ViaWest: Your Total Compliance Solution

  • Cloud compliance and colocation services
  • Regulatory compliance
  • Information security

Compliance Built Around You

We understand that our customers are subject to varying compliance and regulatory obligations. In order to effectively meet our customers’ needs, ViaWest's compliance group has created a security, governance and risk management framework of policies, procedures and standards that draws on many areas. Often, our customers have requirements above and beyond what our standard process or product offerings provide. In these situations, we will work with you to tailor products or processes where possible and develop an ideal compliance solution that is centered around you. The independent auditor reports or certifications that ViaWest obtains include:

SSAE 16/ISAE

3402 SOC 1 Type II Report

SOC 2 and SOC 3 on the Security and Availability Trust Services Principles

ViaWest has obtained a Service Organization Controls 1 (SOC 1), Type II report. The audit for this report is conducted in accordance with the Statement on Standards for Attestation Engagements No. 16 (SSAE 16) and the International Standards for Assurance Engagements No. 3402 (ISAE 3402) professional standards. This dual-standard report is specifically intended to meet the needs of ViaWest customers and their auditors, as they evaluate the effect of the controls at ViaWest on their financial statement assertions. The SOC 1 report attests that ViaWest’s control objectives are appropriately designed and operating effectively.

ViaWest maintains a SOC 2, Type II report. Similar to the SOC 1 in the evaluation of controls, the SOC 2 report is an attestation report that is an evaluation of controls specific to the criteria set forth by the American Institute of Certified Public Accountants (AICPA) Trust Services Principles. These principles define leading practice controls relevant to security, availability, processing integrity, confidentiality, and privacy applicable to service organizations such as ViaWest.

ViaWest’s SOC 3 report is a Trust Services Report (Trust Services Principles, Criteria, and Illustrations) specifically designed to meet the needs of customers and potential customers who want assurance about ViaWest controls related to one or more of the Trust Services Principles (security, availability, processing integrity, confidentiality, or privacy) but do not need the level of detail provided in a SOC 2 Report.

ViaWest maintains SOC audits for all of our data centers and these reports are available for ViaWest customers via the MySupport portal.

HIPAA Compliance Report for Physical Controls

Though ViaWest does not store, transmit, or process electronic Protected Health Information (ePHI), we acknowledge that our customers might. As a result, ViaWest engaged Coalfire Systems, a leading IT Governance, Risk and Compliance firm, to conduct an independent assessment of the physical components of ViaWest’s Colocation and Managed Service hosting offerings for compliance with the physical security-related safeguards associated with the Health Insurance Portability and Accountability Act (HIPAA) of 1996, as well as the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. This assessment report can be accessed from ViaWest’s customer service portal, MySupport and will help you understand our HIPAA Complance advantages.

PCI DSS Compliance

The Payment Card Industry (PCI) Data Security Standard (DSS) was developed to encourage, enhance and facilitate the broad adoption of consistent data security measures for cardholder data globally. PCI DSS provides a baseline of technical and operational requirements designed to protect cardholder data. PCI DSS applies to all entities involved in payment card processing – including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.

Attestation of Compliance for our physical security (PCI DSS section 9) and information security policies (PCI DSS section 12) documents are available for customers. Our PCI DSS compliance has been validated by an authorized independent Qualified Security Assessor.

NIST Compliance 800-53

NIST 800-53 defines the security controls for most U.S. federal information systems. National Institute of Standards and Technology (NIST) publishes, develops and issues standards, guidelines, and other publications to assist federal agencies in implementing the Federal Information Security Management Act of 2002 (FISMA). Specifically, NIST 800-53 covers the steps in the Risk Management Framework that address security control selection for federal information systems in accordance with the security requirements in Federal Information Processing Standard (FIPS) 200. ViaWest maintains compliance with physical security requirements of the NIST 800-53 standard.

ITAR Compliance

The International Traffic in Arms Regulation (ITAR) is a U.S. State Department requirement for companies involved in the manufacture, sale or distribution of weapons-related goods, including items covered under the United States Munitions List (USML). In addition ITAR is applicable to weapons component suppliers and resellers. ITAR “compliance” means that a company subject to ITAR is registered on the State Department website under the US State Directorate of Defense Trade Controls. The company is self-certifying that they operate in accordance with ITAR requirements. Companies commonly validate this self-certification through an external audit firm. ViaWest partners with customers to assist them in complying with any applicable ITAR requirements that they have. ViaWest maintains a limited-scope ITAR audit certification from an external audit firm covering HR onboarding practices, physical and logical access and authorization, environmental controls, and other requirements. For customers that have contractual ITAR requirements with ViaWest, this audit ensures that covered data physically resides in a U.S data center and is physically and logically accessible only by employees that are U.S. citizens.

United States- European Union Safe Harbor Privacy Framework

US-EU Safe Harbor is a streamlined process for US companies to comply with the EU Directive 95/46/EC on the protection of personal data. The process was developed by the US Department of Commerce in consultation with the EU. The Safe Harbor Principles are designed to prevent accidental information disclosure or loss. ViaWest annually reregisters its adherence to the program.

These compliance initiatives demonstrate our commitment to processes and standards that enable us to maintain the governance and security controls our customers need to help meet their regulatory obligations. By having a dedicated compliance department we believe we are uniquely qualified to provide high-quality services to our customers.

Contact Us