Kaspersky has completed another SOC 2 Type II audit, with an independent auditor assessing the company’s controls around antivirus database development, testing, and release for Windows and Unix operating systems.
The audit covered the period from August 2025 to July 2026 and examined both the design and operating effectiveness of Kaspersky’s security controls throughout the database development lifecycle.
Independent audit examines Kaspersky’s security controls
SOC 2 is a framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates organizational controls against five Trust Service Criteria: security, availability, processing integrity, confidentiality, and privacy.
Kaspersky said it has undergone SOC 2 audits regularly since 2019. The latest assessment was conducted by an independent auditor and focused specifically on the processes used to develop, test, and release its antivirus databases.
The review included interviews with management and technical teams, observations of operational procedures, analysis of policies, workflows, and control evidence, and re-performance of manual controls to verify that they were applied consistently.
According to Kaspersky, the auditors concluded that its antivirus database development, testing, and release processes continued to meet SOC 2 requirements, including controls designed to protect those processes against tampering.
Audit covers Windows and Unix database development
The latest assessment focused on the lifecycle of antivirus database development for both Windows and Unix operating systems.
This covers the processes involved in developing, testing, and releasing the databases used by Kaspersky’s security technologies. The company said the audit provides independent verification of how these controls operate over the assessment period.
Kaspersky said a full copy of the audit report is available upon request.
“For Kaspersky customers and partners, the successful SOC 2 audit completion is more than procedural milestone, it is independent confirmation that the security controls underpinning our technologies remain consistently effective,” said Yuliya Shlychkova, Vice President of Global Public Affairs at Kaspersky.
Part of Kaspersky’s broader transparency program
Kaspersky positioned the latest SOC 2 assessment as part of its Global Transparency Initiative, through which the company says customers and partners can independently assess aspects of its security practices.
The company also cited its ISO/IEC 27001 certification and Common Criteria certifications for enterprise products as other components of its broader security and assurance efforts.
The latest SOC 2 Type II audit does not represent a one-time assessment of Kaspersky’s security controls. Instead, it provides an independent examination of how the specified controls were designed and operated during the August 2025–July 2026 review period.
