generated: '2026-07-18'
method: searched
source: https://www.bmc.com/corporate/trust-center/compliance.html
note: >-
  Compliance program is BMC-wide (BladeLogic / TrueSight Server Automation is a
  BMC product). Standards below are published certifications/attestations, not
  API protocol conformance (no public OpenAPI is available to derive protocol
  conformance from — the REST API ships with the on-prem Application Server).
standards:
- id: soc2-type-ii
  conforms: true
  evidence: SOC 2 Type II attestation (Control-M SaaS) listed on compliance page
- id: iso-27001
  conforms: true
  evidence: ISO 27001:2022 ISMS certification
- id: iso-27017
  conforms: true
  evidence: ISO 27017:2015 cloud security controls
- id: iso-27701
  conforms: true
  evidence: ISO 27701:2019 privacy information management
- id: csa-star
  conforms: true
  evidence: Cloud Security Alliance STAR registry entry
- id: c5
  conforms: true
  evidence: C5:2020 cloud computing baseline
- id: tisax
  conforms: true
  evidence: TISAX automotive information security assessment
- id: nist-800-171
  conforms: true
  evidence: NIST SP 800-171 CUI protection
- id: gdpr
  conforms: true
  evidence: GDPR privacy program (BMC privacy policy + PIMS)