c2.1 Identify security and regulatory requirements
Identify the regulations your organization must comply with and understand what each one expects in terms of security controls, before you design the controls to satisfy them.
Implementation guidance
Know what you must comply with
List the laws, industry regulations, and contractual obligations that apply to your organization (by country, industry, and the type of data you handle), and translate each into the specific security controls it expects. Assign a team or owner responsible for compliance analysis and audits.
Security of the cloud vs. in the cloud
AWS compliance certifications cover the security of the cloud. Your workloads still need their own certification for the security you operate in the cloud. Auditors can rely on the audit reports and certifications in AWS Artifact to verify the controls AWS is responsible for, so you can focus your evidence on your side of the shared responsibility model.
Find requirements by country and industry
The AWS Compliance Center lets you look up regulatory considerations per country, and the AWS Compliance Programs page lists the certifications and attestations AWS holds (SOC, ISO, PCI DSS, FedRAMP, and more).
Related
See Produce compliance reports for turning these requirements into evidence.
How to validate
- Have you identified the security frameworks your organization aligns to?
- Have you identified the regulatory and contractual requirements that apply to you?
- Is there a team or owner responsible for compliance analysis and audits?
Threats addressed
- Without a clear understanding of the requirements, a compliance gap can lead to regulatory fines, revoked licenses, or loss of authorization to operate.
AWS services
AWS Artifact