{"id":1816872,"date":"2023-01-20T10:00:44","date_gmt":"2023-01-20T18:00:44","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=1816872"},"modified":"2023-03-09T17:14:50","modified_gmt":"2023-03-10T01:14:50","slug":"implemented-and-upcoming-2023-arcgis-security-privacy-advancements","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements","title":{"rendered":"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[],"industry":[],"product":[36571,36811,36551,763582],"class_list":["post-1816872","blog","type-blog","status-publish","format-standard","hentry","category-administration","product-arcgis-enterprise","product-arcgis-hub","product-arcgis-online","product-trust-arcgis"],"acf":{"short_description":"FedRAMP moderate and more could significantly change how your organization uses geospatial capabilities from Esri.","flexible_content":[{"acf_fc_layout":"content","content":"

As we kick off the new year, it\u2019s worth taking a few minutes to summarize key milestones which can significantly enhance how your organization uses ArcGIS, such as:<\/p>\n

    \n
  1. FedRAMP MODERATE<\/strong> \u2013 As 2022 came to a close we wrapped up a 20+ week, third-party assessment of ArcGIS Online.\u00a0 The agency authorization process has started which will be completed over the next several months.\u00a0 If you are not a US government organization and just need to see the 3rd<\/sup> party audit report to confirm ArcGIS Online stores your data in alignment with FedRAMP moderate security controls, we can provide that under NDA in the next several months, just ask your account manager.\u00a0 US agencies will need to wait for the below authorization process to be completed as described here<\/a>.\u00a0 There is no migration for our customers, these security improvements are already in place for your ArcGIS Online organizations.\u00a0 This is a major milestone for many geospatial customers to expand their usage of ArcGIS Online cloud services, as FedRAMP Moderate means it is designed to handle sensitive information, with over 3x more security controls then ISO 27001 – Start talking with your organization’s security leadership now to determine what new geospatial use cases may now be considered for use in ArcGIS Online.<\/li>\n
  2. PRIVACY PAPER<\/strong> – We posted a major refresh of our Location Sharing Privacy Best Practices paper<\/a> to be in alignment with products and regulations as they have evolved including extending security and privacy setting recommendations summarized at the end of the document.<\/li>\n
  3. VULNERABILTY AUDIT<\/strong> – Esri, as a CVE Numbering Authority (CNA), was recently audited by the NIST National Vulnerability Database (NVD) and achieved the highest acceptance level of “Provider” for both the metrics we use to communicate the impact of software security vulnerabilities in our products via CVSS v3.1 scores as well as Common Weakness Enumeration (CWE) used to baseline weakness identification, mitigation, and prevention efforts for product vulnerabilities.\u00a0 This level of assurance concerning the vulnerability information we provide to customers is achieved by less than 1% of software organizations around the globe.\u00a0 Additional information about this program and audit result details may be found here<\/a>.<\/li>\n<\/ol>\n


    \nUpcoming additional assurance:<\/strong><\/p>\n

      \n
    1. \u00a0CLOUD SECURITY ALLIANCE<\/strong> \u2013 Expect to not only see a major update of our ArcGIS Online Cloud Security Alliance CAIQ answers<\/a> for the newer 4.0.2 framework<\/a> within the next several months, but also some of our other cloud-based service offerings.<\/li>\n
    2. SECURE CYBER SUPPLY CHAIN<\/strong> – The importance of ensuring software providers have a secure cyber supply chain to minimize customer risk continues to increase rapidly.\u00a0 We are actively completing an Open Trusted Technology Provider Standard (O-TTPS<\/a>) \/ International Organization for Standardization (ISO) 20243 gap analysis and expect our ArcGIS Online self-assessed certification to be completed within 2023 Q1.\u00a0 Expect to see additional Secure Cyber Supply Chain evidence for our products later in 2023.<\/li>\n
    3. ARCGIS ENTERPRISE SECURITY HARDENING GUIDE<\/strong> \u2013 While there is a DISA STIG for ArcGIS Server<\/a> available, the cadence for DISA being able to engage to issue a new revision spanning ArcGIS Enterprise has resulted in us deciding to release a general security hardening guide for our product first in 2023.<\/li>\n
    4. EU REGION ASSURANCE<\/strong> \u2013 Through the latter half of 2023, we will be aligning our ArcGIS Online European Union (EU) operations to align with ISO 27001<\/a>, in preparation for achieving certification in 2024.<\/li>\n
    5. TRUST CENTER EXPANSION<\/strong> – As there are so many advancements, we will be expanding the compliance section of the ArcGIS Trust Center over the next several weeks and throughout the year as we align with additional certifications\/standards.<\/li>\n<\/ol>\n

      2023 is an exciting year for us, as our customers can now more effectively balance cloud and on-premises geospatial implementation needs while meeting more rigorous security and privacy requirements \u2013 gone are the days of utilizing cloud services for only public-facing content.\u00a0 Now is the time to start considering what it means to your organization\u2019s strategic plans.\u00a0 Feel free to reach out to us if you would like to provide us feedback concerning early release materials for the above items.<\/p>\n

      – Esri\u2019s Software Security & Privacy team<\/em> \u2013 SoftwareSecurity@esri.com<\/a><\/p>\n"}],"related_articles":"","card_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2023\/01\/2023-Upcoming-1.png","wide_image":false,"authors":[{"ID":3911,"user_firstname":"Michael","user_lastname":"Young","nickname":"Michael Young","user_nicename":"myoung1000","display_name":"Michael Young","user_email":"myoung@esri.com","user_url":"http:\/\/trust.arcgis.com","user_registered":"2018-03-02 00:15:29","user_description":"","user_avatar":""}]},"yoast_head":"\nImplemented and Upcoming 2023 ArcGIS Security & Privacy Advancements<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\" \/>\n<meta property=\"og:site_name\" content=\"ArcGIS Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/esrigis\/\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-10T01:14:50+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@ESRI\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\"},\"author\":{\"name\":\"Michael Young\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/person\/b1e77881551053100a9cef9dba632678\"},\"headline\":\"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements\",\"datePublished\":\"2023-01-20T18:00:44+00:00\",\"dateModified\":\"2023-03-10T01:14:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\"},\"wordCount\":8,\"publisher\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#organization\"},\"articleSection\":[\"Administration\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\",\"url\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\",\"name\":\"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements\",\"isPartOf\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#website\"},\"datePublished\":\"2023-01-20T18:00:44+00:00\",\"dateModified\":\"2023-03-10T01:14:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.esri.com\/arcgis-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#website\",\"url\":\"https:\/\/www.esri.com\/arcgis-blog\/\",\"name\":\"ArcGIS Blog\",\"description\":\"Get insider info from Esri product teams\",\"publisher\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.esri.com\/arcgis-blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#organization\",\"name\":\"Esri\",\"url\":\"https:\/\/www.esri.com\/arcgis-blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/04\/Esri.png\",\"contentUrl\":\"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/04\/Esri.png\",\"width\":400,\"height\":400,\"caption\":\"Esri\"},\"image\":{\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/esrigis\/\",\"https:\/\/x.com\/ESRI\",\"https:\/\/www.linkedin.com\/company\/5311\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/person\/b1e77881551053100a9cef9dba632678\",\"name\":\"Michael Young\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2021\/12\/SSP-213x200.jpg\",\"contentUrl\":\"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2021\/12\/SSP-213x200.jpg\",\"caption\":\"Michael Young\"},\"sameAs\":[\"http:\/\/trust.arcgis.com\"],\"url\":\"https:\/\/www.esri.com\/arcgis-blog\/author\/myoung1000\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements","og_locale":"en_US","og_type":"article","og_title":"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements","og_url":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements","og_site_name":"ArcGIS Blog","article_publisher":"https:\/\/www.facebook.com\/esrigis\/","article_modified_time":"2023-03-10T01:14:50+00:00","twitter_card":"summary_large_image","twitter_site":"@ESRI","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements#article","isPartOf":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements"},"author":{"name":"Michael Young","@id":"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/person\/b1e77881551053100a9cef9dba632678"},"headline":"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements","datePublished":"2023-01-20T18:00:44+00:00","dateModified":"2023-03-10T01:14:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements"},"wordCount":8,"publisher":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/#organization"},"articleSection":["Administration"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements","url":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements","name":"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements","isPartOf":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/#website"},"datePublished":"2023-01-20T18:00:44+00:00","dateModified":"2023-03-10T01:14:50+00:00","breadcrumb":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/implemented-and-upcoming-2023-arcgis-security-privacy-advancements#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.esri.com\/arcgis-blog\/"},{"@type":"ListItem","position":2,"name":"Implemented and Upcoming 2023 ArcGIS Security & Privacy Advancements"}]},{"@type":"WebSite","@id":"https:\/\/www.esri.com\/arcgis-blog\/#website","url":"https:\/\/www.esri.com\/arcgis-blog\/","name":"ArcGIS Blog","description":"Get insider info from Esri product teams","publisher":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.esri.com\/arcgis-blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.esri.com\/arcgis-blog\/#organization","name":"Esri","url":"https:\/\/www.esri.com\/arcgis-blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/04\/Esri.png","contentUrl":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2018\/04\/Esri.png","width":400,"height":400,"caption":"Esri"},"image":{"@id":"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/esrigis\/","https:\/\/x.com\/ESRI","https:\/\/www.linkedin.com\/company\/5311\/"]},{"@type":"Person","@id":"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/person\/b1e77881551053100a9cef9dba632678","name":"Michael Young","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.esri.com\/arcgis-blog\/#\/schema\/person\/image\/","url":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2021\/12\/SSP-213x200.jpg","contentUrl":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2021\/12\/SSP-213x200.jpg","caption":"Michael Young"},"sameAs":["http:\/\/trust.arcgis.com"],"url":"https:\/\/www.esri.com\/arcgis-blog\/author\/myoung1000"}]}},"text_date":"January 20, 2023","author_name":"Michael Young","author_page":"https:\/\/www.esri.com\/arcgis-blog\/author\/myoung1000","custom_image":"https:\/\/www.esri.com\/arcgis-blog\/app\/uploads\/2025\/08\/Newsroom-Keyart-Wide-1920-x-1080.jpg","primary_product":"ArcGIS Trust Center","tag_data":[],"category_data":[{"term_id":37501,"name":"Administration","slug":"administration","term_group":0,"term_taxonomy_id":37501,"taxonomy":"category","description":"","parent":0,"count":427,"filter":"raw"}],"product_data":[{"term_id":36571,"name":"ArcGIS Enterprise","slug":"arcgis-enterprise","term_group":0,"term_taxonomy_id":36571,"taxonomy":"product","description":"","parent":0,"count":976,"filter":"raw"},{"term_id":36811,"name":"ArcGIS Hub","slug":"arcgis-hub","term_group":0,"term_taxonomy_id":36811,"taxonomy":"product","description":"","parent":36591,"count":219,"filter":"raw"},{"term_id":36551,"name":"ArcGIS Online","slug":"arcgis-online","term_group":0,"term_taxonomy_id":36551,"taxonomy":"product","description":"","parent":0,"count":2427,"filter":"raw"},{"term_id":763582,"name":"ArcGIS Trust Center","slug":"trust-arcgis","term_group":0,"term_taxonomy_id":763582,"taxonomy":"product","description":"Reserved for articles authored by the ArcGIS Trust Center team","parent":36981,"count":89,"filter":"raw"}],"primary_product_link":"https:\/\/www.esri.com\/arcgis-blog\/?s=#&products=trust-arcgis","_links":{"self":[{"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/blog\/1816872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/users\/3911"}],"replies":[{"embeddable":true,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/comments?post=1816872"}],"version-history":[{"count":0,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/blog\/1816872\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/media?parent=1816872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/categories?post=1816872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/tags?post=1816872"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/industry?post=1816872"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.esri.com\/arcgis-blog\/wp-json\/wp\/v2\/product?post=1816872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}