AWS Customer Compliance Guides now publicly available

The AWS Global Security & Compliance Acceleration (GSCA) Program has released AWS Customer Compliance Guides (CCGs) on the AWS Compliance Resources page to help customers, AWS Partners, and assessors quickly understand how industry-leading compliance frameworks map to AWS service documentation and security best practices.

CCGs offer security guidance mapped to 16 different compliance frameworks for more than 130 AWS services and integrations. Customers can select from the frameworks and services available to see how security “in the cloud” applies to AWS services through the lens of compliance.

CCGs focus on security topics and technical controls that relate to AWS service configuration options. The guides don’t cover security topics or controls that are consistent across AWS services or those specific to customer organizations, such as policies or governance. As a result, the guides are shorter and are focused on the unique security and compliance considerations for each AWS service.

We value your feedback on the guides. Take our CCG survey to tell us about your experience, request new services or frameworks, or suggest improvements.

CCGs provide summaries of the user guides for AWS services and map configuration guidance to security control requirements from the following frameworks:

• National Institute of Standards and Technology (NIST) 800-53
• NIST Cybersecurity Framework (CSF)
• NIST 800-171
• System and Organization Controls (SOC) II
• Center for Internet Security (CIS) Critical Controls v8.0
• ISO 27001
• NERC Critical Infrastructure Protection (CIP)
• Payment Card Industry Data Security Standard (PCI-DSS) v4.0
• Department of Defense Cybersecurity Maturity Model Certification (CMMC)
• HIPAA
• Canadian Centre for Cyber Security (CCCS)
• New York’s Department of Financial Services (NYDFS)
• Federal Financial Institutions Examination Council (FFIEC)
• Cloud Controls Matrix (CCM) v4
• Information Security Manual (ISM) (Australia)
• Information System Security Management and Assessment Program (ISMAP) (Japan)

CCGs can help customers in the following ways:

• Shorten the process of manually searching the AWS user guides to understand security “in the cloud” details and align configuration guidance to compliance requirements
• Determine the scope of controls applicable in risk assessments or audits based on which AWS services are running in customer workloads
• Assist customers who perform due diligence assessments on new AWS services under consideration for use in their organization
• Provide assessors or risk teams with resources to identify which security areas are handled by AWS services and which are the customer’s responsibility to implement, which might influence the scope of evidence required for assessments or internal security checks
• Provide a basis for developing security documentation such as control responses or procedures that might be required to meet various compliance documentation requirements or fulfill assessment evidence requests

The AWS Global Security & Compliance Acceleration (GSCA) Program connects customers with AWS partners that can help them navigate, automate, and accelerate building compliant workloads on AWS by helping to reduce time and cost. GSCA supports businesses globally that need to meet security, privacy, and compliance requirements for healthcare, privacy, national security, and financial sectors. To connect with a GSCA compliance specialist, complete the GSCA Program questionnaire.

 
If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.