INDUSTRY-LEADINGSECURITY & COMPLIANCE
The Complete PAAS Solution for Multi-Omics & Scientiﬁc DataOVERVIEWDIAGRAM KEY

DNAnexus is the global leader in genome informatics and data management,
providing the industry’s most comprehensive security, quality and privacy
framework. Learn why the FDA, top pharmaceutical companies, global diagnostic
test providers, genome centers and sequencing service providers have trusted
DNAnexus to support their global genomics programs.

SET APART FROM THE RESTLayers of platform features& accreditation supporting an
exceptionally strong security& compliance proﬁle.

Compliance with ISO 27001, aninternationally recognized
Information Security Management
System & accompanying controls.

Continually audited & certiﬁedby an independent 3rd party.

Built to address a broad range ofglobal compliance regimes.

BAA: Business Associate Agreements tocomply with HIPAA regulations.
CAP: The College of American Pathologists
comprehensive set of accreditation guidelines
for laboratory quality assurance.
CLIA: 1988 Clinical Laboratory Improvement
Amendments established quality standards for
all lab testing to ensure validity, reliability &timeliness of lab examinations & procedures,
handling of specimens, & reporting of results.
EU-US Privacy Shield: New privacy & datatransfers pact which supersedes the former
Safe Harbor framework.
FedRAMP: Government-wide program thatprovides a standardized approach to security
assessment, authorization, & continuous
monitoring for cloud products & services.
FISMA: Federal Information Security
Management Act

CustomerCompliance

EU-US
Privacy Shield=DNAnexus
Compliance+

DNAnexus
Features+

Cloud
Compliance

CAP
CLIA

HIPAA
BAA

FISMA

GxP

GDPR

DNAnexus Platform-as-a-Service

GxP: Good Clinical Practices (GCP), Good
Laboratory Practices (GLP), and 21 CFR § 11and 820 as required for submitting data forregulatory approval (GxP) to the United States
Food & Drug Administration

ISO 27001

FedRAMP ATO

BAA

GDPR: General Data Protection Regulation
cover the EU as a Data Processor.

MonitoringThreat Management

Access Controls

Immutable Data

Complete Encryption

Logging

HIPAA: U.S. Health Insurance Portability &Accountability Act

Multi-Factor Auth

Single Sign-on

Chain of Provenance

Cloud Infrastructure
FISMA

HIPAA

FedRAMP

SOC 2

ISO 27001

ISO 27001: Internationally recognized
Information Security Management System thatprovides a comprehensive framework forsecurity & compliance
SOC 2, Type II: Service Organization Controls
reportApril 2019 | www.dnanexus.com

DNAnexus SECURITY ARCHITECTURE
Platform Security Architecture

Availability

Access Control

Consent

DNAnexus restricts user data to high-security facilities with
SOC2 Type II, and FedRAMP Moderate Authorizations toOperate. All data are encrypted when in transit (TLS 1.2+) andat rest (AES 256). DNAnexus follows the ISO27001 and NIST
800-53r4 standards for controls around Conﬁdentiality,
Integrity and Availability (CIA).

Administrator controls restrict users and organizations withwhom to share information, allowing granular privilege levels tobe speciﬁed on groups of data and application resources. “CopyNot Allowed” functionality prevents the movement of data toother projects. Downloads can be disabled to comply with data
localization requirements. Twofactor authentication, password
complexity and change requirements, and session timeout
features also protect against unauthorized access to
conﬁdential data.

Consistency of Results

Preconﬁgured pipelines allow bioinformaticians to presetparameters, thereby ensuring consistent analysis of samples.
These pipelines can be packaged as separate apps for “Pointand Click” functionality. All data, tools, and workﬂows aretracked and version controlled in order to ensure auditability
and reproducibility. DNAnexus provides runtime consistency
enabling all users to work in a common operating environment.

Auditability

DNAnexus provides comprehensive features that provide audit
trails necessary to document compliance. All uploads are loggedand “hashed” to verify integrity and audit logs are maintained inalignment with industry standard retention policies.

All user data is redundantly stored on multiple devices acrossmultiple facilities to provide 99.999999999% durability with
99.99% access availability. Consistent with ISO 27002
controls, disaster recovery and incident response plans are inplace to ensure that appropriate recovery steps are followed
including stakeholder notiﬁcation.

Under DNAnexus’ Privacy Policy, users are responsible for
ensuring patients or donors of genomic samples have provided
informed consent. DNAnexus has helped many customers
adhere to data compliance in accordance to speciﬁc privacy
laws and regulations.

Privacy

DNAnexus acts as a data processor to help customers
manager their EU data in compliance with GDPR. In addition
to the EU and US, DNAnexus’ Privacy Policy aligns with theregulations of Australia, Canada, and the principles of theCross Border Privacy Enforcement Agreement and Data
Transfer Agreements.

Compliance & Assessment

DNAnexus performs regular independent audits of security
controls and a formal annual assessment of its entire security
management system. DNAnexus does weekly vulnerabilityscans and uses independent 3rd parties for network/application
penetration testing. DNAnexus is externally certiﬁed to be ISO
27001, HITRUST (in progress) and has a Moderate "Authority toOperate" for FedRAMP (NIST 800-53r4 and others).

DNAnexus CAN HELP
Complying with security standards and privacy regulations is an increasingly complex job. DNAnexus cloud-based platform simpliﬁes
security and compliance for critical business operations so your company can focus on what matters, the science. Leverage a team ofbioinformatics and cloud computing experts for a Security, Quality and Compliance Strategy that meets your business needs.

For a detailed overview of the DNAnexus approachto security & privacy, email us at info@dnanexus.com

April 2019 | www.dnanexus.com