of IT security products. Rubrik Security Cloud - Private (RSC-P) and Cloud Data Management (CDM) maintain EAL2+.

FIPS 140 is a government computer security standard used to approve cryptographic modules for use in government departments and regulated industries. Rubrik Security Cloud - Private (RSC-P), Cloud Data Management (CDM), and Rubrik Security Cloud - Government utilize FIPS 140-2 and FIPS 140-3 validated cryptography.

Executive Order 14028 on Improving the Nation’s Cybersecurity is intended to enhance federal cybersecurity. In accordance with this EO, Rubrik adheres to certain baseline security standards for development of software sold to the government and supply chain security associated with the software. We maintain Attestations for Rubrik products meeting EO14028 requirements within the government’s Repository for Software Attestations and Artifacts web site.