ConnectWise
Vendor of PSA, RMM, remote access and cybersecurity software for managed service providers, including ScreenConnect and the Asio platform.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| SOC 2 | Aprio LLP (named on the public SOC 3 report — re-verify) | Business Management & CW Platform profile: SSO, PSA, CPQ, RMM, BrightGauge, ITBoost, Cloud billing, Identify Assessment, Co-Managed Backup. | — | — | Current |
| SOC 2 | Aprio LLP (re-verify) | Unified Monitoring & Management profile: ConnectWise Automate and ScreenConnect. | — | — | Current |
| SOC 2 | Aprio LLP (re-verify) | Cybersecurity Management profile: Co-Managed SIEM, ConnectWise SIEM. | — | — | Current |
| ISO/IEC 27001:2013 | Not published | ConnectWise Cloud Backup and SaaS Security ONLY. Note this is the withdrawn 2013 version of the standard. | — | — | Current |
| ISO/IEC 27701:2019 | Not published | ConnectWise Cloud Backup and SaaS Security only. | — | — | Current |
| CSA STAR Level 2 | Cloud Security Alliance | ConnectWise Cloud Backup and SaaS Security only. | — | — | Current |
| SOC 3 | Aprio LLP (re-verify) | Publicly distributable; e.g. ConnectWise RMM 2023 SOC 3 Type II report. | — | — | Current |
Compliance Frameworks
SOC 2 Type 2
Partial
SOC 2 across four separate product profiles; reports gated behind a Whistic account and annually renewed NDA.
ISO/IEC 27001:2022
Partial
ISO 27001 is confined to the Data Protection line (Cloud Backup, SaaS Security) and is against the withdrawn 2013 version. PSA, RMM, Automate and ScreenConnect have SOC 2 only.
GDPR 2016/679
Partial
Published DPA templates and a detailed public per-product sub-processor list. DPF member; UK Extension under review.
Data Handling
Data Residency Regions
AWS: AU, CA, DE, IN, IE, JP, SG, ZA, UK, US. Azure: AU, CA, FR, DE, HK, IE, JP, NL, NO, SG, ZA, SE, CH, UK, US. Also OVH, IBM, Equinix
Encryption at Rest
No
Encryption in Transit
No
Incident & Breach History
| Date | Summary | Impact | Resolution | Report |
|---|---|---|---|---|
| May 28, 2025 | ConnectWise disclosed suspicious activity in its environment that it believed was tied to a sophisticated nation-state actor, affecting ScreenConnect customers. | ConnectWise stated a very small number of ScreenConnect customers were affected; it did not disclose the breach date or customer count. | Mandiant engaged for forensics, all affected customers contacted, law enforcement coordination, enhanced monitoring and network hardening. Related CVE-2025-3935 (ScreenConnect ViewState code injection, patched 24 Apr 2025) was added to CISA KEV in June 2025, though ConnectWise did not confirm the CVE linkage. | — |
| Feb. 21, 2024 | ScreenConnect authentication bypass CVE-2024-1709 ("SlashAndGrab") plus a path-traversal flaw were mass-exploited to deploy ransomware. | Widely exploited against internet-exposed on-premises ScreenConnect servers. | Cloud partners remediated by the vendor; on-premises partners told to upgrade to 23.9.8, or at minimum 22.4.20001 if off maintenance. | Report ↗ |
| Feb. 1, 2019 | A plugin syncing ConnectWise Manage with Kaseya VSA allowed unauthenticated operations on a Kaseya server and was exploited to deploy GandCrab ransomware against MSPs. | One MSP had roughly 2,000 managed computers encrypted with a $2.44M demand; Kaseya found 126 of around 10,000 customers still running the vulnerable plugin. | The flaw was patched in Feb 2018, over a year before the attacks; ConnectWise hardened the patch against improper installation, added persistent login-screen notifications and contacted customers directly. | — |
Contact & Responsible Disclosure
- Security Contact [email protected]
- Responsible Disclosure View policy ↗
- Bug Bounty Platform HackerOne Response (intake only, no paid bounty)
Certification is product-scoped, not company-wide
ConnectWise splits its attestations across **four separate Whistic profiles**, and the split matters:
- **ISO 27001, ISO 27701 and CSA STAR cover only the Data Protection line** (x360Recover, x360Cloud, x360Sync, Cloud Backup, SaaS Security — the Axcient and SkyKick-derived products acquired in Sept 2024).
- **The flagship products — PSA, RMM, Automate and ScreenConnect — have SOC 2 only.**
- The ISO 27001 is against **ISO/IEC 27001:2013**, a withdrawn version.
Partner InfoSec hotline for active incidents: 1-888-WISE911. ConnectWise has signed the CISA Secure by Design pledge and publishes a dated advisory feed.
Copyright © 2026 SnapGRC