SemiAnalysis

Security

Data protection, compliance, and infrastructure security measures including encryption, access controls, and audit capabilities.

Critical Failure

No SOC 2, ISO 27001 or any other bare minimum security attestations means you are unable to serve the primary market that your business is designed to serve.

Key Requirements

  • ✓SOC 1 or SOC 2 Type II compliance
  • ✓ISO 27001 certification
  • ✓GDPR, PCI, HIPAA, FedRAMP compliance
  • ✓Ability to sell to secure government customers globally
  • ✓Penetration testing conducted (provider, scope, and coverage documented)
  • ✓SOC 2 & pentesting specifically cover InfiniBand/RoCEv2 fabric
  • ✓Security firms with expertise in high-speed IB/ETH networking
  • ✓VLAN isolation between tenants for RoCE
  • ✓PKeys set for InfiniBand tenants
  • ✓InfiniBand Security Keys Management (SMKey, SAKey, CKey, VSKey)
  • ✓AM Key configuration (if SHARP is available)
  • ✓InfiniBand CSPs enable the UFM "Secured Bare Metal Cloud" profile, providing a comprehensive set of security features required for secure multi-tenant cloud environments
    • •Full MAD key protection with randomized seeds: MKEY, VSKEY, PMKEY, CCKEY, Class C key (N2N), AM and job keys, SMKEY, and SAKEY
    • •GUID-based access control using the allowed_guid_list feature
    • •Service-level authentication via service_key (e.g., for AM services)
    • •Enhanced SA trust model applied to all commands
    • •MAD rate limiting (MAD Limiter) to protect against abuse and congestion
    • •DoS/DDoS protection: automatically identifies and limits excessive packet rates from individual nodes to protect the management node
    • •Source-based rate limiting: monitors and controls traffic based on the source LID address of each node
  • ✓SR-IOV with QP0 & MAD disabled when passing Virtual Function pointer into VM
  • ✓Strong isolation between tenants. Not namespaces, or container-only isolation, i.e. no reliance on vClusterKubernetes
  • ✓Protection against container escalation vulnerabilities
  • ✓Updated NVIDIA Container Toolkit preventing CVE-2024-0132 and related vulnerabilities
  • ✓Protection against CVE-2025-23359, CVE-2025-23266
  • ✓Part of NVIDIA security program for embargoed access to latest security patches
  • ✓Automated rollout of new NVIDIA Container Toolkit versions upon CVE discovery
  • ✓Process in place for future security improvements

All evaluation criteria