Esri Software Security and Privacy
Esri is committed to delivering secure geospatial software and services that meet theneeds of customers, from individuals to large organizations. While Esri has always
taken the security of its products seriously, the importance of embedding security andprivacy into the development life cycle has increased as Esri continually advances Web
GIS and software-as-a-service (SaaS) offerings such as ArcGIS Online. This document
summarizes key aspects of Esri's Secure Development Life Cycle.
Governance
Security policies spanning the company are set at the corporate level by the corporate security team’s
Chief Information Security Officer (CISO), while privacy policies are set by the Chief Privacy Officer(CPO) within the Legal team. Esri’s Human Resource team ensures that all employees areappropriately vetted before onboarding. Corporate security controls are inherited across Esri, while
functional areas (such as engineering and operations) are responsible for specific security control
families, as seen in figure 1 below.
The security of Esri products and services is overseen by the Chief Information Security Officer (CISO)Products, who leads Esri's Software Security & Privacy team. This team is embedded within productoperations and engineering, providing security guidance and validation while fostering a security
champion program across the broad spectrum of product teams to help further embed security acrossEsri products.

Figure 1—Product Security Responsibility by Functional Area

October 3, 2023

Page 1 of 4

Secure Development Standards
Esri utilizes the Building Security In Maturity Model (BSIMM) as the backbone to measure its efforts toimmerse security throughout the development life cycle in the most effective manner for its products.
BSIMM was utilized to create Esri’s Product Security Baseline to assure basic security and privacy
requirements are addressed. The amount of security validation incorporated during the life cycle for aproduct varies depending on the product's relative risk.
Esri designs security into ArcGIS to ensure a consistent, secure experience across your enterprise,
whether it's providing role-based access control (RBAC), logging, authentication, or authorization.
ArcGIS is also designed to integrate into your organization's security infrastructure through support ofstandards such as LDAP, SAML, and even using your organization's identity store and security policies
at the web level to facilitate single sign-on or public key infrastructure (PKI) support. Additional
embedded product security capabilities are documented in Esri's Trust Center at Trust.ArcGIS.com aswell as our online help.
Esri provides secure coding training based on Open Web Application Security Project (OWASP)
guidelines and promotes awareness of the Common Weakness Enumeration (CWE/SANS) Top 25 mostdangerous software errors. Esri provides teams with secure coding checklists to further reinforce theimportance of key security items that all product teams should address. Basic items, such as malicious
code discovery, have been incorporated into the build process for many years, utilizing multiple
antivirus programs to minimize risk and false positive alerts.
Esri applies its most rigorous security measures for ArcGIS Enterprise and ArcGIS Online, since Web GIS
components are frequently exposed on the Internet. These products regularly undergo static codeanalysis, dynamic scans, third-party component analysis, and periodic third-party pen testing. Key
client-based offerings such as ArcGIS Pro undergo regular static code analysis and third-party
component scans. Esri continues to expand the amount of security validation it performs against all
ArcGIS products.
Software-as-a-Service Security
ArcGIS Online is Esri's premier software-as-a-service (SaaS) geographic information system (GIS).
Esri's security strategy for government-authorized offerings, such as ArcGIS Online, is based on anindustry-standard defense-in-depth approach that provides security controls at every level including
application, network, and facilities. ArcGIS Online is FedRAMP authorized by the US Government
ensuring that security and risk management activities are integrated under a risk management
framework. This includes annual third-party assessments / pen testing, and regular security
validation efforts including the scans mentioned for ArcGIS Enterprise. The Esri Managed Cloud
Services Advanced Plus offering is also FedRAMP authorized, providing single tenant ArcGIS
Enterprise hosting for both commercial organizations and federal agencies.
Vulnerability and Breach Response
Esri has a Product Security Incident Response Team (PSIRT), which reports to the CISO-Products, tohelp shepherd security issues from cradle to grave, as shown in figure 2. Vulnerability concerns canbe submitted via Esri's standard support process or Trust Center security concern page, where thePSIRT team will be engaged. To help prioritize efforts, Esri utilizes the Common Vulnerability Scoring
System (CVSS) to determine the potential severity of the vulnerability and adjust for applicable
October 28, 2022

Page 2 of 4

environment factors. Ultimately, the resolution of a reported incident may require upgrades toproducts that are under active support from Esri. If an item requires a security patch, upon release, itis broadcast in the Trust Center "Announcements" section, which has an RSS feed that customers cansubscribe to. Esri also announces patches through its Support site, blogs, and some end-user
products—such as ArcGIS Pro—to notify the user of updates when starting the application.
If an event were to occur where a customer's data being managed by Esri was confirmed breached,
Esri will contact the customer within 72-hours. Esri will coordinate with appropriate parties toinvestigate the security breach and perform remediation as necessary. Esri will provide updates tothe customer with applicable information on a mutually agreed-on schedule. Esri does not inform
any third party of a breach of a customer's information and data without first obtaining thecustomer's prior written consent, unless required by law or court order.

Figure 2—Product Security Incident Response Team (PSIRT) Workflow
Privacy
Esri values the privacy of its customers, distributors, and partners, as it is a principal component ofestablishing trust. Esri has created a general company Privacy Statement and a Products & Services
Privacy Statement Supplement to ensure that customers receive the level of privacy they deserveand expect. The privacy statements describe how Esri collects data and uses information you provide
to us and are independently validated.
Esri supports alignment with the General Data Protection Regulation (GDPR), the California
Consumer Privacy Act (CCPA), and has a Data Processing Addendum (DPA) containing Standard
Contractual Clauses available within the ArcGIS Trust Center documents that customers can sign.
Lastly, HIPAA eligible services are available for ArcGIS Online, which are backed by a BusinessAssociate Agreement (BAA).

October 28, 2022

Page 3 of 4

More Security & Privacy Information
Esri posts detailed product security, privacy, andcompliance information to its Trust.ArcGIS.com
website. In addition to guidance for each of theseareas, there are security presentations, best practicetechnical papers, and in-depth answers to the Cloud
Security Alliance (CSA) common security questions.

Esri Software
Security & Privacy Team
SoftwareSecurity@Esri.com