Security Program
Summary: Dragos publishes a security program description covering its OT platform, stating that its information security program aligns with industry standards and that its products align with NIST CSF, ISO 27001 and SOC 2 Type 2. The program covers background checks on all employees and contractors, annual security awareness training, an SSDLC with peer review and routine vulnerability scans, external penetration testing on all major product releases at least once per year, and a Business Continuity and Disaster Recovery Plan that is regularly reviewed and tested.
Bottom line: Dragos states it does not provide customers or partners with audit rights related to its IT or systems environment and procedural controls, so assurance rests on an independent SOC 2 Type II report provided annually under NDA and available to current customers and partners on written request no more than once a year.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026