Secure Development Lifecycle
Trimble’s Secure Development Lifecycle (TSDLC) framework comprises tools and processes that embed and operationalize security practices to ensure our solutions meet consistent security levels. These include security measures on our systems and networks such as identity and access management, vulnerability management, intrusion detection solutions and more.
External certifications
SOC 1 Type II
SOC 1 type 2 has been certified in accordance with the AICPA SSAE NO.18 and IAASB ISAE 3402 Standards.
SOC 2 Type II
SOC 2 type 2 was certified in accordance with the AICPA SSAE NO. 18 and IAASB ISAE 3000 Standards.
SOC 3 ISAE
SOC 3 ISAE has been certified in accordance with the AICPA Attestation and IAASB ISAE No. 3000 Standards.
ISO 27001
Trimble relies on specific services on Trimble Cloud xOps for Operational Support, Security Operations, and Developer Virtual Private Network (VPN) Service. Trimble Cloud xOps is certified by ISO/IEC 27001:2013. An independent third-party auditor conducts yearly surveillance audits of Trimble Cloud xOps as well as a full audit of Trimble’s Information Security Management System (ISMS) every three years.
Security compliance for government agencies
For Trimble customers at government organizations, a production environment compliant with U.S. federal, state and local government security standards is available in Trimble Unity Construct Government Edition. This production environment provides:
FedRAMP Authorized: Moderate Impact Level Security
FedRAMP ensures cloud solutions for U.S. government agencies meet NIST security standards. The U.S. Department of Energy is the authorizing agency. The FedRAMP Authorized Moderate Impact Level Security standard requires 325 security controls.
Reporting vulnerabilities
As part of Trimble’s continued dedication to security, the public is encouraged to report vulnerabilities found in Trimble Unity Construct. Trimble reviews all reported vulnerabilities for validity, severity and solution. Once analyzed, Trimble will develop a plan of action to address the vulnerability.
Report vulnerabilities by emailing: e-builderfedrampsecurity@trimble.com
