Security certification raises compliance options for regulated industries
Protecting critical data is no longer just about preventing attacks: organizations must also demonstrate that their infrastructure meets increasingly stringent security requirements amid growing regulation.
The adoption of artificial intelligence, data sovereignty requirements, and evolving regulatory frameworks are increasing scrutiny of how organizations govern and protect their critical information.
This environment is also raising the requirements for the technology infrastructure they use to store and manage that data.
In this context, Hitachi Vantara has obtained the Common Criteria (ISO/IEC 15408) international certification for its Virtual Storage Platform One (VSP One) Block storage platform, an independent assessment of its security capabilities for sensitive and mission-critical data.
The validation is aimed particularly at government organizations and regulated industries that must meet strict information protection requirements.
The certification was issued under Japan’s IT Security Evaluation and Certification Scheme (JISEC) and is backed by the CCRA agreement, which establishes mutual recognition of these evaluations among participating countries. Its official validity extends through June 19, 2031, under registration JISEC-C0870.
Security requirements in regulated industries.
In Latin America, countries such as Argentina, Brazil, Chile, Colombia, and Mexico have critical infrastructure sectors in which international certifications may be required for hardware and software procurement. Areas subject to these requirements include government agencies, financial institutions, telecommunications, and the armed forces.
The VSP One Block validation covers capabilities related to cryptographic support, security management, identification, authentication, and trusted communications.
The international recognition of these evaluations may facilitate consideration of the platform in public tenders and audits of regulated organizations, in accordance with the mutual recognition mechanisms associated with the CCRA.
Data sovereignty raises the bar.
Recent industry research cited in the announcement indicates that 38% of organizations have established data sovereignty governance, while 46% have implemented a technical architecture for this purpose.
In addition, 43% identify technical obstacles as a major impediment, compared with 26% recorded in 2025.
In this context, independent validation provides objective evidence that a technology has been assessed against defined security requirements.
This can support vendor evaluation processes and risk management strategies, although certification alone does not replace the security policies and controls each organization must implement.
Octavian Tanase, Chief Product Officer (CPO) at Hitachi Vantara: “Organizations are under immense pressure to demonstrate that the technology supporting their most critical data has been proven to meet rigorous security standards.”
Data protection and recovery.
Hitachi Vantara’s data resilience strategy aligns with the NIST Cybersecurity Framework 2.0 and includes capabilities to protect hardware, software, networks, and data; identify vulnerabilities; detect intrusions and malware; respond to attacks; and facilitate information recovery.
VSP One Block also combines immutable data protection with CyberSense, a ransomware detection technology that, according to the company, identifies data corruption caused by these attacks with 99.99% accuracy and enables the identification of clean data snapshots for recovery.
The platform also comes with a 100% Data Availability Guarantee. Eligible VSP One Block systems are covered by a Cyber Resilience Guarantee that provides a 100% clean recovery point following a cyberattack, subject to the company’s terms and conditions.
The ISO/IEC 15408 certification provides external validation of VSP One Block’s security capabilities at a time when organizations face increasingly stringent regulatory requirements and must demonstrate how they protect their critical data.
|
|
