Microsoft

Microsoft is listed in the FedRAMP registry as FedRAMP In Process, audited by Kratos, as of 12 Oct 2026. Microsoft holds a CSA STAR Level 2 certification, issued 5 Apr 2016, which per the CSA STAR registry as of 12 Oct 2026 is built on an ISO/IEC 27001 certification. Microsoft holds active EU-US Data Privacy Framework, Swiss-US, and UK Extension certifications, issued 12 Aug 2016 and valid through 31 Aug 2027, per the Data Privacy Framework registry as of 12 Oct 2026. Microsoft, as Microsoft Ireland Operations Limited, is listed as a Designated Critical ICT Third-Party Provider under DORA Article 31, per the ESAs list of 18 Nov 2025, as of 12 Oct 2026. No public evidence found for PCI DSS or HIPAA frameworks for Microsoft as of 12 Oct 2026.

• FedRAMP In Process, auditor Kratos, per FedRAMP registry as of 12 Oct 2026.
• ISO/IEC 27001: CSA STAR Level 2 certification (built on ISO/IEC 27001), issued 5 Apr 2016, as of 12 Oct 2026.
• EU-US Data Privacy Framework: active EU-US, Swiss-US, UK Extension certifications, issued 12 Aug 2016, valid through 31 Aug 2027, as of 12 Oct 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 13 Oct 2026; it is regenerated whenever a row changes.