BeyondTrust

**Trust Centre:** https://www.beyondtrust.com/trust-center
**Gated trust portal (for security reviews):** https://trustportal.beyondtrust.com
**Privacy Centre:** https://www.beyondtrust.com/privacy-center

**Publicly available without NDA**
- Industry certifications page with named scopes AND expiry dates: https://www.beyondtrust.com/trust-center/industry-certifications
- Corporate security programme and the full list of ISMS policy topics: https://www.beyondtrust.com/trust-center/security
- Cloud security, BC/DR approach, uptime SLA: https://www.beyondtrust.com/trust-center/cloud-security
- Application security, responsible disclosure, SDLC and SBOM commitment: https://www.beyondtrust.com/trust-center/application-security
- Numbered security advisories with CVEs, CVSS scores and public dates: https://www.beyondtrust.com/trust-center/security-advisories
- Sub-processor and affiliate list with corporate addresses and DPO contacts: https://www.beyondtrust.com/privacy-center/sub-processors-list
- DPA, GDPR statement, privacy FAQs, AI policy, government access request policy
- ISO 27001, ISO 27701, DPF, FIPS 140-2, Common Criteria and TX-RAMP certificates are linked directly from the certifications page

**Gated / NDA required**
- SOC 2 Type 2 reports (both AWS-hosted and Azure-hosted variants)
- ISMS policies and standards, incident response plan, BC/DR plan and test results
- Cloud Security Guide, SBOMs, penetration test evidence

**The 26 ISMS policy and standard topics published by BeyondTrust**
Access Management; Asset Management; Audit Management; Change Management; Communications Management; Configuration Management; Use of Cryptography; Data Protection; Device & Media Control; Disaster Recovery & Business Continuity Management; Endpoint Use & Endpoint Security; Exception and Approval Process; Human Resources Security Management; Incident Management; Information Lifecycle Management; Information Security Management; Logging & Monitoring Management; Network Security Management; Password & Authentication Management; Patch Management; Personal Information Management; Physical & Environmental Security Management; Risk Analysis & Management; Software Development; Third-Party Risk Management; Vulnerability Management.

**Corporate control measures published**
Pre-employment background checks globally (identity, right to work, criminal record, credit, education, drug screening); mandatory security awareness training pre-employment and annually with phishing simulations; SSO with FIDO2 MFA and least privilege; full disk encryption, EDR, web content filtering and centralised configuration management on endpoints; next-generation internet-edge firewalls; dedicated Security Operations Centre with centralised SIEM ingestion; documented incident response covering identification, containment, eradication, recovery and lessons learned.

**Gaps noted at review**
- No public master agreement or terms of service page could be located; contractual terms appear to be negotiated per customer. Only product-specific EULAs (e.g. the Discovery Tool EULA) and the customer support guide are public.
- The sub-processor page "Summary of Changes" log shows only one entry, 23 April 2024 (page publication). Either the list has not changed in over two years or changes are not being logged - ask BeyondTrust to confirm.
- No backup frequency, RTO or RPO figures published, and no published data retention periods.

**Inherent risk drivers**
- BeyondTrust is a privileged access management vendor. Its products hold and broker credentials for the most privileged accounts in the estate and, in the case of Remote Support and Privileged Remote Access, provide interactive remote control of endpoints and servers. Compromise of the vendor or the product is a direct path to domain-level compromise. Treat inherent risk as **critical**.
- Remote Support / Privileged Remote Access are internet-facing by design and have a sustained record of critical vulnerabilities: CVE-2024-12356 (9.8), CVE-2025-5309 (8.6), CVE-2026-1731 (9.9) and four further high/critical issues in BT26-03 (up to 9.2) in July 2026.
- The December 2024 incident is the clearest demonstrated risk: a compromised BeyondTrust infrastructure API key allowed a China-nexus actor into 17 customers’ Remote Support SaaS instances by resetting local application passwords. This was a genuine supply-chain compromise of the PAM layer, not a theoretical one.
- Cloud products are split across AWS and Azure by product, so assurance and residency answers differ depending on which BeyondTrust product you buy.

**Mitigating factors**
- ISO/IEC 27001:2022 plus ISO/IEC 27701 PIMS certification, and two SOC 2 Type 2 reports covering the AWS- and Azure-hosted product sets.
- FedRAMP Moderate for Secure Remote Access and TX-RAMP Level 2 for three product lines - meaningful government-grade scrutiny of the highest-risk products.
- Genuinely good vulnerability transparency: numbered advisories with CVEs, CVSS scores and dates, and self-disclosure of internally discovered issues rather than waiting for researchers.
- Strong, specific incident handling in December 2024: key revoked and instances quarantined the same day the anomaly was confirmed, public advisory within three days, third-party forensics firm already on retainer, law enforcement engaged, IoCs published and a dated closure statement.
- Well-documented corporate controls: FIDO2 MFA on SSO, EDR and full disk encryption, dedicated SOC with SIEM, global background checks, annual awareness training with phishing simulation.
- Sub-processor list is unusually detailed - corporate addresses, hosting location and a named DPO contact for each - with a 30-day objection window.

**Concerns to track**
- **ISO 27001 and ISO 27701 certificates show an expiration date of 21 August 2026, roughly two weeks after this review.** Obtain the renewal certificates before relying on them.
- **All three Data Privacy Framework certifications show a published expiration of 24 March 2026, which has already passed.** Verify BeyondTrust’s current status on the official DPF list; if lapsed, the SCC route in the DPA is the operative transfer mechanism.
- **PCI DSS is Level 4 MERCHANT compliance only.** It says nothing about the products’ suitability for cardholder data environments. Do not let this appear as "PCI DSS certified" in a risk register without that qualifier.
- FIPS 140-2 covers **Remote Support only** and dates from April 2021; FIPS 140-2 is superseded by 140-3. Common Criteria dates from June 2018. Both are stale.
- FedRAMP Moderate and each TX-RAMP certificate are product-specific. Do not credit them across the portfolio.
- No named third-party penetration testing firm, no published external testing cadence and no pen test report - testing is described as part of the in-house SDLC. This is weaker than every other vendor currently in this library.
- No published backup frequency, RTO, RPO or data retention periods. The 99.9% uptime SLA is stated but RTO/RPO explicitly "may vary".
- No bug bounty and no researcher rewards, which may reduce external vulnerability discovery relative to peers.
- Sub-processor change log has not been updated since the page was published in April 2024.
- Entitle (acquired) introduces a distinct sub-processor set (Datadog, GitHub, Slack, LogRocket) and an Israeli affiliate, Entitle Inc.

**Residual customer responsibilities**
- Patch self-hosted appliances promptly and enable "Apply Critical Updates Automatically" in the /appliance interface. The December 2024 guidance makes clear self-hosted customers own their own patching.
- Prefer external SAML authentication over local application accounts, and delete unused accounts - local password reset was the exact mechanism abused in the 2024 incident.
- Integrate session data and configuration/authentication events into your own SIEM via syslog or middleware and review them; do not rely on vendor-side detection.
- Apply least privilege to user roles, capabilities and endpoint access; use the Session Policy simulator to validate policies.
- Periodically review all active accounts, especially admins, deactivate unused ones and rotate passwords.
- Enable network restrictions and outbound event notifications where possible.
- Confirm your hosting region per product and obtain the SOC 2 report matching your hosting platform.
- Execute the DPA and confirm the current transfer mechanism given the DPF expiry.

**Suggested review cadence:** semi-annual reassessment rather than annual, given the criticality of the PAM layer and the frequency of critical CVEs. Subscribe to the advisories page and treat any critical Remote Support or Privileged Remote Access advisory as an immediate out-of-cycle trigger. Re-check the ISO and DPF certificate status before the next assessment closes.