We use cookies to make your experience better. To comply with the new e-Privacy directive, we need to ask for your consent to set the cookies. Learn more.
ISO 27001
The systems and processes that support Bentley Managed Services are ISO/IEC 27001:2013 certified. ISO/IEC 27001:2013 is one of the most widely recognized information security standards. Compliance with ISO/IEC 27001:2013 is certified by A-LIGN an ANAB accredited ISO 27001 certification body. View the Bentley Managed Services ISO/IEC 27001:2013 certificate and the current ISO/IEC 27001:2013 Statement of Applicability.
Products in scope of Bentley’s ISO 27001 certification for Managed Services include AssetWise (eB Insight V8i), ConstructSim Work Package Server, and ProjectWise.
ISO 27001:2013 recertification audit completed: September 17, 2021. A-LIGN conducted a full audit virtually. The audit included procedures, interviews of personnel, controls, review of documentation and analysis of documentation of audit findings.
Service Organization Control (SOC)
Bentley’s information systems as a service are designed to keep user data secure with enterprise grade security and are audited annually against the SOC reporting framework by qualified independent computer-security auditors. The scope of the audit covers controls applicable to in-scope trust principles for each service. In general, the availability of these reports is restricted to customers who have signed non-disclosure agreements with Bentley.
Bentley Cloud Services
- To request the SOC 2 Type 2 report, contact your account manager. If you do not currently have a Bentley account and would like to request a SOC 2 report, contact us.
- The SOC 3 report is designed to be a public document containing a high-level summary without the confidentiality and NDA requirements of the SOC 2 report. Contact us to request SOC 3 report.
Bentley Managed Application Platform (B-MAP)
- To request the SOC 2 Type 1 report, contact your account manager. If you do not currently have a Bentley account and would like to request the SOC 2 Type 1 report, contact us.
- NOTE: Bentley is engaged with its independent external auditing firm and anticipates having the SOC2 Type 2 and SOC3 Reports available in late 3Q2023.
ISO 9001:2015
Bentley Systems (UK) Ltd has an ISO 9001 certification for part of the UK business activities of Cohesive, a business unit of Bentley Systems Inc. Cohesive delivers services across the whole asset lifecycle covering Deliver – Operate and Optimize.
The scope of the ISO 9001 relates to the ‘Deliver’ and ‘Operate’ Service activities in the UK. View the Bentley Systems (UK) Ltd. ISO 9001:2015 certificate for the Deliver activities, and the Operate activities.
ISO 14001:2015
Bentley Systems (UK) Ltd. has ISO 14001 certification for part of the UK business activities of Cohesive, a business unit of Bentley Systems Inc (UK) Limited. Cohesive delivers services across the whole asset lifecycle covering Deliver – Operate and Optimize.
The scope of the ISO14001 relates to the “Deliver” activities Services. View the Bentley Systems (UK) Ltd ISO14001:2015 certificate.
Cyber Essentials Plus
Bentley Systems (UK) Ltd. has Cyber Essentials Plus accreditation, a UK Government back cyber security framework, for the UK business activities of the Cohesive, trading as a business unit of Bentley Systems, Inc. View the Bentley Systems (UK) Ltd. Cyber Essentials Plus certificate.
Cloud Security Alliance
Bentley Systems is a Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) registrant. Bentley has completed the Consensus Assessments Initiative Questionnaire (CAIQ) for multiple products and services to provide answers to nearly 300 questions a cloud user or a cloud security auditor may wish to ask of a cloud provider. The CSA STAR is a publicly accessible registry that documents the security controls provided by various cloud computing offerings. The registry helps users assess the security of the cloud providers they currently use or are considering contracting with. View the CAIQ’s for Bentley Systems.
EU General Data Protection Regulation
On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) went into effect. The GDPR imposes new obligations that will impact companies and other organizations around the world that offer goods and services to European Union residents or that collect and process data tied to EU residents.
Bentley believes that the GDPR is an important step to strengthen and harmonize data protection of EU residents’ personal data. Learn more about Bentley’s Compliance with the GDPR. Review Bentley’s list of subprocessors.
Government Cloud
G-Cloud 13 is an online catalogue where public sector customers can procure cloud-based computing services such as software and cloud support. The Crown Commercial Service (an agency that works to improve commercial and procurement activity by the UK government) has signed a framework agreement with Bentley Systems UK for the following cloud software offerings and associated implementation services: AssetWise ALIM, AssetWise Linear Analytics, AssetWise Rail Condition Analytics (RCA), BCDE Common Data Environment, ComplyPro, iTwin-enabled Services, OpenCities Planner, OpenGround, ProjectWise, Reality Modeling Cloud Service, OpenFlows WaterSight, Orbit 3DM Cloud, Recurring Advancement Services Program, SYNCHRO Control, SYNCHRO Field, SYNCHRO Perform, SYNCHRO 4D.
Cyber Defence And Risk (CyDR)
The Cyber Defence and Risk (CyDR) accreditation from the UK Ministry of Defence (MOD) attests to the security of information and communication technology systems. Accreditation confirms that appropriate security measures are implemented for storing and processing MOD information. View Bentley CyDR accreditation certificate for cloud-based ProjectWise. The CyDR team reviews Bentley’s security processes annually.