CGI
Security and trust center evidence
Since 1976, CGI has grown into one of the largest IT and business consulting services firms in the
Summary
CGI has 3 registry-verified rows in the CertReports index, last verified 31 Oct 2026. The strongest row is FedRAMP: FedRAMP Authorized. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
FedRAMP registry records show CGI as FedRAMP Authorized, with an authorization date of 26 Apr 2021, as recorded in the FedRAMP registry as of 12 Oct 2026. The FedRAMP entry names Kratos as the assessor, as of 12 Oct 2026. CGI is listed in the Visa Global Registry as PCI DSS validated through 31 Jan 2027, with CIPHER named as auditor, as of 12 Oct 2026. CGI is listed in the EU-US Data Privacy Framework registry as of 12 Oct 2026, showing active EU-US, UK Extension and SW-US certifications issued 8 Jan 2024. The EU-US Data Privacy Framework entry notes an expiration date of 8 Dec 2026, as of 12 Oct 2026.
- FedRAMP - Authorized, issued 26 Apr 2021 (auditor Kratos), as of 12 Oct 2026
- PCI DSS - Visa Global Registry, validated through 31 Jan 2027 (auditor CIPHER), as of 12 Oct 2026
- EU-US Data Privacy Framework - active, issued 8 Jan 2024, expires 8 Dec 2026, as of 12 Oct 2026
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 13 Oct 2026; it is regenerated whenever a row changes.
Among business services vendors
3verified rows
Category median 0, across 146 indexed business services vendors. CGI has more verified rows than 97 percent of them.
digital-transformationenterprise-servicesit-consultingtechnology-solutions
Compliance grid
FedRAMPVerifiedFedRAMP Authorized
as of 31 Oct 202645 sources · Kratos
PCI DSSVerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-01-31
as of 12 Oct 20262 sources · CIPHER
EU-US Data Privacy FrameworkVerifiedActive: EU-US Certification, UK Extension Certification, SW-US Certification
as of 26 Oct 20261 source
Legal artefacts
No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this.
Subprocessors
No subprocessor list captured yet.
Change history
- 12 Oct 2026PCI DSS auditor changedAuditor changed from Foregenix Ltd. to CIPHER.
- 18 Sep 2026First indexed by CertReports5 evidence rows across 3 frameworks entered the index.
Similar vendors with evidence
Related by product tags and the Business services category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Stefanini
Business services
Partner with Stefanini, global tech consulting present in 104
Xigo
Business services
NTT drives innovation globally with human-centered technology, creating a connected future for people and
Protiviti
Business services
Protiviti is a management consulting firm providing IT consulting, Risk & Compliance, Digital Transformation, Internal Audit
Longevity Consulting
Business services
Longevity is a customer-focused management consulting firm that partners with our clients to achieve their goals, improve outcomes, and
Evidence against regulations
All regulations for CGIHow much of each regulation’s vendor requirements CGI’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read