Rockwell Automation TOMs

Last Updated: March 2026
Applies to: All Rockwell Automation entities, employees, contractors, systems, and third parties processing PII on behalf of Rockwell Automation.

1. Purpose and Scope

These Technical and Organizational Measures (TOMs) describe the administrative, technical, and physical safeguards implemented by Rockwell Automation to protect PII against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, in accordance with:

• GDPR Article 32
• ISO/IEC 27001 and 27002
• NIST Cybersecurity Framework
• Applicable contractual and regulatory requirements

These TOMs apply to the entire lifecycle of PII, including collection, access, processing, storage, transmission, retention, and secure disposal—across IT, OT, cloud, AI-enabled, and third‑party environments.

Rockwell Automation implements, operates, and regularly maintains appropriate technical and organizational measures (TOMS) aligned to industry standards to protect Customer PII. Customer acknowledges and agrees that Rockwell Automation reserves the right to modify these TOMS provided that the functionality and security are not materially degraded. Without limiting the generality of the foregoing, Rockwell Automation will at a minimum maintain its TOMS as set forth below.

2. Information Security Governance and Accountability2.1 Governance Framework

Rockwell Automation maintains an enterprise-wide Information Security Management System (ISMS) governed through formal policies, standards, and procedures aligned with internationally recognized frameworks. Oversight is provided by senior leadership, including a designated Chief Information Security Officer (CISO).

Governance includes:

• Enterprise security policies approved by executive leadership
• Risk ownership and accountability assigned at system, data, and business levels
• Formal exception and risk acceptance processes
• Periodic management review of security posture and risk

2.2 Roles and Responsibilities

• Data Owners: Accountable for classification, lawful use, and protection of PII
• System Owners: Responsible for secure system configuration and operation
• Global Cybersecurity Organization: Defines security standards, monitoring, and assurance
• Employees and Contractors: Required to comply with policies and complete mandatory
  training

3. Data Classification and PII Handling

Rockwell Automation classifies all data, including PII, based on sensitivity and risk. PII is treated as Confidential or Highly Confidential (Restricted) depending on impact.

Controls include:

• Mandatory data classification and labeling
• Defined handling requirements per classification
• Restrictions on storage, transmission, and sharing
• Prohibition on unauthorized personal or public AI tool use with PII

PII handling requirements are embedded across operational processes and enforced through preventive and detective controls.

4. Access Control and Identity Management

4.1 Identity and Access Management (IAM)

Access to systems processing PII is controlled using least privilege and need-to-know principles.

Key measures:

• Unique individual user accounts (no shared identities unless approved)
• Centralized identity lifecycle management
• Role-based access controls
• Formal access request, approval, and review processes
• Immediate access revocation upon role change or termination

4.2 Strong Authentication

• Multi-factor authentication (MFA) enforced for:
  • Remote access
  • Privileged access
  • Cloud and administrative interfaces
• Strong password policies enforced via technical controls

5. Technical Security Measures5.1 Encryption and Cryptographic Protections

PII is protected using encryption:

• At rest: Full-disk and database encryption
• In transit: Industry-standard TLS encryption
• Cryptographic key management: Centralized and controlled

Encryption requirements align with data classification standards and regulatory expectations.

5.2 Endpoint and System Security

• Managed endpoints with standard security baselines
• Anti-malware and endpoint detection controls
• System hardening per defined configuration standards
• Patch and vulnerability management with regular scanning and remediation

5.3 Network Security

• Defense-in-depth architecture
• Network segmentation and firewall protections
• Secure remote access with logging and MFA
• Intrusion detection and prevention systems (IDS/IPS)

6. Logging, Monitoring, and DetectionRockwell Automation employs continuous monitoring to detect unauthorized access or anomalous activity involving PII.

Measures include:

• Centralized Security Information and Event Management (SIEM)
• Logging of:
  • Access to PII
  • Administrative activities
  • Authentication events
• 24x7 security operations monitoring
• Alerting and investigation of suspicious events

Audit logs are protected from unauthorized alteration and retained according to defined schedules.

7. Incident Management and Breach ResponseRockwell Automation maintains a formal Incident Response Program covering:

• Incident identification and classification
• Investigation and containment procedures
• Forensic evidence preservation
• Regulatory and customer notification where required
• Root cause analysis and corrective actions

Incidents involving PII are escalated, documented, and handled according to contractual and legal obligations, including GDPR breach notification timelines.

8. Business Continuity and Availability

To ensure ongoing availability and resilience of systems processing PII, Rockwell Automation implements:

Business Impact Analysis (BIA)

Documented Business Continuity Plans (BCP)

• Disaster Recovery (DR) strategies with defined RTOs/RPOs
• Regular testing of recovery capabilities
• Backup, redundancy, and failover mechanisms

9. Physical and Environmental Security by Rockwell or Hosting Provider

• Facilities and physical assets processing PII are protected through:
• Controlled physical access (badges, biometrics where applicable)
• Surveillance and monitoring (e.g., CCTV)
• Environmental controls (fire suppression, power redundancy)
• Secure storage and disposal of physical media

Visitor access is managed and logged.

10. Asset and Lifecycle Management

• All systems processing PII are inventoried
• Ownership and responsibility are documented
• Secure configuration and baseline enforcement
• Controlled system changes through formal Change Management
• Secure sanitization and disposal of equipment and media

For Operational Technology (OT), enhanced lifecycle and disposal controls apply.

11. Third-Party and Subprocessor Management

Rockwell Automation requires all third parties handling PII to meet defined security and privacy expectations.

Controls include:

• Pre-engagement risk assessments
• Contractual security and data protection clauses
• Ongoing monitoring of critical vendors
• Defined incident notification obligations
• Secure exit and data return or destruction procedures

12. Secure Software Development and Change Management

• Secure SDLC practices for applications processing PII
• Code reviews, testing, and vulnerability assessments
• Formal Change Management with security impact analysis
• Dual authorization and segregation of duties where required

13. AI, Automation, and Emerging Technologies

Use of AI systems involving PII is subject to:

• Prior risk assessment and approval by the AI Governance Council
• Data minimization and purpose limitation
• Human oversight and auditability
• Restrictions on use of public generative AI tools with PII

14. Training, Awareness, and Insider Risk

• Mandatory onboarding and annual security training
• Role-based training for privileged roles
• Phishing simulations and awareness campaigns
• Insider risk controls with legal oversight

15. Assurance, Audits, and Continuous Improvement

• Periodic control assessments and internal audits
• Independent security assessments where required
• Monitoring of regulatory and threat environment changes
• Continuous improvement of controls based on risk and lessons learned

16. Conclusion

These Technical and Organizational Measures demonstrate that Rockwell Automation implements state-of-the-art, risk‑based, and proportionate safeguards to protect PII. The controls described are embedded into governance, operational processes, and technical architectures, providing a defensible and auditable security posture consistent with regulatory and contractual expectations.

Detailed Control Table (Enhanced)

Legend:

✓  = Implemented

◐ = Implemented with conditions / risk-based application