Compliance
Compliance & GovernanceCompliance in cloud security means meeting the requirements defined by regulatory bodies, industry standards, and internal policies. AWS provides the infrastructure compliance (SOC reports, ISO certifications), but customers must implement compliant configurations.
Common Frameworks
- SOC 2 Type II: trust service criteria for security, availability, processing integrity
- HIPAA: health information protection (requires BAA with AWS)
- GDPR: EU data protection and privacy
- PCI DSS v4.0: payment card data security
- CIS AWS Foundations Benchmark: prescriptive security configuration checklist (v6.0 is latest)
- ISO 27001: information security management system
AWS Compliance Tools
- AWS Config: continuous configuration compliance monitoring
- Security Hub: automated compliance scoring against CIS, FSBP, PCI DSS
- AWS Audit Manager: automated evidence collection for audits
- AWS Artifact: access AWS compliance reports and agreements
Related AWS Services
Related Terms
A prescriptive security configuration checklist from the Center for Internet Security that defines best practices for securing AWS accounts.
The framework defining that AWS is responsible for security of the cloud (infrastructure), while customers are responsible for security in the cloud (data, access, configuration).
A preventive or detective control that enforces security boundaries across AWS accounts, implemented through SCPs, AWS Config rules, or Security Hub standards.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.