ZSCALER, INC.
INDEPENDENT PRACTITIONER’S REPORT ON
ITAR PERSONNEL SCREENING AND ACCESS AUTHORIZATIONPROCEDURES FOR ZSCALER’S ENVIRONMENTS
NOVEMBER 12, 2021

Attestation and Compliance Services

Proprietary & Confidential
Reproduction or distribution in whole or in part without prior written consent is strictly prohibited.

This report is intended solely for use by the management of Zscaler, Inc. and customers of its Zscaler
Private Access and Zscaler Internet Access (Moderate and High) environments covered by this report(referred to herein as a “specified user”).
If report recipient is not a specified user (herein referred to as a "non-specified user"), use of this reportis the non-specified user's sole responsibility and at the non-specified user's sole and exclusive risk.
Non-specified users may not rely on this report and do not acquire any rights against Schellman &Company, LLC as a result of such access. Further, Schellman & Company, LLC does not assume any
duties or obligations to any non-specified user who obtains this report and/or has access to it.
Unauthorized use, reproduction, or distribution of this report, in whole or in part, is strictly prohibited.

TABLE OF
CONTENTSSECTION 1 INDEPENDENT PRACTITIONER’SREPORT .................................................... 4
SECTION 2 MANAGEMENT’S ASSERTION .................. 7

SECTION 1
INDEPENDENTPRACTITIONER’SREPORTINDEPENDENT PRACTITIONER’S REPORTTo Zscaler, Inc.:Scope
We have examined management of Zscaler, Inc.‘s (“Zscaler”) assertion that description of its personnel screening
and access authorization procedures (“the “Controls”) related to aspects of the International Traffic in ArmsRegulations (“ITAR”) for its Zscaler Private Access (ZPA) and Zscaler Internet Access (ZIA) (Moderate and High)environments, as of November 12, 2021 (the “description”) is fairly presented, and the Controls stated in thedescription, were in place as of November 12, 2021, in accordance with management’s assertion. Zscaler provides
segmented infrastructure for performing services to US government organizations. Zscaler management isresponsible for its assertion. Our responsibility is to express an opinion on management’s assertion based on ourexamination.
Zscaler uses a combination of Amazon Web Services, Inc. (“AWS”) and colocation facilities for providing itsservices. The description in Section 3 includes only the Controls performed by Zscaler and excludes the controls,
and procedures of to those organizations. Our examination did not include the services provided by theseorganizations, and we have not evaluated the suitability of the design or operating effectiveness of suchcomplementary subservice organization controls.
Zscaler Responsibilities
Zscaler has provided the attached assertion, in Section 2, about the fairness of the presentation of the description
based on the description criteria. Zscaler is responsible for preparing the description and the assertion, including
the completeness, accuracy, and method of presentation of the description and assertion; providing the services
and related controls covered by the description; determining the applicability of implementing the controls described
therein for conformance of its personnel screening and access authorization procedures to meet the applicablerequirements of ITAR.
Independent Practitioner’s Responsibilities
Our examination was conducted in accordance with attestation standards established by the American Institute ofCertified Public Accountants. Those standards required that we plan and perform the examination to obtainreasonable assurance about whether management’s assertion is fairly stated, in all material respects. An
examination involves performing procedures to obtain evidence about management’s assertion. The nature, timing,and extent of the procedures selected depend on our judgment, including an assessment of the risks of material
misstatement of management’s assertion, whether due to fraud or error. We believe that the evidence we obtained
is sufficient and appropriate to provide a reasonable basis for our opinion.
Inherent Limitations
Our organization is a licensed and independent CPA firm; however, our examination does not constitute a legal
determination of compliance with the relevant regulations or a substitute for audit procedures that may be applied
separately by regulatory entities. The specific procedures we performed, the nature, timing, and results of our tests
are presented in section 4 of our report titled “Results.”
Because of their nature, Zscaler controls may not prevent, or detect and correct, all errors or omissions relevant to
its personnel screening and access authorization procedures. Also, the projection to the future of any evaluation ofthe fairness of the presentation of the description, or conclusions about the suitability of the design of the Controls
is subject to the risk that controls at Zscaler may become inadequate or fail.
OpinionIn our opinion, management’s assertion in all material respects, based on the criteria described in Zscaler’s
assertion in Section 2, is fairly stated, in all material respects.

a. The description fairly presents the Controls in place as of November 12, 2021, as required by the applicablerequirements of ITAR; andb. The Controls, stated in the description, were in place as of November 12, 2021.
Restricted UseThis report, including the description of the tests of controls and results thereof in the Testing Matrices, is intended
solely for the information, and use of Zscaler, and users of its ZPA and ZIA environments as of November 12, 2021,
who have sufficient knowledge and understanding of the following:•The nature of the service provided by Zscaler;•How Zscaler’s system interacts with users;•Internal control and its limitations;•The applicable ITAR requirements and users’ responsibilities for compliance; and•The risks that may threaten the achievement of the applicable ITAR requirements and how controls address
those risks.

This report is not intended to be and should not be used by anyone other than these specified parties.

Tampa, Florida
1/14/2022

SECTION 2
MANAGEMENT’S
ASSERTIONMANAGEMENT’S ASSERTION
We have prepared the description of Zscaler, Inc.’s (“Zscaler”) personnel screening and access authorization
procedures (the “Controls”) related to aspects of the International Traffic in Arms Regulations (“ITAR”) supporting
the ZPA and ZIA environments (the “description”) for user entities of the system as of November 12, 2021. We
confirm, to the best of our knowledge and belief, that:a. the description fairly presents the Controls supporting the ZPA and ZIA environments as of November 12,2021. The criteria we used in making this assertion were that the descriptioni.

presents how the Controls were designed and implemented;ii.

describes the controls deemed applicable by management for complying with aspects of ITAR;

iii.

specifies the assertions and Controls designed to achieve those assertions, andiv.

does not omit or distort information relevant to the scope of the Controls supporting the ZPA andZIA environments.

b. the controls related to Zscaler adherence to ITAR requirements were suitably designed as of November
12, 2021, to achieve the related assertions. The criteria we used in making this assertion were thati.

the risks that threaten the achievement of the assertions stated in the description have been
identified by Zscaler; andii.

the controls identified in the description would, if operating as described, provide reasonableassurance that those risks would not prevent the assertions stated in the description from being
achieved.

Section 3 of this report includes Zscaler’s description of the Controls supporting the ZPA, and ZIA environments
related to the applicable requirements under ITAR that is covered by this assertion.