Iron Mountain InSight DXP security whitepaper

Iron Mountain InSight® DXP, our intelligent content platform, has established a broad and specific security compliance programme that aligns with industry and regulatory customer needs. This includes security compliance and data privacy. 

Compliance attestations

• ISO-27001 – InSight DXP has been continuously certified since 2020. This is an international standard that helps organisations manage the security of their information assets. It provides a management framework for implementing an information security management system (ISMS) to maintain the confidentiality, integrity, and availability of all data.
• SOC2 Type 2 – Iron Mountain has maintained a SOC2 Type 2 attestation for InSight DXP since 2020. SOC2 Type 2 Report is a service organisation control (SOC) audit on how a cloud-based service provider handles sensitive information.

Industry compliance

• InSight DXP is 21 CFR Part 11 capable.
• StateRAMP – Ready status received in January 2024.
• FedRAMP (NIST 800-53/37) – Third-party testing performed against the NIST 800-53 Revision 4 controls, as well as additional FedRAMP requirements. InSight DXP has received FedRAMP Authorisations to Operate (ATO) at both the Moderate and High impact levels, as well as FedRAMP Ready status. 

Data privacy

• General Data Protection Regulation (GDPR) – InSight DXP has undergone a GDPR assessment, and a copy of the report is available upon request.
• Health Insurance Portability and Accountability Act (HIPAA) – InSight DXP is HIPAA-compliant and has implemented privacy and security measures to protect both personally identifiable information (PII) and protected health information (PHI).
• ISO 27701 – InSight DXP has been continuously certified since 2024. This is an international standard that provides a framework for establishing and managing privacy information management systems (PIMS).

View all certifications

Identity and access management

• We implement and enforce role-based access control for privileged users wherein their use and allocation are restricted. Multi-factor authentication (MFA) is mandatory to limit access to authenticated users. Least privilege is implemented for authorised users and processes.

Monitoring

• Security scanning – The InSight DXP environment includes a monitoring system and security scanning capabilities that scan container images and systems, and runtime components to detect vulnerabilities and potential security risks.
• Application security testing – The platform conducts static application security testing (SAST), secrets scan, software composition analysis (SCA), open-source software (OSS) vulnerabilities and license checks, dynamic application security testing (DAST), and manual penetration testing (MPT).
• System monitoring and audit logs – The platform includes a security information and event management (SIEM) system for log management, real- time monitoring of security events, correlation and alerting of security events, and audit logs.
• Incident response – Our cyber incident and response team (CIRT) is responsible for classifying audit events that are of particular interest for the InSight DXP information system, and for conducting reviews and analysis of audit records.
• Incident management – Our cyber incident and response team (CIRT) maintains a cyber response plan to identify, protect, detect, respond, and recover in real time to include comprehensive logging and monitoring of our products and infrastructure. We also maintain employee awareness and training programmes to include internal information security policies and procedures.

Disaster recovery

• InSight DXP’s disaster recovery test is designed so that we can effectively recover objects, databases, and indices from accidental deletion or update, as those are the sources of persistent data for the InSight DXP application within the given RTO/RPO as documented in our business continuity plan (BCP).

Capacity planning

• Our capacity planning is geared towards monitoring workload performance and allowing capacity to meet current and future demands. This includes measuring performance and monitoring so that we do not reach capacity limits.

Patching and vulnerability management

• Patching and vulnerability management, anti-malware, endpoint disk encryption, and intrusion prevention are managed through our Information Technology asset and endpoint management solutions.

Encryption

• All customer data is encrypted at rest and in transit using encryption methods as outlined in Federal Information Processing Standard (FIPS) Publication 140-2 (FIPS 140-2) Annex A or greater (e.g. Advanced Encryption Standard with a 256-bit key or higher).

 

Data residency

• To help comply with data residency requirements, the platform has the ability to control where data is stored and also customise and restrict data storage to certain regions.

Data protection

• The platform applies appropriate technical, organisational and administrative measures, including encryption and multi-factor authentication (MFA), so that customer data remains secure. The platform can deploy a web application firewall (WAF) at a customer’s request.
• Customers have full control over the information they submit to the platform for processing (including personal data). Customer data is retained only for the duration of the services and then either returned or deleted upon the customer’s direction.
• InSight DXP acts as a global expansion accelerator, allowing multinational enterprises to scale document workflows across borders while mitigating compliance risks. Iron Mountain leverages legally recognised transfer mechanisms—including, but not limited to, Standard Contractual Clauses (SCCs) and a full commitment to the EU-U.S., the UK Extension to the EU-U.S., and the Swiss-U.S. Data Privacy Framework—to make cross-border data movements seamless rather than administrative.

 

NOTE: If you would like to learn more about InSight DXP solutions or our privacy compliance, we are available to assist you. For privacy compliance-related inquiries, please contact us at global.privacy@ironmountain.com or visit our Privacy & Data Protection website.