AWS Security Blog
2023 PiTuKri ISAE 3000 Type II attestation report available with 171 services in scope
Amazon Web Services (AWS) is pleased to announce the issuance of the Criteria to Assess the Information Security of Cloud Services (PiTuKri) International Standard on Assurance Engagements (ISAE) 3000 Type II attestation report. The scope of the report covers a total of 171 services and 29 global AWS Regions.
The Finnish Transport and Communications Agency (Traficom) Cyber Security Centre published PiTuKri, which consists of 52 criteria that provide guidance when assessing the security of cloud service providers. The criteria are organized into the following 11 subdivisions:
- Framework conditions
- Security management
- Personnel security
- Physical security
- Communications security
- Identity and access management
- Information system security
- Encryption
- Operations security
- Transferability and compatibility
- Change management and system development
The report includes 17 additional services in scope, for a total of 171 services. See the full list on our Services in Scope by Compliance Program page.
The following are the 17 additional services now in scope for the 2023 Pitukri report:
- AWS AppFabric
- AWS Artifact
- Amazon Bedrock
- Amazon Braket
- Amazon Chime SDK
- AWS Clean Rooms
- AWS Fault Injection Service (formerly AWS Fault Injection Simulator)
- AWS HealthImaging
- AWS HealthOmics
- Amazon Inspector
- AWS IoT Device Defender
- AWS IoT TwinMaker
- Amazon Managed Grafana
- Amazon Managed Workflows for Apache Airflow
- AWS Resilience Hub
- AWS User Notifications
- AWS Wickr
Five additional AWS Regions have been added to the scope, for a total of 29 Regions. The following are the five additional Regions now in scope:
- Australia: Asia Pacific (Melbourne) (ap-southeast-4)
- India: Asia Pacific (Hyderabad) (ap-south-2)
- Spain: Europe (Spain) (eu-south-2)
- Switzerland: Europe (Zurich) (eu-central-2)
- United Arab Emirates: Middle East (UAE) (me-central-1)
The latest report covers the period from October 1, 2022, to September 30, 2023. An independent third-party audit firm issued the report to assure customers that the AWS control environment is appropriately designed and implemented for support of adherence with PiTuKri requirements. This attestation demonstrates the AWS commitment to meet security expectations for cloud service providers set by Traficom.
Customers can find the full PiTuKri ISAE 3000 report on AWS Artifact. To learn more about the complete list of certified services and Regions, see AWS Compliance Programs and AWS Services in Scope for PiTuKri.
AWS strives to continuously bring new services into the scope of its compliance programs to help you meet your architectural and regulatory needs. Contact your AWS account team for questions about the PiTuKri report.
If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.
Want more AWS Security news? Follow us on Twitter.