Acronis

Cybersecurity Switzerland Website Reviewed Sept. 22, 2026

Cyber protection vendor combining backup, disaster recovery, anti-malware and endpoint management for MSPs and enterprises.

Report an issue with this profile

Certifications & Accreditations

Certification Certifying Body Scope Achieved Expiry Status
ISO 27000 series Not stated by vendor Acronis lists the ISO 27000 "series" — a family of standards, not a specific certificate. No auditor, scope or dates published. — — Current
SOC 2 Not stated by vendor Listed on the Acronis trust centre compliance page; no auditor, scope or dates published. — — Current
ISO 9001 Not stated by vendor Listed on the trust centre; no version year, auditor, scope or dates published. — — Current
PCI DSS Not stated by vendor Listed on the trust centre; no version, level or AoC published. — — Current
Cyber Essentials Not stated by vendor Listed on the trust centre; no certificate, level or dates published. — — Current
CSA STAR Level 2 Cloud Security Alliance Listed on the trust centre. — — Current
FIPS 140-2 Not stated by vendor Listed on the trust centre; certificate number not published. — — Current

Compliance Frameworks

ISO/IEC 27001:2022
Partial
Acronis lists the ISO 27000 series rather than a specific ISO 27001 certificate; no auditor, scope or dates published.
SOC 2 Type 2
Partial
Listed with no auditor, scope or dates.
ISO 9001:2015
Partial
Listed with no version year or certifying body.
Cyber Essentials
Partial
Listed with no certificate or level.
PCI DSS v4.0
Partial
Listed with no version, level or AoC.

Data Handling

Data Residency Regions
Global Acronis Cloud data centres; region list not enumerated on the compliance page
Encryption at Rest
No
Encryption in Transit
No

Incident & Breach History

Date Summary Impact Resolution Report
July 29, 2024 CVE-2023-45249 in Acronis Cyber Infrastructure — an insecure default password allowing remote code execution — was added to the CISA Known Exploited Vulnerabilities catalog. Confirmed exploited in the wild against unpatched instances. The CVE is 2023-dated but exploitation surfaced mid-2024. Patched in earlier ACI builds; customers on unpatched instances required to upgrade. Report ↗
March 9, 2023 Data posted to BreachForums was claimed as an Acronis breach; Acronis’ own analysis states the credentials of one customer, used to upload diagnostic data to Acronis Support, were compromised outside Acronis systems. Roughly 12–21GB of diagnostic data posted. Acronis states no Acronis systems or networks were compromised, no lateral movement occurred and the diagnostic set contained no sensitive data. Account access blocked, logs reviewed, IOCs shared and law enforcement engaged. Report ↗

Evidence quality caveat

Acronis publishes a long compliance list but **no auditor, scope statement or dates for any of it**, and the headline entry is the ISO 27000 *series* rather than a specific ISO 27001 certificate. Treat every entry here as a vendor assertion pending certificates.

Its security advisory portal is JavaScript-gated and could not be machine-read, so the incident entries lean on CISA KEV and Acronis’ own blog rather than its advisory text.

Assess Acronis in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register