VMware (Broadcom)

**Trust centre:** Broadcom Trust Center at broadcom.com/support/trust-center, with the certification index at broadcom.com/support/trust-center/compliance. Certifications are listed per service and per region, and the filters make clear that most VMware attestations cover only a small subset of the portfolio.

**Audit evidence access:** there is no self-service trust portal. Compliance artifacts (SOC reports, ISO certificates, HIPAA and PCI documentation) sit behind the Broadcom Support Portal in the Product Legal Documentation module and require an Enterprise User Profile, which is a two-step upgrade from a Basic account. Download instructions are published as notification 37107 (first published 25 February 2026, last updated 09 March 2026).

**TruSight:** Broadcom participates in TruSight, but reports are purchased directly from TruSight ([email protected]) rather than obtained from Broadcom.

**Security advisories:** the public VMware Security Advisories index is at broadcom.com/support/vmware-security-advisories. It has no per-advisory deep links; the searchable advisory table lives on the Support Portal at support.broadcom.com/web/ecx/security-advisory, segmented as VC (VMware Cloud Foundation), VT (Tanzu) and VA (Application Networking and Security). At the review date the VMware Cloud Foundation segment held 340 advisories.

**Vulnerability policy:** VMware External Vulnerability Response and Remediation Policy at broadcom.com/support/vmware-services/security-response. PSIRT contact [email protected]; PGP key at knowledge.broadcom.com/external/article?legacyId=1055.

**Sub-processors:** Broadcom Third Party List at broadcom.com/company/legal/privacy/third-party-list, last updated 30 July 2026.

**Scope warning:** VMware End User Computing (Horizon, Workspace ONE) was divested to Omnissa and is out of scope for Broadcom trust documentation. Omnissa must be assessed separately at omnissa.com.

**Inherent risk drivers**

- Hypervisor and management-plane concentration: vCenter and ESX sit beneath large parts of the estate, so a single critical vulnerability has estate-wide blast radius.
- Repeated confirmed in-the-wild exploitation of critical, network-reachable vCenter and ESXi flaws (CVE-2023-34048 in 2023; CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226 in 2025).
- Workarounds are frequently unavailable, so patching is often the only remediation and the patch window becomes the entire control.
- Predominantly on-premises software: the customer, not Broadcom, owns patching, hardening, segmentation, backup and monitoring.

**Certification scope is narrow - always check per service**

- ISO/IEC 27001: only VMware Cloud on AWS (which also holds 27017 and 27018), VMware Live Cyber Recovery, VMware Avi Load Balancer, VMware vDefend Advanced Threat Prevention and Tanzu CloudHealth.
- SOC 1 and SOC 2: VMware Cloud on AWS, Live Cyber Recovery, Avi Load Balancer and vDefend ATP. Tanzu CloudHealth is the only service with a SOC 3.
- PCI DSS and ISO 9001: VMware Cloud on AWS only. HIPAA BAA: VMware Cloud on AWS and VMware Live Cyber Recovery only.
- Cyber Essentials and Cyber Essentials Plus: VMware Cloud Foundation only.
- IRAP: no VMware service is in scope, all IRAP entries are Symantec. PCI 3DS: Arcot only. TISAX: the semiconductor business only.
- Practical consequence: on-premises VMware Cloud Foundation, vSphere, NSX and Tanzu deployments sit largely outside the audited service perimeter, so an attestation should not be assumed to cover the SKU you are buying.

**Mitigating factors**

- Mature, well-documented PSIRT: VMware is an approved CVE Numbering Authority and publishes structured VMSAs with CVSS scores, known attack vectors, response matrices and explicit notes when exploitation is happening in the wild.
- Advisories are prompt and usually coordinated with patch availability, with supplemental FAQs for critical events.
- Broadcom has patched end-of-life versions where severity warranted it, for example vCenter 6.7U3, 6.5U3 and VCF 3.x under VMSA-2023-0023.
- Published Data Processing Addendum, EU Data Act Addendum, transparency notices and a dated third-party list.
- Explicit safe-harbour commitment for good-faith security researchers.

**Residual responsibilities for the customer**

- Subscribe to Broadcom security alerts and maintain an emergency patch path for Critical VMSAs; treat vCenter and ESX as tier-0 assets.
- Restrict management-plane network reachability and never expose vCenter to untrusted networks.
- Confirm the specific service or SKU being purchased is inside a certified scope before relying on any attestation.
- Assess Omnissa separately for Horizon and Workspace ONE.
- Own backup, replication and DR design for on-premises deployments.

**Evidence gaps at review date**

- No self-service trust portal; audit evidence requires an Enterprise Support Portal profile, which adds friction to annual due diligence.
- No public bug bounty and no published penetration-test summary for on-premises products; visible external assurance comes mainly through Pwn2Own and Zero Day Initiative submissions.
- No published RTO, RPO or uptime SLA on the public trust centre for VMware services.
- No named Article 27 EU representative or Data Protection Officer.

**Suggested review cadence:** annual, with continuous monitoring of VMSAs and an out-of-cycle review triggered by any Critical advisory affecting a deployed product.