Iron Mountain InSight DXP security whitepaper

Whitepaper

Learn how Iron Mountain InSight DXP incorporates an end-to-end security strategy that covers content ingestion to storage of digital documents and metadata.

October 9, 202512 min read

Download Resource

Iron Mountain Insight Security Whitepaper Thumbnail

Executive Summary

About Iron Mountain security

Iron Mountain incorporates an in-depth security approach that covers content ingestion, storage, and processing of digital documents as well as hosting in a secure data center. Iron Mountain leverages the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF) as our enterprise security framework. We provide secure deployment of services, data storage with end-user privacy safeguards, communications between services, and administration support with separation of duties.

Training

Iron Mountain works with highly regulated industries requiring workforce security and privacy training. Employees take various security courses and training developed throughout the year as mandated by our enterprise-wide training program. The training includes annual security awareness, data privacy training, secure code training, code of ethics, and business conduct. We work with customers so that personnel are properly vetted with background checks. Our employment is contingent upon a background investigation as applied through various local and client requirements.

Iron Mountain InSight DXP security, compliance, and data privacy

Iron Mountain InSight® DXP, our intelligent content platform, delivers measurable operational impact whether you use it to power your core business functions or deploy our ready-made industry solutions. Central to this operational value is our commitment to trust; InSight DXP is backed by a comprehensive security and compliance program specifically engineered to align with stringent industry standards and data privacy regulations.

Compliance attestations

ISO-27001 - InSight has been continuously certified since 2020. This is an international standard that helps organizations manage the security of their information assets. It provides a management framework for implementing an information security management system (ISMS) to maintain the confidentiality, integrity, and availability of all data.
SOC2 Type 2 - Iron Mountain has maintained a SOC2 Type 2 attestation for InSight since 2020. SOC2 Type 2 Report is a service organization control (SOC) audit on how a cloud-based service provider handles sensitive information.

Industry compliance

InSight DXP is 21 CFR Part 11 capable.
StateRAMP - Ready status received in January 2024.
FedRAMP (NIST 800-53/37) - Third-party testing performed against the NIST 800-53 Revision 4 controls, as well as additional FedRAMP requirements. InSight has received FedRAMP Authorizations to Operate (ATO) as well as FedRAMP Ready status.

Data privacy

General Data Protection Regulation (GDPR) - InSight has undergone a GDPR assessment and a copy of the report is available upon request.
Health Insurance Portability and Accountability Act (HIPAA) - InSight is HIPAA-compliant and has implemented privacy and security measures to protect the privacy and security of personally identifiable information (PII).
ISO 27701 - InSight DXP has been continuously certified since 2024. This is an international standard which provides a framework for establishing and managing privacy information management systems (PIMS).

View all certifications

01 / 04

Compliance programs

Identity and access management

We implement and enforce role-based access control for privileged users wherein their use and allocation is restricted. Multi-factor authentication (MFA) is mandatory so that access is limited to authenticated users. Least privilege is implemented for authorized users and processes.

Monitoring

Security scanning - The InSight DXP environment includes monitoring system and security scanning capabilities that scan container images and systems, runtime components to detect vulnerabilities and potential security risks.
Application security testing - The platform conducts static application security testing (SAST), secrets scan, software composition analysis (SCA), open-source software (OSS) vulnerabilities & license checks, dynamic application security testing (DAST) and manual penetration testing (MPT).
System monitoring and audit logs - The platform includes a security information and event management (SIEM) system for log management, real time monitoring of security events, correlation and alerting of security events, and audit logs.
Incident response - Our cyber incident and response team (CIRT) is responsible for classifying audit events that are of particular interest for the Iron Mountain InSight DXP information system, and for conducting reviews and analysis of audit records.
Incident management - Our cyber incident and response team (CIRT) maintains a cyber response plan to identify, protect, detect, respond, and recover in real time to include comprehensive logging and monitoring of our products and infrastructure. We also maintain employee awareness and training programs to include internal information security policies and procedures.

Business continuity

The platform’s Recovery Time Objective (RTO) for Tier 1 business applications is between 10 - 24 hours and the Recovery Point Objective (RPO) was assessed to be 1 hour in our last business continuity plan (BCP) test conducted in Q4 2023. RTO/RPO can be modified based upon customer needs.

Disaster recovery

InSight’s disaster recovery test is designed so that we can effectively recover objects, databases, and indices from accidental deletion or update, as those are the sources of persistent data for the InSight application within the given RTO/RPO as documented in our business continuity plan (BCP).

Capacity planning

Our capacity planning is geared towards monitoring workload performance and allowing capacity to meet current and future demands. This includes measuring performance and monitoring so that we do not reach capacity limits.

Patching and vulnerability management

Patching and vulnerability management, anti-malware, endpoint disk encryption, and intrusion prevention are managed through our Information Technology asset and endpoint management solutions.

Encryption

All customer data is encrypted at rest and in transit using encryption methods as outlined in Federal Information Processing Standard (FIPS) Publication 140-2 (FIPS 140-2) Annex A or greater (e.g. Advanced Encryption Standard with a 256-bit key or higher).

01 / 04

Operational security overview

Retention, privacy, and security: Keys to AI success

Data residency

To help comply with data residency requirements, the platform has the ability to control where data is stored and also customize and restrict data storage to certain regions.

Data protection

The platform applies appropriate technical, organizational and administrative measures, including encryption and multi-factor authentication (MFA) so that customer data remains secure at all times. The platform can deploy a web application firewall (WAF) at a customer’s request.
Any type of customer data (including confidential and personal data) may reside on the platform and the customer has full discretion as to what data is submitted to the platform for processing. Customer data is retained only for the duration of the services and then either returned or deleted upon the customer’s direction.
Iron Mountain is aware that many countries have laws governing international data transfers and relies on Standard Contractual Clauses for internal and external transfers of personal data, as applicable, e.g., EU/ UK personal data transfers to countries such as the U.S. and India. Iron Mountain complies with the EU-U.S. Data Privacy Framework (DPF), the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Iron Mountain Data Processing Agreement sets out our responsibilities and commitments related to the processing of customer personal data.

NOTE: Please view Iron Mountain’s Privacy Notice to learn more about our privacy and data protection practices.

01 / 04

Data privacy

Enhancing Citizen Trust Privacy and Data Security is Step One | data security typing on laptop

Loading component...

Download Resource

Iron Mountain InSight DXP security whitepaper

Executive Summary

About Iron Mountain security

Training

Featured services

InSight DXP

InSight DXP use cases

Intelligent document processing in InSight DXP