Barracuda Networks
Email, application, network and data protection vendor offering email security, backup, WAF and firewall products for SMBs and MSPs.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| ISO/IEC 27001 | Not published | Scoped to Barracuda Cloud-to-Cloud Backup ONLY — product-specific, not company-wide. A Statement of Applicability is published. | — | — | Current |
| SOC 2 | AICPA framework; auditor not published | Presented company-wide on the trust centre; no date published. | — | — | Current |
| ENS (High) | Esquema Nacional de Seguridad | Verifiable on the Spanish ENS portal. | — | — | Current |
| FIPS validation | NIST CMVP | Cryptographic modules. | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Partial
Certification covers only Barracuda Cloud-to-Cloud Backup, not the company or the email security products.
SOC 2 Type 2
Partial
Presented company-wide; auditor and date not published.
Cyber Essentials
In Progress
Listed by Barracuda as in progress (self-assessment), not held.
PCI DSS v4.0
In Progress
Listed as in progress (SAQ-D), not held.
Incident & Breach History
| Date | Summary | Impact | Resolution | Report |
|---|---|---|---|---|
| May 19, 2023 | CVE-2023-2868, a zero-day in the Barracuda Email Security Gateway appliance, allowed arbitrary command execution through incomplete validation of user-supplied .tar filenames. | Affected physical and virtual ESG appliances, versions 5.1.3.001 to 9.2.0.006; Barracuda SaaS email products were unaffected. Exploitation by China-nexus actor UNC4841 was traced back to October 2022 — roughly seven months of undetected access — with persistent backdoors (SALTWATER, SEASPY, SEASIDE) deployed. | Patches issued 20 and 21 May 2023. Unusually, Barracuda and the FBI then told customers that **patching was insufficient and compromised appliances had to be physically replaced**, provided free of charge. | Report ↗ |
Certification scope and in-progress items
**ISO 27001 covers only Barracuda Cloud-to-Cloud Backup**, not the company and not the email security gateway products.
Listed as **in progress, not held**: ISO 27017, ISO 27018, ISO 42001, GovRAMP, PCI DSS (SAQ-D), CICLON, CMMC Level 1 (self-assessment) and UK Cyber Essentials (self-assessment).
The 2023 ESG incident is the most consequential in this part of the library: the remediation required physical appliance replacement, not patching.
Copyright © 2026 SnapGRC