Compliant PAM Platforms: SOC 2, ISO 27001:2022, HIPAA & FedRAMP
Privileged access platforms with the compliance posture regulated buyers require.
Verdict as of November 2026: for regulated buyers the most compliance-ready PAM platform is Idira (formerly CyberArk) on breadth of attestations, but Delinea is the safer pick when FedRAMP High must be verifiable today, and BeyondTrust when FedRAMP Moderate is enough.
| Platform | FedRAMP (Marketplace, checked Oct to Nov 2026) | Key attestations listed | 2026 patch record |
|---|---|---|---|
| Idira (formerly CyberArk) | High from March 2024; transfer to Idira unconfirmed | SOC 2 Type II, ISO/IEC 27001:2022, PCI DSS v4.0.1, ISO/IEC 42001 | Critical CVEs in June 2026, none in CISA KEV |
| BeyondTrust | Moderate, April 2024 | SOC 2 Type 2, ISO 27001:2022 | Remote Support zero-day exploited, KEV on 16 Oct 2026 |
| Delinea | Secret Server High, 8 July 2026 | SOC 2 Type 2, ISO/IEC 27001:2022, PCI DSS v4.0.1 | Four critical on-prem Secret Server CVEs, Sept 2026 |
| One Identity Safeguard | Not tracked | Confirm with vendor | None tracked |
| WALLIX | No | ANSSI CSPN (first level) | None tracked |
For regulated buyers, privileged access is where auditors look first, so a PAM vendor's own compliance posture is a gating requirement. This page ranks on evidence you can check: what each vendor's trust centre or the FedRAMP Marketplace actually lists, not what a datasheet implies. For capability-led selection, see enterprise PAM.
How to read a PAM vendor's compliance claims
Scope is per product. Certifications are granted to specific products and hosting environments. A SOC 2 report covering a vendor's remote-access cloud says nothing about its self-hosted vault.
FedRAMP has levels and package names. Check the impact level (Moderate or High) and the exact service offering on the FedRAMP Marketplace, then confirm it covers the module you are buying.
Ownership changes can strand paperwork. After an acquisition, confirm the authorisation and attestations transferred to the new entity.
Self-hosted is on you. A vendor certification covers the vendor's service. On-premises deployments put patching and evidence back in your hands.
Applied to this category
CyberArk, now part of Palo Alto Networks and rebranded Idira in May 2026, has the broadest list: its trust centre shows SOC 2 Type II, ISO/IEC 27001:2022, 27017 and 27018, PCI DSS v4.0.1, Common Criteria via NIAP, CSA STAR and IRAP. The FedRAMP Marketplace data lists High authorisations from March 2024 for Endpoint Privilege Manager and Identity for Government, but CyberArk's FedRAMP documentation pages now return 404 after the migration, so federal buyers should confirm the authorisation carried over to Idira.
BeyondTrust lists product-scoped SOC 2 Type 2 reports and ISO 27001:2022 certification, and its Identity Security for Government offering is FedRAMP Moderate, authorised in April 2024. Delinea's Secret Server reached FedRAMP High on 8 July 2026 through partner UberEther, and its trust centre lists SOC 2 Type 2, ISO/IEC 27001:2022 and PCI DSS v4.0.1; it also disclosed four critical Secret Server CVEs in September 2026 affecting on-premises installs only. BeyondTrust's self-hosted Remote Support was hit by CVE-2026-102764, exploited from 29 August 2026 and added to the CISA KEV catalog on 16 October; auditors will ask how quickly you applied the fix. One Identity Safeguard is the governance play, with privileged entitlements certified alongside One Identity Manager, while its parent prepares to separate from Quest. WALLIX Bastion holds a first-level ANSSI CSPN certification and is built for European and NIS2-driven buyers; confirm current ISO 27001 scope directly.
Quick picker by scenario
- US federal, FedRAMP High required now: Delinea, or CyberArk once the Idira authorisation is confirmed.
- FedRAMP Moderate is enough: BeyondTrust.
- Broadest attestation list, Palo Alto ownership acceptable: CyberArk.
- SOX-style evidence joined to access certifications: One Identity Safeguard.
- EU sovereignty or OT environments under NIS2: WALLIX.
Where to go next
Read the compliance guides on SOC 2, PCI DSS, HIPAA and NIS2, and the IAM audit preparation guide. For the scored field, see the best PAM tools, best PAM for enterprises and the top 10 PAM solutions in 2026, and run the evaluation with how to choose a PAM solution. Capability scores follow our methodology; compliance facts come from each vendor profile and the FedRAMP Marketplace.
The broadest compliance and assurance coverage in privileged access.
CyberArk pairs the deepest PAM control set with a mature trust program: its trust centre lists SOC 2 Type II, ISO/IEC 27001:2022 and PCI DSS v4.0.1, and it announced FedRAMP High for Endpoint Privilege Manager and Workforce Identity in March 2024. Its audit depth and certifications are a major reason the largest regulated organizations standardize on it.
Best for: Highly regulated enterprises and government that need the deepest, best-attested PAM
Watch out: Now Idira under Palo Alto Networks; confirm the FedRAMP authorization transferred
Strong compliance posture across PAM, endpoint privilege, and remote access.
BeyondTrust lists product-scoped SOC 2 Type 2 reports and ISO 27001:2022 certification, and its Identity Security for Government offering is FedRAMP Moderate, so enterprises unifying privileged access, endpoint least-privilege, and secure remote access can meet compliance across all three from one vendor.
Best for: Regulated enterprises unifying PAM with endpoint privilege and remote access
Watch out: Suite breadth means scoping which modules you deploy and certify
Capable PAM with a solid compliance program and faster deployment.
Delinea lists SOC 2 Type 2, ISO/IEC 27001:2022 and PCI DSS v4.0.1, and Secret Server reached FedRAMP High in July 2026, pairing strong compliance with a reputation for quicker time-to-value, which appeals to regulated enterprises that want to satisfy auditors without the longest implementation.
Best for: Regulated enterprises that want compliance-ready PAM with quicker time-to-value
Watch out: Very large, complex estates may still favor the deepest incumbent
Privileged access that integrates with governance for cleaner audits.
Safeguard pairs naturally with One Identity Manager, so governance teams can bring privileged entitlements into access certifications, which simplifies the evidence auditors expect for SOC 2, ISO 27001, and SOX.
Best for: Enterprises unifying PAM and governance to streamline audit evidence
Watch out: Most compelling alongside the wider One Identity suite
Session-centric PAM with strong European compliance and OT coverage.
WALLIX Bastion holds a first-level ANSSI CSPN certification and aligns with European regulatory expectations (including NIS2 and sector rules), with a notable presence in operational technology, making it a strong compliance fit for European enterprises and industrial environments.
Best for: European and OT-heavy enterprises prioritizing session control and EU compliance
Watch out: Narrower ecosystem than the global market leaders
At a glance
| # | Vendor | Score | Best for |
|---|---|---|---|
| 1 | Idira (formerly CyberArk) | 4.7/5 | Highly regulated enterprises and government that need the deepest, best-attested PAM |
| 2 | BeyondTrust | 4.5/5 | Regulated enterprises unifying PAM with endpoint privilege and remote access |
| 3 | Delinea | 4.4/5 | Regulated enterprises that want compliance-ready PAM with quicker time-to-value |
| 4 | One Identity Safeguard | 4.2/5 | Enterprises unifying PAM and governance to streamline audit evidence |
| 5 | WALLIX | 4.1/5 | European and OT-heavy enterprises prioritizing session control and EU compliance |
Frequently asked questions
- Which PAM platforms are SOC 2, ISO 27001, and FedRAMP compliant?
- CyberArk, BeyondTrust, and Delinea list SOC 2 Type II and ISO/IEC 27001:2022. On FedRAMP, Delinea Secret Server is High (July 2026), BeyondTrust Identity Security for Government is Moderate, and CyberArk held High for two government offerings from March 2024, though transfer under the Idira rebrand is unconfirmed. WALLIX holds an ANSSI CSPN certification. Always confirm the current, exact certifications and authorization scope directly with each vendor, since these change.
- What are the most trusted privileged access management tools?
- Trust in PAM is checkable: attestations, FedRAMP level and patch record. As of November 2026, Idira (formerly CyberArk) has the broadest attestation list, Delinea holds the newest FedRAMP High authorization (Secret Server, 8 July 2026), and BeyondTrust holds FedRAMP Moderate. All three have had critical CVEs in 2026, and one in self-hosted BeyondTrust Remote Support (CVE-2026-102764) was exploited in the wild, so prefer the vendor's SaaS edition or a fast patch cycle.
- Why does PAM matter for compliance?
- Privileged accounts are the highest-risk access in any organization, so frameworks like SOC 2, ISO 27001, PCI DSS, HIPAA, and SOX expect strong controls over them: vaulting, session recording, least privilege, and audit trails. PAM produces much of the evidence auditors request for privileged access.
- Does a PAM vendor's certification make me compliant?
- No. The vendor's SOC 2 or FedRAMP authorization covers their service, not your program. It reduces your due-diligence burden and supports your audits, but you remain responsible for configuring, operating, and evidencing your privileged access controls.
- What is FedRAMP and when do I need it?
- FedRAMP is the US government's standardized security authorization for cloud services. You need a FedRAMP-authorized PAM if you are a federal agency or a contractor handling federal data in the cloud. Delinea Secret Server is FedRAMP High, BeyondTrust Identity Security for Government is FedRAMP Moderate, and CyberArk should confirm its High authorization carried over to Idira.
Related on Start with Identity
- RankingCompliant IGA Platforms: SOC 2, ISO 27001:2022 & FedRAMP
The most compliance-ready IGA platforms in 2026: SailPoint, Saviynt, Omada, One Identity, and RSA Governance. Ranked on SOC 2 Type II, ISO 27001:2022, FedRAMP,
- RankingCompliant CIAM Platforms: SOC 2 Type II, ISO 27001 and HIPAA
The most compliance-ready CIAM platforms in 2026: Auth0, Stytch, MojoAuth, WorkOS, Ping Identity, Clerk, SSOJet, and Frontegg. Ranked on SOC 2 Type II, ISO 2700
- RankingBest CIAM for Healthcare: Top 5 HIPAA-Ready Platforms
The best CIAM platforms for healthcare in 2026: Auth0, SAP Customer Data Cloud, Ping Identity, Transmit Security, and ForgeRock. Ranked for HIPAA readiness, con
- GuideIdentity Controls for ISO 27001
ISO 27001 identity controls are the Annex A controls in ISO/IEC 27001:2022 that govern who can access information and how: A.5.15 Access control, A.5.16 Identit
- GlossaryISO/IEC 27001
ISO/IEC 27001 is the international standard that specifies requirements for an information security management system (ISMS). The current edition is [ISO/IEC 27
- ArticleCyberArk Alternatives in 2026: 6 PAM Options Compared After the Idira Rebrand
CyberArk is now Idira, inside Palo Alto Networks, and the vendor neutrality many buyers chose it for is gone. Six alternatives compared on depth, operational we