Kyndryl
Security and trust center evidence
At Kyndryl, we design, build, manage and modernize the mission-critical technology systems that the world depends on every
Summary
Kyndryl has 2 registry-verified rows in the CertReports index, last verified 2 Nov 2026. The strongest row is EU-US Data Privacy Framework: Active: UK Extension Certification, SW-US Certification, EU-US Certification. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
As of 17 Sep 2026, Kyndryl is listed in the EU-US Data Privacy Framework registry as active, covering UK Extension, SW-US, and EU-US Certifications, issued 12 Feb 2024 and expiring 21 Jan 2027. As of 21 Sep 2026, Kyndryl Inc. is listed as a designated critical ICT third-party provider under DORA Article 31, per the ESAs list dated 18 Nov 2025. No public evidence of SOC 2 was found for Kyndryl as of 21 Sep 2026. No public evidence of ISO/IEC 27001 certification was found for Kyndryl as of 21 Sep 2026. No public evidence of PCI DSS validation was found for Kyndryl as of 21 Sep 2026.
- EU-US Data Privacy Framework: listed in registry as active through 21 Jan 2027 (as of 17 Sep 2026)
- DORA: listed as designated critical ICT third-party provider under Article 31, ESAs list dated 18 Nov 2025 (as of 21 Sep 2026)
- SOC 2 / ISO/IEC 27001 / PCI DSS: no public evidence found (as of 21 Sep 2026)
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 26 Sep 2026; it is regenerated whenever a row changes.
Among it management vendors
2verified rows
Category median 1, across 53 indexed it management vendors. Kyndryl has more verified rows than 72 percent of them.
cloud servicesinfrastructure managementit operationsmanaged it services
Compare with similar vendors
Pick your own comparisonCompliance grid
EU-US Data Privacy FrameworkVerifiedActive: UK Extension Certification, SW-US Certification, EU-US Certification
as of 2 Nov 20261 source
DORA critical ICT provider designationVerifiedDesignated critical ICT third-party provider under DORA Article 31 as Kyndryl Inc. (ESAs list of 18 November 2025)
as of 2 Nov 20261 source
Legal artefacts
No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this.
Subprocessors
No subprocessor list captured yet.
Change history
- 22 Sep 2026DORA critical ICT provider designation evidence addedA DORA critical ICT provider designation row entered the index with state Verified.
- 18 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.
Similar vendors with evidence
Related by product tags and the IT management category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Cloudscale365
IT management
As your single-source managed IT provider, CloudScale365 makes technology easy for small and medium-sized businesses across
eapps
IT management
As your single-source managed IT provider, CloudScale365 makes technology easy for small and medium-sized businesses across
Ensono
IT management
Ensono helps enterprises modernize and manage mission-critical IT with flexibility, expertise, and innovation — spanning mainframe, cloud
Torii Software
IT management
Torii, a leader in the Gartner® Magic Quadrant™ for SaaS Management Platforms, empowers IT pros to solve modern SaaS challenges at their
Evidence against regulations
All regulations for KyndrylHow much of each regulation’s vendor requirements Kyndryl’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read