Okta

**Primary trust portal:** https://security.okta.com (SafeBase) - reached from https://trust.okta.com. Public status and availability: https://status.okta.com (trust page reports 12-month availability of 99.99%, averaged across incidents affecting at least 10% of customers).

**Publicly available without NDA**
- Full compliance badge list, control descriptions and policy summaries on the trust centre landing page
- SOC 3 report (public summary)
- Sub-processor list: https://www.okta.com/en-gb/legal/trustandcompliance/subprocessors/
- Data Processing Addendum, SCCs, Information Security Addendum, Business Associate Agreement, Government Request Transparency Report, Modern Slavery statement, EU Cloud Code of Conduct public report of adherence and AI Model Cards: https://www.okta.com/trustandcompliance/
- Vulnerability Reporting Policy and Bugcrowd programmes
- Security advisories and RSS: https://trust.okta.com/security-advisories/
- Security blog: https://sec.okta.com

**Gated behind trust-centre access request / NDA**
- SOC 1 and SOC 2 Type 2 reports
- ISO 27001 / 27017 / 27018 certificates
- CSA STAR Level 2 certification, CAIQ, HECVAT, MVSP
- IRAP Protected documentation, ENS (Royal Decree 311/2022) report, PCI DSS AoC
- Penetration test reports and the Okta FastPass Assessor’s Report
- Information Security Policy, Okta Control Library, BCP/DR attestation, incident response plan, endpoint security standard, release management procedure

**Additional trust-centre claims recorded here but not held as separate certificates:** CISA Secure-by-Design Pledge signatory, NIST 800-53 Rev. 5 (via FedRAMP), EU-US / Swiss-US DPF and UK Extension, GDPR, HIPAA, DORA, ENS, APEC/Global CBPR and PRP, ProcessUnity and TruSight questionnaire participation, VPAT accessibility conformance.

**Other notes**
- Okta runs a "Pooled Security Audits" programme allowing customers to share audit effort - see https://sec.okta.com/articles/pooledauditretro/
- Customers should set a Primary Security Contact and CIO/CISO contact in the Okta Help Center so Okta can alert them to organisation-specific threats.
- Sub-processor change notifications are opt-in by emailing [email protected] with an executed DPA; customers have 10 business days to object.

**Inherent risk drivers**
- Okta is an identity provider and therefore a single point of authentication for every downstream application it fronts. Compromise of the Okta tenant is effectively compromise of the whole estate, so inherent risk should be treated as **critical** regardless of the data volume held.
- Holds authentication credentials, MFA factors, session tokens, directory attributes and detailed sign-in telemetry.
- Highly attractive target: Okta has been the subject of two widely reported supply-chain style incidents (the January 2022 Lapsus$/Sitel third-party support compromise and the October 2023 Help Center incident recorded above).
- Long fourth-party chain. Okta depends on AWS, Google and Microsoft Azure for hosting, plus Twilio, TeleSign and SendGrid for out-of-band authentication delivery - meaning MFA availability depends on third-party telecom providers.
- Outsourced 24x7 support in Romania (CGS) with potential access to production support data. This was the risk pattern behind the 2022 incident.

**Mitigating factors**
- Very broad and independently audited assurance set: SOC 1/2/3, ISO 27001/27017/27018, CSA STAR Level 2, BSI C5, PCI DSS v4.0.0, IRAP, FedRAMP High and Moderate, DoD IL5, GovRAMP, TISAX, EU Cloud Code of Conduct and FIPS 140-2 validated crypto.
- Per-tenant encryption keys at rest and TLS with PFS and HSTS in transit.
- Public, dated and product-segmented sub-processor list with an opt-in notification and objection process - materially better transparency than most vendors in this library.
- Annual third-party penetration testing plus a continuous internal penetration testing team and two public Bugcrowd programmes.
- Quarterly DR testing with regional and geographic DR capacity; BCP/DR and incident response attested within SOC 2 Type II.
- Demonstrated incident transparency: root cause analysis, recommended actions, independent forensic review by Stroz Friedberg and published closure.
- Concrete product hardening delivered after 2023 (Zero Standing Privileges for admins, MFA for protected admin actions, IP binding, API network zone allowlisting, anonymiser blocking) and the ongoing Okta Secure Identity Commitment.

**Concerns to track**
- Verify which cell your tenant is in. Data residency, and which sub-processors apply, differ per cell and per SKU - EU cell data can still flow to US-hosted Splunk, Datadog or Google depending on the service.
- FedRAMP High, FedRAMP Moderate, DoD IL5 and GovRAMP apply **only** to Okta for Government / US Military subscriptions. Do not credit these to a commercial tenant.
- Retention periods are in separate Okta and Auth0 Data Retention Policy documents and vary by product and log type; confirm actual figures rather than assuming.
- CDN processing for Auth0 via Cloudflare is explicitly global and cannot be pinned to a region.
- MFA delivered by SMS depends on Twilio/TeleSign; prefer phishing-resistant factors (Okta FastPass, WebAuthn) to reduce both security and third-party availability risk.
- Most substantive evidence (SOC 2, ISO certificates, pen test reports, ISMS policies) requires an NDA and a trust-centre access request - budget time for this in the assessment.

**Residual customer responsibilities**
- Configure and enforce phishing-resistant MFA, admin role scoping, Zero Standing Privileges, session and IP binding, Dynamic Zones and API network zone allowlisting. Okta ships these controls but does not enable them for you.
- Restrict who can upload HAR files or other troubleshooting artefacts to Okta support, and sanitise them first.
- Set the Primary Security Contact and CIO/CISO contact in the Help Center.
- Subscribe to sub-processor change notifications and to the security advisory RSS feed.
- Execute a DPA (and a BAA where PHI is in scope) and confirm the applicable SCC module.
- Monitor and retain Okta System Log events in your own SIEM - do not rely on Okta-side log retention.

**Suggested review cadence:** annual full reassessment, with quarterly review of security advisories, sub-processor changes and tenant configuration drift. Given the criticality of the identity layer, treat any Okta security advisory as an out-of-cycle trigger for review.