Mimecast

Mimecast is listed in the FedRAMP registry as FedRAMP Authorized, with the authorization issued 8 Dec 2020 and audited by Deloitte & Touche LLP, per a registry record dated 19 Sep 2026. Mimecast is listed in the CSA STAR registry with a STAR Level 2 attestation issued 28 Sep 2015, per a CSA STAR record dated 17 Sep 2026. Mimecast is listed in the EU-US Data Privacy Framework registry as active for the SW-US, UK Extension and EU-US Certifications, issued 31 Jul 2018 and valid through 10 Jul 2027, per a DPF record dated 17 Sep 2026. Mimecast states it has a SOC 2 Type II report on its trust centre, per evidence dated 18 Sep 2026. The vendor also displays a HIPAA badge on its trust centre, though BAA availability is not captured, and states ISO/IEC 27001:2022, GDPR, Cyber Essentials, Cyber Essentials Plus, ISO/IEC 27701:2019, ISO/IEC 42001:2023, ISO 22301:2019, CCPA, TISAX and ENS on its trust centre, all per evidence dated 18 Sep 2026.

• Listed in the FedRAMP registry as FedRAMP Authorized since 8 Dec 2020 (audited by Deloitte & Touche LLP), per record dated 19 Sep 2026.
• Listed in the CSA STAR registry (STAR Level 2, issued 28 Sep 2015) and the EU-US Data Privacy Framework registry (active, issued 31 Jul 2018, valid through 10 Jul 2027), per records dated 17 Sep 2026.
• States it has a SOC 2 Type II report and displays a HIPAA badge (BAA availability not captured) on its trust centre, per evidence dated 18 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.