Trend Micro helps make the world safe for exchanging digital information. Fueled by
decades of security expertise, global threat research, and continuous innovation,
Trend Micro cybersecurity platform protects hundreds of thousands of organizations
and millions of individuals across clouds, networks, devices, and endpoints. As a
leader in cloud and enterprise cybersecurity, Trend Micro delivers a powerful range
of advanced threat defense techniques optimized for environments such as AWS, Microsoft,
and Google, as well as central visibility for better, faster detection and response.
Trend Micro is committed to the security and privacy of its customers and their data.
Trend Cloud One resources are representative of this commitment. For more information,
see the Trend Micro Trust Center.
The following table provides the up-to-date information on the security, privacy,
and compliance for Trend Cloud One.
![]() |
![]() |
![]() |
Data Privacy
Depending on the nature of the protected environment and the object that is the target
of the security event (for example, files, memory, network traffic), there is a risk
that personal information may be collected within a security event. Security policy
configuration and module selection are provided to meet the requirements of your target
environment and minimize this risk.
For general information on how Trend Micro protects your data, see Trend Micro Global Privacy Notice.
For more information on the data sent to Trend Micro and customer controls over that
data, see Trend Cloud One Data Collection Notices.
GDPR
Trend Micro complies with applicable data protection laws, including GDPR. For more
information, see Trend Micro GDPR Compliance.
- Where appropriate, Trend Micro implements Technical and Organization Measures (TOMs) to support processing of data under GDPR.
- As a data processor under GDPR, Trend Micro's processing of personal data is limited in a number of cases. The details on the data processed by Trend Cloud One and the controls available to you over that data are documented in Data Collection Disclosure Notices for each Trend Cloud One service.
Trend Cloud One Data Collection Notices
The Data Collection Notices for each of the Trend Cloud One services are in Trend Cloud One Data Collection Notices.
When an account is created in a specific Trend Cloud One region, all Trend Cloud One
infrastructure is in that region and this may help with concerns for data residency
and data sovereignty. For more information on what regions are covered by Trend Cloud
One, see Trend Cloud One Regions.
Trend Cloud One allows you to create new accounts by defining new users and roles, as well as providing
subscription information. As a result, Trend Cloud One may process personal data.
For more information, see Trend Cloud One Data Collection Notice.
Trend Cloud One - Workload Security is responsible for protecting your workloads. Consequently, Workload Security may
process personal data. For example, when a security or system event takes place, some
of the information processed may contain personal data, such as IP addresses. The
logging data created by Workload Security may also contain personal data, such as
administrator names and IDs. For more information, see Trend Cloud One - Workload Security Data Collection Notice.
Trend Cloud One - Conformity requires access to your cloud account data to run rules and provide monitoring services.
Account access is initially granted when you add your cloud account to the service
and can be modified for existing accounts. You can configure the account access policy
and rules to allow access to and collection of your cloud environment’s metadata.
For more information, see Trend Cloud One - Conformity Data Collection Notice.
Trend Cloud One - Container Security connects to your Kubernetes environment using an API key and does not collect personal
information. For more information, see Trend Cloud One - Container Security Data Collection Notice.
Trend Cloud One - File Storage Security is deployed using AWS CloudFormation stacks. One to three stacks are deployed depending
on the solution selected. The collected information is stored in File Storage Security;
it is used for managing stacks and does not contain personal information. For more
information, see Trend Cloud One - File Storage Security Data Collection Notice.
Trend Cloud One - Network Security is deployed using AWS CloudFormation stacks. The collected information does not contain
personal information. For more information, see Trend Cloud One - Network Security Data Collection Notice.
Data Security
Trend Micro adheres to industry standards for data security and provides an outline
of general security practices. In addition, Trend Cloud One uses industry accepted
best practices to secure your data. This includes segregating individual customer
data and encrypting data in transit. Backup of customer data follows industry-defined
best practices and Trend Micro's various certifications. For example, ISO 27001 (for
access control and cryptography) and ISO 27017 (for monitoring of cloud services and
segregation of environments) help define Trend Micro's processes for backup and data
recovery.
Data Segregation
For each Trend Cloud One service, all customer information is segregated to ensure
that customers have access to only their own data. Customer contact details, such
as their email address, are encrypted at rest to ensure confidentiality. Data collected
by the Trend Cloud One services is listed in Trend Cloud One Data Collection Disclosure Notices.
Data Encryption
Encryption at rest ensures that data elements are protected with database-agnostic
application-level encryption using AES 256 GCM (for example, databases and backups).
Encryption in transit helps protect data that is stored on a disk or backup media.
A minimum of TLS 1.2 is used for all internal network communication. A minimum of
TLS 1.2 is used for communication between the security agent and Trend Cloud One (see
Use TLS 1.2 with Workload Security). You are responsible for ensuring that the security agent is kept up to date to
make use of the latest available cryptography and security fixes. See Communication between Workload Security and the agent for details on ciphers used by the security agent and connections to Trend Cloud
One.
Data Access
All access to Trend Micro offices and networks is strictly controlled to authorized
or accompanied individuals only. Access is given through a key card system and approval
is required before entry is granted into sensitive areas. The Trend Cloud One infrastructure
is hosted in AWS.
Trend Cloud One is hosted in a highly-restricted subnet with no internet access. Only
a limited set of administrators have access to Trend Cloud One for maintenance tasks.
Operator access is done over secure encrypted connections and secured with multiple
layers of network and access controls.
Access is restricted to certain allowed IPs and is monitored in a SIEM. Alerts are
generated for any suspicious access. Investigation of alerts is done according to
incident management procedures.
Subcontractors are not used in the development nor operation of Trend Cloud One.
Security Logs
Trend Cloud One services use Cloud Trail, CloudWatch, and Amazon GuardDuty to monitor
the services. In addition, where workloads are being used in the services, Trend Cloud
One uses the Trend Cloud One agent to monitor Anti-Malware, Firewall, Intrusion Prevention,
Integrity Monitoring, and Log Inspection.
Trend Cloud One enables automated alerts and employs 24/7 on-call staff. Security
logs are reviewed for all systems on a daily basis. If a security incident is suspected,
it is immediately reported to the Trend Micro Security Operations Center (SOC). Potential
incidents are prioritized based on the severity of the suspected incident and a team
from the SOC, as well as technical experts, are assigned to investigate.
These logs remain in the region that is hosting the Trend Cloud One account and customers
do not have access to these logs. For more information on what regions are covered
by Cloud One see Trend Cloud One Regions.
Data Backup
Trend Cloud One backups are conducted daily. Automated tests are run weekly to validate
the consistency of the Trend Micro backups and the backups are stored to mitigate
the risk of issues within a single region. Backups are kept for 35 days before they
are destroyed.
Disaster Recovery and Business Continuity (DR)
Trend Cloud One has a disaster recovery (DR) and business continuity plan (BCP). A
Disaster Recovery (DR) simulation is executed at least annually to verify the backup
data and RTO/RPO claims under ISO 27001.
The Trend Cloud One current RTO and RPO claims are outlined in the Trend Cloud One Service Level Agreement.
The R&D operations team monitors a number of key metrics in Trend Cloud One on a 24x7
basis:
- Canary tenants that represent customer workloads that Trend Micro monitors.
- Splunk monitoring of metrics including, but not limited to, memory, CPU, connections, job and heartbeat throughput, heartbeat failures, and database transactions.
- Site24x7 to have a third party monitor Trend Micro interfaces.
- PagerDuty for 24/7 alerting.
Trend Micro's objective is to proactively act on the initial indication of problems
in Trend Micro's operational metrics, to allow Trend Micro to correct or mitigate
issues before they become customer-visible.
With regards to Trend Cloud One Workload Security, any service interruption, scheduled
or unscheduled, does not impact the protection provided by existing agents running
on customer workloads. Agents activated prior to the service interruption continue
to provide protection on the computers on which they are running until access to the
service is restored. Events are queued as long as the computer has enough disk space
and the agent transmits events to Trend Cloud One the next time that they connect.
Agents automatically reconnect once service is restored.
Data Deletion
The process to cancel your account and timeline for deletion of data is outlined in
Cancel Your Account.
ISO 27001 contains provisions for data destruction. Both Trend Cloud One and AWS are
ISO 27001-compliant.
You may start a data deletion or porting request by emailing the Trend Micro legal
team at gdpr@trendmicro.com.
Employee Training
Trend Cloud One software developers are trained in secure coding practices using an
industry-standard curriculum based on SANS 25/OWASP Top 10/PCI 6.5. Education campaigns
are conducted on an annual basis and when an employee joins the company. All employees
must adhere to the Trend Micro internet, computer, remote access, and mobile device
acceptable use policies. Failure to comply with these policies may result in disciplinary
actions, which could include termination. All new employees and contractors are required
to complete a criminal background check. Trend Cloud One development teams employ
specialized staff to handle product security. Security testing, secure code review,
and threat modeling are part of the development lifecycle. For more information about
Trend Micro's secure coding best practices, see Trend Micro Trust Center for Compliance.
Trend Micro adheres to the following password polices and standards:
- All passwords must be changed at least on a quarterly basis.
- Passwords must not be inserted into email messages or other forms of electronic communication.
- Passwords must not be shared or revealed to anyone.
- Passwords must be changed immediately if compromise is suspected.
- Passwords must be encrypted during transmission and stored hashed with a salt.
- Passwords must be at least eight alphanumeric characters long.
- Passwords must contain both upper and lower case characters (for example, a-z, A-Z).
- Password reuse prevention is enforced.
- Passwords must not be based on personal information, names of family, and so on.
Change Control
Ensuring that Trend Micro's customers continue to receive the latest security capabilities
in a safe, reliable way is a key priority for the Trend Micro team. In addition to
the development practices around code review, functional testing, and scale testing,
as well as vulnerability scanning and penetration testing, Trend Micro takes a number
of steps to ensure that any service updates are introduced in a safe and controlled
way. All service updates are introduced in small, incremental updates that are rolled
out first to a staging environment and then to production. Each change is closely
monitored and multiple procedures are in place, both automated and manual, to handle
situations that may arise. All updates to the service are introduced transparently
to customers, and can be rolled back transparently, should any unforeseen issues arise.
Application upgrades within the Trend Cloud One environment are completed after meeting
Trend Micro's quality objectives. Trend Micro uses best practices for changes, including
full backups and approval processes. Trend Cloud One has multiple dedicated development
and testing environments. Any changes requested are first reviewed by technical stakeholders
to determine the urgency and potential impact of the changes. All changes require
a documented back-out plan. These changes are tracked and recorded in a change control
system.
Vulnerability Management
Vulnerabilities are continuously monitored and tracked. Each vulnerability is assigned
a CVSS score. Patching requirements that specify time frames for addressing a vulnerability
according to CVSS-based severity are included in the Secure Development Compliance
Policy. The Trend Cloud One software in the Trend Cloud One environment is updated
weekly to use the latest available code base, including vulnerability fixes. The Trend
Cloud One team is responsible for patching the Trend Cloud One software and supporting
AWS services. You are responsible for updating the security agents deployed on your
workloads.
Code Analysis
Vulnerability scans of the Trend Cloud One production environments are performed weekly
by a PCI authorized scanning vendor (ASV), Tenable.io. A PCI ASV attestation is obtained
quarterly. The same vendor is used for automated weekly internal scans of the Trend
Cloud One environments. The Trend Cloud One code base is scanned weekly using a leading
static analysis security tool. The development team receives automated alerts if new
issues are identified, and a clean scan is a requirement for each product release.
Third-party components included with Trend Cloud One are monitored continuously using
a leading software composition analysis tool.
Penetration Testing
Trend Cloud One production environments undergo yearly penetration tests. The scope
of the third-party penetration tests includes application security tests, internal
and external network scans, and network segmentation tests. Trend Micro can provide
the penetration test report upon request. Trend Micro InfoSec conducts web application
assessments of Trend Cloud One for any major release and at least annually using leading
dynamic analysis security tools.
For more information about the Trend Micro vulnerability response program, see Trend Micro Vulnerability Response.
Incidence Response
Trend Micro has a dedicated Information Security (InfoSec) team that is responsible
for ensuring compliance with Trend Micro security policies. Trend Cloud One engineers
immediately contact the InfoSec team when a security incident is discovered. In addition,
InfoSec independently monitors Trend Cloud One environment logs. If a security incident
is discovered, the incident is prioritized based on severity. A dedicated team of
technical experts is assigned to investigate, advise on containment procedures, perform
forensics, and manage communication. Following an incident, the team examines the
root cause, and revises the response plan accordingly. In the event of a breach involving
customer data, Trend Micro follows its obligations under GDPR. For more information,
see Trend Micro GDPR Compliance.
If you suspect a security incident, please contact Trend Micro Technical Support.
Certifications
ISO 27001, ISO 27014, ISO 27017, and SOC2
Trend Micro and Trend Micro Cloud Services undergo yearly audits by trusted external
auditors to ensure their adherence to industry best practices. ISO 27001 is a global
standard used to define the overall Information Security Management System for Trend
Micro. ISO 27001 covers items such as human resource security, access control, operations
security and information security incident management. SOC Type II certification is
used to validate the security controls over Trend Micro IT systems and includes Trend
Micro internal systems, as well as its SaaS offerings. SOC Type II controls include
items such as security (for example, firewalls, IPS), availability (disaster recovery
and incident handling), confidentiality (encryption and access control), privacy and
processing integrity (quality assurance).
Trend Cloud One is certified for ISO 27001, 27014, and 27017 and you can find the
compliance certificates at Trend Micro Trust Center for Compliance.
Trend Cloud One has completed a SOC 2 TYPE 2 evaluation and you can find the SOC 3
report and the request form for the SOC 2 report at Trend Micro Trust Center for Compliance.
PCI DSS
Trend Cloud One completed the PCI Data Security Standards 4.0 assessment as a Level
1 Service Provider. PCI-DSS is meant to increase controls around cardholder data and
includes controls such as maintaining security networks and systems, protection of
personal data, and system maintenance and vulnerability management.
The Trend Cloud One PCI Attestation of Compliance (AOC) is available at Trend Micro Trust Center for Compliance. AWS is also PCI-certified.
Trend Cloud One service
|
PCI DSS Level 1 Service Provider
|
Workload Security
|
✔
|
Network Security
|
✔
|
Application Security
|
|
Container Security
|
✔
|
File Storage Security
|
✔
|
Conformity
|
✔
|
Cloud Sentry
|
✔
|