Splunk Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Splunk

1. 1

   Obtain Splunk's complete subprocessor list directly from their privacy team (privacy@splunk.com or via Cisco's privacy portal) — request an itemized list with entity names, processing countries, and data categories. This is the highest-priority action for GDPR-compliant deployments and should be completed before go-live.

   GDPR Full TextGDPR Subprocessor Rules
2. 2

   Confirm the AI data sharing opt-out is active in your Splunk Enterprise Security settings — navigate to the settings panel and document the current state with a screenshot. Additionally, request written confirmation from your account team clarifying which data categories are covered by the opt-out versus opt-in mechanisms across your contracted product tier.

3. 3

   Request Splunk's current SOC 2 Type II report and bridge letter — Splunk claims SOC 2 compliance on their trust documentation page (docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice). Contact your account team or Splunk's security team and ask for the most recent Type II report; many enterprise customers can access this through the Splunk trust portal or via an NDA.

   SOC 2 Overview (AICPA)
4. 4

   Verify HTTP security header configuration on your specific Splunk application endpoint — run an independent scan at securityheaders.com against your tenant URL (e.g., your-instance.splunkcloud.com) to confirm HSTS, CSP, and clickjacking protections are active in the production environment. Document results for your vendor risk register.

   NIST Supply Chain Risk (SP 800-161)
5. 5

   Monitor Splunk's FedRAMP authorization progress via the FedRAMP Marketplace (marketplace.fedramp.gov/products/FR2314156865) — the Splunk Cloud Platform for FedRAMP High is currently In Process at the High impact level. If your organization operates under FedRAMP requirements, set a calendar reminder to check authorization status quarterly until full authorization is granted.

   FedRAMP Marketplace
6. 6

   Request ISO 27001 and HITRUST certification documentation directly from Splunk's compliance team — independent registry verification was inconclusive during this assessment. Ask for current certificate numbers, issuing bodies, and validity dates, then cross-reference against the IAF CertSearch database (iafcertsearch.org) to independently validate any certificates provided.

   ISO 27001 Standard

• Certificate Transparency log data (Certificate Transparency service) was unavailable during this assessment; certificate metadata was sourced from a direct TLS handshake, which does not provide subdomain enumeration or full issuance history.
• External cyber risk scoring data was not available for this assessment; infrastructure risk assessment relied on direct scanning and publicly available threat intelligence sources.
• The HTTP security scanner scan was performed against the public marketing domain (splunk.com); the production application endpoint and tenant environments were not independently scanned and may have materially different security header configurations.
• Splunk's subprocessor page returned no parseable entries at the time of assessment; it is possible the page was temporarily incomplete or undergoing updates, and manual verification with the vendor is required.
• ISO 27001 certification status was not found in the IAF CertSearch registry during this assessment; this does not confirm absence of certification, as the registry has coverage limitations and some certifications may not be indexed.
• HITRUST certification status could not be independently verified due to rendering limitations in the HITRUST directory at the time of assessment.
• AI data retention periods for Splunk's AI features are not publicly specified in the reviewed policy documentation, limiting the completeness of the AI data handling assessment.