N-able Security Statement

Last Updated: 10-November-2023

N‑able is committed to the security and privacy of our partners and their customers. We strive to implement and maintain security processes, procedures, standards, and take all reasonable care to prevent unauthorized access to customer data. We apply what we believe are appropriate administrative, operational, and technical security controls to help ensure that our customer data is handled and processed in a responsible and secure manner.

This Security Statement is aimed at providing you with more information about our security infrastructure and practices. Our Privacy Notice  contains more information on how we handle data that we collect.

Reporting a Security Vulnerability

N‑able reviews all reports of security vulnerabilities submitted to it affecting N‑able products and services. To learn more about the N-able vulnerability disclosure program or to report a vulnerability in one of our products or solutions or a vulnerability in one of our corporate websites, please see more information here.

Information Security Policy

N‑able maintains a written Information Security policy that defines employee responsibilities and acceptable use of information system resources. The organization receives acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior before providing authorized access to N‑able information systems. This policy is reviewed annually and updated as necessary.

Our security policies cover a wide array of security related topics ranging from general standards with which every employee must comply, such as account, data, and physical security, to more specialized security standards covering internal applications and information systems.

Organizational Security

Information security roles and responsibilities are defined within the organization. The N‑able Security Office (NSO) focuses on information security, global security auditing and compliance, as well as defining the security controls for protection of N‑able’s hardware and cloud infrastructure.

The NSO team receives information system security notifications on a regular basis and distributes security alert and advisory information to the organization as needed after assessing the risk and impact as appropriate.

N‑able generally follows the National Institute of Standards and Technology (NIST) Cybersecurity Framework with layered security controls to help identify, prevent, detect, and respond to security incidents. The NSO team is also responsible for tracking incidents, vulnerability assessments, threat mitigation, and risk management.

Asset Management

N‑able data and information system assets are comprised of customer and end-user assets as well as corporate assets. These asset types are managed under our security policies and procedures. N‑able authorized personnel are trained to understand how these assets contribute to our overall security posture and trained to comply with the policies and procedures when procuring and managing them.

Personnel Security

N‑able employees are required to conduct themselves in a manner consistent with the company’s guidelines, including those regarding confidentiality, business ethics, appropriate usage, and professional standards. All newly hired employees are required to sign confidentiality agreements and to acknowledge the N‑able code of conduct policy. The code outlines the company’s expectation that every employee will conduct business lawfully, ethically, with integrity, and with respect for each other and the company’s users, partners, and competitors. Processes and procedures are in place to address employees who are on-boarded and off-boarded from the company.

Employees are provided with security training as part of new hire on-boarding. In addition, each N‑able employee is required to read, understand, and take a training course on the company’s code of conduct on an annual basis.

Physical and Environmental Security

N‑able has policies, procedures, and infrastructure to handle both the physical security of its data centers as well as the environment from which the data centers operate.

Our information systems and infrastructure are hosted in data centers that are geographically dispersed to provide high availability and redundancy to N‑able and its customers. The standard physical security controls implemented at each data center include electronic card access control systems, fire alarm and suppression systems, interior and exterior cameras, and security guards. Physical access is centrally managed and strictly controlled by data center personnel. All visitors and contractors are required to present identification, are required to log in, and be escorted by authorized staff through the data center.

Access to areas where systems or system components are installed or stored are segregated from general office and public areas. The cameras and alarms for each of these areas are centrally monitored 24×7 for suspicious activity, and the facilities are routinely patrolled by security guards. Servers have redundant internal and external power supplies. Data centers have backup power supplies and can draw power from diesel generators and backup batteries. These data centers have undergone SSAE 16 audits, which produced a Service Organization Control (SOC) 2 Type II attestation letters.  They are also ISO27001 certified.

Operational Security

Change Management

N‑able maintains a change management process to ensure that all changes made to the production environment are applied in a deliberate manner. Changes to information systems, network devices, and other system components, and physical and environment changes are monitored and controlled through a formal change control process. Changes are reviewed, approved, tested, and monitored post-implementation to ensure that the expected changes are operating as intended.

Supplier and Vendor Relationships

N‑able partners with suppliers and vendors that operate with the same or similar values around lawfulness, ethics, and integrity that N‑able does. As part of its review process, N‑able screens our suppliers and vendors and binds them to appropriate confidentiality and security obligations, including requirements for appropriate management of any customer data they may handle.

Auditing and Logging

We maintain system audit logs which provide an account of which personnel have accessed which systems. We limit access of our auditing and logging tools to authorized individuals.  Security events are logged, monitored, prioritized, and addressed by trained security team members. Network components, workstations, applications, and any monitoring tools are enabled to monitor user activity. Organizational responsibilities for responding to security events are defined. Critical system configuration changes create audit events, which are recorded and reviewed at the time of change. Retention schedules for the various logs are defined in our security control guidelines.

Antivirus and Malware Protection

Antivirus and malicious code protection are centrally managed and configured to retrieve the updated signatures and definitions available. Malicious code protection policies automatically apply updates to these protection mechanisms. Anti-virus tools are configured to run scans, virus detection, real-time file write activity, and signature file updates. Laptop and remote users are covered under virus protection. Procedures to detect and remove unauthorized or unsupported (e.g. freeware) applications are documented.

System Backups

N‑able has backup standards, guidelines, and associated procedures for performing backup and restoration of data in a scheduled and timely manner. Controls are established to help safeguard backed-up data (onsite and off-site). We also work to ensure that customer data is securely transferred or transported to and from backup locations. Periodic tests are conducted to test whether data can be safely recovered from backup devices.

Network Security

Our infrastructure servers reside behind high-availability firewalls and are monitored for the detection and prevention of various network security threats. Firewalls are utilized to help restrict access to systems from external networks and between systems internally. By default, all access is denied and only explicitly allowed ports and protocols are allowed based on business need.

N‑able maintains separate development and production environments. Our next generation firewalls (NGFWs) are designed to provide network segmentation through the establishment of security zones that control the flow of network traffic. These traffic flows are defined by strict firewall security policies.

Automated tools are deployed within the network to support near-real-time analyses of events to support of detection of system-level attacks. NGFWs deployed within the data center as well as at remote office sites monitor outbound communications for unusual or unauthorized activities, which may be an indicator of the presence of malware (e.g., malicious code, spyware, adware).

Data Protection

N‑able continually strives to develop products that support the latest recommended secure cipher suites and protocols to encrypt traffic while in transit. We monitor the changing cryptographic landscape closely and work to upgrade our products to respond to new cryptographic weaknesses as they are discovered, implementing best practices as they evolve.

Vulnerability Management

Security assessments are performed to identify vulnerabilities and to determine the effectiveness of the patch management program. Each vulnerability is reviewed to determine if it presents a valid risk, ranked based on potential impact and probability, prioritized, and then triaged to the appropriate team for remediation.

Patch Management

N‑able strives to apply the latest security patches and updates to operating systems, applications, and network infrastructure to mitigate exposure to vulnerabilities. Patch management processes are in place to implement security patch updates as they are released by vendors. Patches are tested in a separate environment prior to being deployed into production.

Secure Network Connections

HTTPS encryption is configured for customer access to web applications. This helps ensure that while in transit, user data is safe, secure, and available only to intended recipients. The level of encryption is either SSL or TLS encryption and is dependent on what the web browser can support.

Access Controls

Role-Based Access

Access to information systems is provisioned using Role-Based Access Controls (RBAC).  The permissions in RBAC are based on what level of access specific user categories require to perform their duties. N‑able employees are granted a limited set of default permissions to access company resources, such as their email and the corporate intranet. Employees are granted access to certain additional resources based on their specific job function. Requests for additional access follow a formal process that involves a request and an approval from a data or system owner, manager, or other executives, as defined by our security guidelines. Approvals are managed by workflow tools that maintain audit records of changes. Processes and procedures are in place to offboard employees who separate voluntarily or are terminated. Access to sensitive data in our databases, systems, and environments is set on a need-to-know/least privilege necessary basis.

Authentication and Authorization

We require that authorized users be provisioned with unique account IDs. Our password policy covers all applicable information systems, applications, and databases. We enforce password best practices, such as complexity requiring both alpha and numeric characters and Multi-factor Authentication (MFA) to protect against unauthorized use of passwords.

Software Development Lifecycle

We follow a defined methodology for developing secure software that is designed to increase the resiliency and trustworthiness of our products. Our products are deployed on an iterative, rapid release development lifecycle. Security and security testing are implemented throughout the entire software development methodology. Quality Assurance is involved at each phase of the lifecycle and security best practices are mandated for all development activities.

Our secure development lifecycle follows standard security practices including vulnerability testing, regression testing, penetration testing, and product security assessments. The N‑able architecture teams review our development methodology regularly to incorporate evolving security awareness, industry practices, and to measure its effectiveness.

Incident Management

N‑able has a formalized Incident Response Plan (IRP) and associated procedures in case an information security incident is declared.  The IRP defines the responsibilities of key personnel and specifies procedures to follow regarding any communication or notifications about the Incident. The IRP is tested at least annually.

The NSO team has a dedicated Incident Response Team, with trained resources that are responsible for the various stages of our Incident Management strategy, including preparation, detection and analysis, containment, eradication, and recovery.

Business Continuity and Disaster Recovery

To minimize service interruption due to hardware failure, natural disaster, or other catastrophe, we have implemented a disaster recovery program at all our data center locations. This program includes multiple components to minimize the risk of any single point of failure. Application data is replicated to multiple systems within the data center and, in some cases, replicated to secondary or backup data centers that are geographically dispersed to provide adequate redundancy and high availability. High-speed connections between our data centers help to support swift failover.

Data Protection

We apply a common set of personal data management principles to customer data that we may process, transmit, and store. We believe we protect personal data using appropriate physical, technical, and organizational security measures.

We give additional attention and care to sensitive personal data and respect local laws and customs, as applicable.

N‑able strives to only process personal information in a way that is compatible with and relevant for the purpose for which it was collected or authorized in accordance with our privacy policy. We believe that we take all reasonable steps to protect information we receive from our users from loss, misuse or unauthorized access, disclosure, alteration and/or destruction.

For information on N‑able Vendor Data Protection Requirements, click here.