figmaJul 1, 2026

Trust You Can Verify: Figma Is Now ISO 42001 Certified | Figma Blog (opens in new tab)

Figma has achieved ISO/IEC 42001:2023 certification, making its AI governance independently verifiable rather than based solely on company assurances. An ANAB-accredited certification body, Schellman, audited Figma’s policies, risk management, data practices, and AI development processes. The certification is intended to give customers—especially regulated organizations—stronger evidence for vendor assessments, regulatory reviews, and board reporting. ## Why Independent Verification Matters - Vendors can describe their AI controls through questionnaires, whitepapers, and documentation, but those materials remain self-reported. - ISO 42001 requires an accredited third party to evaluate whether an organization’s AI management system meets an international standard. - Figma says this provides more reliable evidence than simply claiming to practice responsible AI governance. ## Scope of Figma’s Certification - The certification covers the AI Management System governing how Figma designs, develops, and operates AI features. - It applies across: - Figma Design - Figma Make - FigJam - Dev Mode - Figma Sites - Figma Slides - Figma Draw - Figma Buzz - Figma Weave ## What the Audit Evaluated - The audit took place in two stages: - **Stage 1:** Reviewed the design of Figma’s AI Management System, including documentation, policies, and risk methodology. - **Stage 2:** Tested operational effectiveness through staff interviews, process observation, and control evaluations. - Auditors assessed 38 controls across nine areas: - AI impact assessment - Governance and accountability - AI-specific risk management - AI system lifecycle management - Data governance - Third-party AI risk - Monitoring and performance evaluation - Human oversight - Responsible use of AI systems - Figma emphasizes that the certification validates implementation, not merely the existence of written policies. ## Relevance for Customers - The certification gives customers evidence they can reference in: - Vendor risk assessments - Board reporting - Regulatory submissions - AI procurement processes - It is particularly relevant to financial services, healthcare, insurance, and public-sector organizations with strict security, privacy, and regulatory requirements. - Figma connects the certification to the EU AI Act and emerging procurement standards, which increasingly require demonstrable governance rather than vendor promises. ## Ongoing Commitment - Figma plans to continue submitting its AI governance practices to independent verification as its AI capabilities evolve. - Its certificate and broader compliance documentation are available through `compliance.figma.com`. - The certificate can also be verified through Schellman’s directory, and Figma says it will update its documentation when governance changes affect customer risk assessments. ISO 42001 certification represents a baseline for Figma’s ongoing AI governance efforts, giving customers independently audited evidence they can use when evaluating the company’s AI products.

security-complianceaidata-governanceai-governance+3

gitlabJun 17, 2026

GitLab named a Leader in the 2026 Gartner® Magic Quadrant™ for DevSecOps Platforms (opens in new tab)

GitLab says Gartner named it a Leader in the 2026 Magic Quadrant for DevSecOps Platforms for the fourth consecutive year. The company argues that AI agents have accelerated coding but shifted bottlenecks to pipelines, security, deployments, governance, and costs. GitLab positions its unified platform as the control layer that turns agent-generated code into secure, compliant, production-ready software. ## AI Requires a Control Layer - Enterprises increasingly use multiple coding agents, but often lack centralized governance over: - Which agents can run - What data they can access - Which actions they can take - How their activity is audited - GitLab combines source control, CI/CD, security, deployment, policies, and planning in one platform. - Changes made by developers or agents can be evaluated against existing code, pipelines, and organizational policies before reaching production. ## Enterprise-Scale DevSecOps - GitLab highlights customer examples: - Ericsson reportedly cut deployment time in half. - Southwest uses GitLab for mission-critical airline operations. - Barclays and other regulated organizations use it while maintaining security and compliance requirements. - The platform supports multi-tenant SaaS, single-tenant SaaS, self-managed, and air-gapped environments. - Customers can use self-hosted AI models and integrate existing tools and AI services while maintaining a unified governance boundary. ## Reliability and Availability - Gartner recognized GitLab’s strengthened service-level agreements. - GitLab offers Ultimate customers on GitLab.com and GitLab Dedicated a 99.9% monthly availability commitment. - Eligible customers can receive service credits when availability falls below that threshold. ## New Capabilities for Speed and Governance GitLab announced five innovations intended to coordinate developers, agents, and software delivery: - **Next-generation source code management:** Claimed testing showed up to 50× faster performance and up to 1,000× less network data transfer. - **GitLab Orbit:** A context graph connecting code, work items, pipelines, deployments, and production signals. With Claude Code, GitLab reports tasks running up to 11× faster, using up to 4.5× fewer tokens and producing up to 45× fewer hallucinations. - **Security and governance agents:** Designed to address security and compliance gaps as agent usage expands. - **Agentic triggers:** Automate handoffs between developers and agents without requiring manual coordination. - **GitLab Flex agreements:** Allow customers to adjust spending across GitLab products and capabilities without changing contracts. GitLab’s central recommendation is to standardize development and AI-assisted delivery on one platform, context graph, and governance boundary. The Gartner recognition supports that positioning, although Gartner notes that its Magic Quadrant reflects analyst opinions and should not be interpreted as an endorsement or a recommendation to select the highest-rated vendor.

security-complianceaigitlabci-cd+4

gitlabMar 4, 2026

How GitLab built a security control framework from scratch (opens in new tab)

GitLab created its own security control framework after finding that existing frameworks were too broad, rigid, or insufficiently granular for its multi-product, cloud-native environment. The GitLab Control Framework (GCF) combines industry best practices with product-specific implementations and extensive operational metadata. This lets GitLab manage multiple certifications and internal risks through one scalable framework rather than maintaining separate frameworks for each product. ## Why Existing Frameworks Were Insufficient - GitLab initially used the Secure Controls Framework, then adopted NIST SP 800-53 in preparation for FedRAMP. - NIST’s more than 1,000 controls were comprehensive but included requirements that did not apply to GitLab. - Broad controls often combined several distinct activities: - NIST AC-2, “Account Management,” covers account creation, modification, disabling, termination, shared accounts, and monitoring. - GitLab treated these as separate controls because they have different owners, risks, testing methods, and evidence requirements. - Repeatedly customizing NIST controls effectively meant GitLab was building its own framework, leading to the decision to formalize one. ## Establishing the GitLab Control Framework GitLab developed the GCF through five major steps: ### Assessing Requirements - The team mapped requirements from existing and planned certifications, including: - SOC 2 Type II - ISO 27001, ISO 27017, ISO 27018, and ISO 42001 - PCI DSS - TISAX - Cyber Essentials - FedRAMP - Internal requirements covered mission-critical systems outside certification scopes and systems handling sensitive data. - This analysis established the minimum controls GitLab needed to meet compliance and risk-management obligations. ### Learning from Industry Frameworks - GitLab compared its requirements with: - NIST SP 800-53 - NIST Cybersecurity Framework - Secure Controls Framework - Adobe and Cisco Common Controls Framework - The goal was to reuse proven structures and ensure important security domains and practices were not omitted. ### Creating Custom Domains - The team organized the framework into 18 custom control domains. - Each domain groups related controls according to how GitLab’s security program is managed. - The structure supports adding, changing, or retiring controls as the business evolves. ## Separating Framework Requirements from Implementations GitLab operates several products with different infrastructure and compliance scopes: - GitLab.com is a multi-tenant SaaS platform hosted on GCP. - GitLab Dedicated is single-tenant SaaS hosted on AWS. - GitLab Dedicated for Government is a FedRAMP offering hosted on AWS. To avoid duplicating the framework, the GCF uses two control levels: - **Level 1:** Defines what must be implemented at the organizational framework level. - **Level 2:** Describes how each product fulfills the requirement. - Entity-level controls apply across the organization and are inherited by all product offerings. - This model supports product-specific audits while preserving a single source of control requirements. ## Adding Operational Metadata Rather than tracking only a control ID, description, and owner, the GCF records detailed context for each control: - Responsible owner and risk accountability - Applicable environment or product - Covered assets and systems - Performance or testing frequency - Manual, semi-automated, or automated nature - External certification or internal-risk classification - Testing procedures and required evidence This turns the framework into an operational control inventory. Teams can filter it to identify controls for a particular audit, determine ownership, or find manual controls that may be candidates for automation. ## Designing for Growth - The GCF is intended to evolve with GitLab’s products, risks, and certification goals. - Its structured metadata helps GitLab assess scope and identify gaps when pursuing additional certifications such as ISMAP, IRAP, or C5. - The framework’s modular design makes it easier to extend compliance coverage without creating entirely new control systems. GitLab’s experience suggests that organizations should consider a custom framework when standard frameworks require extensive modification. The most effective approach is to retain useful industry guidance while tailoring control granularity, product implementations, ownership, testing, and metadata to the organization’s actual operating environment.

security-compliancedatabase-designgitlabcloud-native+4

figmaAug 26, 2019

Keeping your data in Figma safe and secure: SOC 2 Type 2, SSO, and more | Figma Blog (opens in new tab)

Figma presents security as a core part of its infrastructure and product development, emphasizing protection of customer data and design intellectual property. Its efforts include SOC 2 certification, privacy compliance for European customers, secure plugin architecture, and enterprise SAML single sign-on. An update later confirmed that Figma completed SOC 2 Type 2 certification and obtained a SOC 3 report. ## SOC 2 Certification - Figma initially achieved SOC 2 Type 1 certification after auditing its infrastructure, software, HR processes, and customer-data policies. - Type 1 evaluates controls at a specific point in time. - Type 2 provides stronger assurance by examining whether those controls operate effectively over an extended period. - By January 2020, Figma had completed SOC 2 Type 2 certification and secured a publicly downloadable SOC 3 report. ## European Data Protection - Figma highlights its readiness for growing European usage. - It complies with relevant data-protection requirements and was certified under: - The EU–U.S. Privacy Shield Framework - The Swiss–U.S. Privacy Shield Framework ## Security-First Product Development - Security is considered during the design of new features, not added afterward. - Figma’s plugin system deliberately limits access: - A plugin can access only one design file at a time. - Plugins cannot access a user’s entire account. - Plugins are isolated from one another’s data. - Plugins cannot modify Figma’s user interface, reducing phishing and user-misdirection risks. - These restrictions sometimes reduced available capabilities, but Figma prioritized security, stability, and performance. ## SAML Single Sign-On - SAML integrations help organizations deploy Figma securely and manage user access centrally. - Figma supported Okta and Microsoft Azure Active Directory, and added OneLogin. - Enterprise administrators can simplify authentication while maintaining organizational access controls. Figma’s overall approach is to combine independent compliance audits, privacy frameworks, careful product architecture, and centralized enterprise authentication. Organizations evaluating Figma should review its security and privacy documentation and consider enterprise SSO controls for managing access.

security-compliancecloud-securitysamlsoc-2+2