AWS Audit Manager

AWS Audit Manager provides prebuilt frameworks that map your AWS resources to control requirements, which are grouped in accordance to the requirements of an industry standard or regulation, such as CIS AWS Foundations Benchmarks, GDPR, or PCI DSS. You can fully customize these prebuilt frameworks and controls to tailor them to your unique needs.

AWS Audit Manager saves you time by automatically collecting and organizing evidence as defined by each control requirement. Instead of manually collecting evidence, you can focus on reviewing the relevant evidence to ensure your controls are working as intended. For example, you can configure an Audit Manager assessment to automatically collect resource configuration snapshots on a daily, weekly, or monthly basis, subject to underlying AWS service configurations.

You can assign controls in your assessment to a subject matter expert to review. For example, you might delegate a security control to a network security engineer to confirm the evidence properly demonstrates compliance. Audit Manager also allows team members to comment on evidence, upload manual evidence, and update the status of each control.

An audit-ready report includes a report summary file that contains links to the relevant evidence folders, which are named and organized according to the controls that are specified in your assessment. The evidence Audit Manager continuously collects from the AWS services you use becomes a record containing the information needed to demonstrate compliance with control requirements. You can review and select the relevant evidence to include in your final audit report.

AWS Audit Manager securely stores evidence in its own managed storage repository with read-only permissions to your end-users. When you generate audit-ready reports, Audit Manager produces a report file checksum so you can validate that the report evidence remains unaltered. Both the summary report and evidence can be downloaded to share with your auditors.

AWS Audit Manager enables you to move from manually collecting, reviewing, and managing evidence to a solution that automates evidence collection and helps to manage evidence security and integrity.

With AWS Audit Manager, you have an increased level of transparency into usage activity and changes in the environment. You can continuously collect evidence, monitor your compliance posture, and proactively reduce risk by fine-tuning your controls.

You can customize a prebuilt framework or build your own framework from scratch. Then, launch an assessment to automatically collect evidence helping you validate if your internal controls are working as intended.