Hitachi Vantara has secured Common Criteria certification under ISO/IEC 15408 for its Virtual Storage Platform One (VSP One) Block, adding independent security validation to the data storage platform. The certification assesses key areas such as cryptographic functions, user identification and authentication, security administration and trusted communications.
The certification could be particularly relevant to government bodies and businesses operating in highly regulated sectors, where the infrastructure supporting sensitive and mission-critical information is subject to stringent security and compliance requirements. Independent evaluation gives such organizations an additional reference point when assessing technology vendors and selecting infrastructure for critical workloads.
Data infrastructure is facing a more demanding security environment as organizations accelerate AI adoption while dealing with stricter data sovereignty rules and an expanding regulatory framework. Protecting information is no longer limited to preventing unauthorized access; organizations also need to demonstrate how critical data is governed, where it resides and whether the underlying technology meets recognized security requirements.
Recent industry research highlights some of these challenges. Only 38% of organizations have established sovereignty governance, while 46% have put the required technical architecture in place. Technical hurdles remain a significant barrier cited by 43% of organizations, compared with 26% in 2025.
Against this backdrop, independent security assessments can provide organizations with evidence that a technology platform has been tested against established criteria. Such validation can support procurement decisions, vendor due diligence, compliance assessments and broader cybersecurity risk management.
Common Criteria provides a globally recognized framework for assessing the security properties of information technology products against defined evaluation requirements. VSP One Block was assessed against the collaborative Protection Profile for Network Devices (NDcPP) Version 3.0e. The evaluation covers several core security functions, including security auditing, cryptographic support, identification and authentication, security management and trusted communications. The certification was awarded through Japan’s IT Security Evaluation and Certification Scheme (JISEC), which is administered by the Information-technology Promotion Agency (IPA), Japan. The assessment was conducted by ECSEC Laboratory Inc.
JISEC operates within the Common Criteria Recognition Arrangement (CCRA) framework, which enables participating countries to recognize Common Criteria certificates issued under the arrangement. This gives the certification relevance beyond a single domestic security evaluation and provides an internationally recognized reference point for organizations assessing IT security capabilities.
Also Read: Sumitomo Joins Hero Future Energies for a Renewable Project Built for 24/7 Power
“Organizations are under immense pressure to demonstrate that the technology supporting their most critical data has been proven to meet rigorous security standards”, said Octavian Tanase, chief product officer, Hitachi Vantara. “Common Criteria provides independent validation of the critical security capabilities of VSP One Block, and it is another proof point in the broader data and cyber resilience solutions we have built across the VSP One portfolio, helping customers protect critical information, reduce risk and strengthen organizational resilience across operational, financial and governance priorities.”
From Security Validation to Outcome-Backed Cyber Resilience
The certification reaffirms Hitachi Vantara’s broader commitment to delivering trusted cyber resilience solutions. Hitachi Vantara takes a layered approach to data security and resilience, combining independent validation with technologies and services designed to mitigate cyber and regulatory risk and enable rapid, clean recovery following a cyberattack.
Key elements of this approach include:
Alignment with recognized cybersecurity frameworks: Hitachi Vantara’s approach to data resilience aligns with the NIST Cybersecurity Framework 2.0, including capabilities to protect hardware, software, networks and data; identify weaknesses; detect intrusions and malware; respond to attacks; and support rapid, clean data recovery at scale. This includes risk-optimized data resilience zones that organize critical data based on business risk and regulatory needs, helping organizations strengthen governance and compliance.
Independent security validation: Hitachi Vantara has previously achieved alignment with the U.S. government’s Secure Software Development Framework (SSDF), as outlined by NIST. The SSDF alignment was independently validated through a third-party attestation process and confirmed by the Cybersecurity and Infrastructure Security Agency (CISA). Hitachi Vantara is also a CISA Secure by Design pledge signatory, reinforcing its commitment to building security into products from the outset.
Layered data protection and threat detection: VSP One Block combines immutable data protection with Ransomware Detection powered by CyberSense, which provides 99.99% accurate ransomware data corruption detection and clean snapshot identification. Together, these capabilities help organizations detect suspicious activity, protect critical information and identify clean data for recovery.
Outcome-backed resilience and recovery: Hitachi Vantara backs VSP One with a 100% Data Availability Guarantee, while qualifying VSP One Block systems are covered by a Cyber Resilience Guarantee that provides a 100% clean recovery point following a cyberattack. This defense-in-depth approach helps reduce the operational and business impact of disruption.
“Government organizations need confidence that the infrastructure supporting critical missions has been evaluated against recognized security requirements,” said Mark Serway, president and CEO of Hitachi Federal. “Independent certifications such as Common Criteria provide another important source of assurance during technology evaluation, while Hitachi Vantara’s broader cyber resilience capabilities help agencies protect access to critical data and maintain continuity when disruptions occur.”
The VSP One Block certification, JISEC-C0870, was granted June 19, 2026, under Common Criteria Version 3.1 Release 5 and the collaborative Protection Profile for Network Devices Version 3.0e. The certification applies to VSP One B20 and is valid through June 19, 2031.
