Resources
Curated links to the official AWS and industry guidance this model is built on, plus answers to common security and compliance questions.
See how each AWS CAF and Well-Architected security item maps to the controls in this model.
Security frameworks
Design principles and best practices for securing workloads on AWS.
docs.aws.amazon.com ↗The 10 security capabilities that organize this model's domains.
docs.aws.amazon.com ↗Target-state design for deploying security services across a multi-account environment.
docs.aws.amazon.com ↗How AWS aligns with and supports the NIST CSF.
aws.amazon.com ↗Prescriptive configuration baselines for securing an AWS account.
www.cisecurity.org ↗AWS security documentation
Security documentation organized by category and service.
docs.aws.amazon.com ↗Reference architectures and best practices for security, identity, and compliance.
aws.amazon.com ↗The catalog of AWS services for protecting workloads, many with a free tier.
aws.amazon.com ↗On-demand access to AWS compliance reports (SOC 2, ISO) and agreements.
aws.amazon.com ↗AWS security whitepapers
How AWS secures its infrastructure and the shared responsibility boundary.
d1.awsstatic.com ↗AWS certifications, programs, and how to approach risk and compliance in the cloud.
docs.aws.amazon.com ↗How AWS achieves tenant isolation without relying on physical separation.
d1.awsstatic.com ↗Prepare for, respond to, and recover from security incidents on AWS.
docs.aws.amazon.com ↗Frequently asked questions
How do I complete a vendor / due-diligence security questionnaire for AWS?
Start with AWS Artifact for on-demand compliance reports — the SOC 2 report gives a complete view of AWS control implementation and effectiveness. The CSA CAIQ captures AWS's answers to the questions a cloud consumer or auditor typically asks, and the AWS Risk and Compliance guide covers certifications and attestations.
Which AWS services meet common security and compliance standards?
AWS Services in Scope lists the services evaluated against each compliance program. Unless noted as excluded, a listed service is reviewed and tested as part of that program's assessment.
Can I meet my regulatory requirements on AWS?
AWS serves customers worldwide and adapts to evolving regulations. The AWS Compliance Center lets you look up cloud-related regulatory requirements by country and see how they affect your industry.
Does AWS use sub-processors that can access my data?
No sub-processor is authorized to access customer content you upload to AWS. AWS publishes the sub-processor list (with optional change notifications) and a third-party access page so you can monitor this throughout the year.
Can you share AWS data center locations for my BC/DR plans?
Data center locations are confidential to protect customer data. You can still assess physical resilience through the AWS Data Center Controls page and the SOC 2 report in AWS Artifact.
What should I evaluate for disaster recovery on AWS?
Define your resilience objectives and any regulatory requirements first, then design to meet them — for example, using physically separate Availability Zones and Regions for critical workloads. See the AWS Data Center Controls page and the SOC 2 report in AWS Artifact.
About framework references and attribution
This model maps AWS security controls to several frameworks to help you locate the corresponding control. The frameworks referenced are the property of their respective owners; this is an independent AWS educational resource and is not affiliated with, endorsed by, or approved by those organizations.
The AWS Cloud Adoption Framework (Security Perspective) and the AWS Well-Architected Framework are published by AWS. The NIST Cybersecurity Framework is a publication of the U.S. National Institute of Standards and Technology (NIST); NIST publications are not subject to copyright in the United States, and the source is credited here with thanks.
Framework references are provided for navigation and mapping only; this model summarizes and maps to them and is not a substitute for the source documents. Always refer to each framework's official publication as the authoritative source.