Hitachi Vantara wins security certification for VSP One

Hitachi Vantara has secured Common Criteria certification for its VSP One Block storage platform. The certification applies to the VSP One B20 system.

It covers security functions including authentication, encryption, security management and trusted communications. Issued under the Japan IT Security Evaluation and Certification Scheme, it is recognised through the Common Criteria Recognition Arrangement, which allows participating countries to accept certified results.

Common Criteria, formally known as ISO/IEC 15408, is an international standard for assessing the security features of information technology products against defined requirements. In this case, the system was evaluated against the collaborative Protection Profile for Network Devices Version 3.0e.

The announcement is aimed at government bodies and organisations in regulated sectors that must show infrastructure handling sensitive information has been independently assessed. Such checks can influence procurement decisions and internal risk reviews where storage systems support critical workloads.

Hitachi Vantara linked the certification to broader concerns over data governance, cyber risk and regulatory scrutiny. It cited industry research showing that 38% of organisations have established sovereignty governance and 46% have established technical architecture, while 43% cite technical hurdles as a key obstacle.

Broader security

Beyond the certification, the wider VSP One Block platform includes immutable data protection and ransomware detection through CyberSense. Hitachi Vantara said these tools are designed to help customers identify suspicious activity, protect stored data and locate clean snapshots for recovery after an attack.

Qualifying systems are also covered by a Cyber Resilience Guarantee that promises a 100% clean recovery point following a cyberattack. VSP One is also backed by a 100% Data Availability Guarantee.

Hitachi Vantara said its broader resilience approach aligns with the NIST Cybersecurity Framework 2.0 and includes what it describes as risk-optimised data resilience zones, which group critical data by business risk and regulatory requirements. It also pointed to earlier alignment with the US Secure Software Development Framework, validated through a third-party attestation process and confirmed by the Cybersecurity and Infrastructure Security Agency.

Octavian Tanase, Chief Product Officer at Hitachi Vantara, said the certification is part of a broader effort to address customer concerns over security standards and resilience. "Organisations are under immense pressure to demonstrate that the technology supporting their most critical data has been proven to meet rigorous security standards," Tanase said. "Common Criteria provides independent validation of the critical security capabilities of VSP One Block, and it is another proof point in the broader data and cyber resilience solutions we have built across the VSP One portfolio, helping customers protect critical information, reduce risk and strengthen organizational resilience across operational, financial and governance priorities."

Public sector focus

The certification is likely to be particularly relevant to public sector buyers and contractors working with regulated datasets, where evidence of third-party assessment can carry weight in supplier reviews. Security certifications do not remove operational risk, but they can provide a common benchmark for comparing products during formal purchasing processes.

Mark Serway, President and Chief Executive Officer of Hitachi Federal, said the issue is especially important in government settings. "Government organizations need confidence that the infrastructure supporting critical missions has been evaluated against recognized security requirements," Serway said. "Independent certifications such as Common Criteria provide another important source of assurance during technology evaluation, while Hitachi Vantara's broader cyber resilience capabilities help agencies protect access to critical data and maintain continuity when disruptions occur."

The certification identifier is JISEC-C0870. It was granted under Common Criteria Version 3.1 Release 5 and remains valid through 2031.