by Kristen Haught, Customer Outreach Manager, AWS Security is the top priority at AWS, and whether you are a startup or an enterprise-level company, our compliance programs can help you demonstrate the effectiveness of this security to your customers. In this session, you will learn how to build your own compliance programs on AWS and how to show your customers evidence of this compliance. Bring both your business and technical hats as we dive into a cross-functional strategy that will accelerate your path to compliance on AWS and your business growth in regulated markets.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
Achieving Compliance and
Selling to Regulated Markets on AWS
Kristen Haught
AWS Security Assurance

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Responsible for security and
compliance
‘of’ the cloud
Shared Responsibility Stakeholders
Responsible for security and
compliance
‘in’ the cloud
Cloud-based
solution
Cloud
Services
Provider
Regulated
Entity

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Demonstrating Compliance to Stakeholders
Cloud-based
solution
Cloud Services
Provider
End user /
Regulated
Entity
Auditor
Regulator

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Stakeholder objectives
Cloud-based
solution
End user /
Regulated
Entity
• Use AWS services to build a secure and compliant
solution
• Quickly demonstrate security and compliance to
prospective customers
• Prepare for and “pass” an audit on AWS
• Assess AWS AND cloud-based solutions against their
supplier requirements
• Develop a cloud governance model that meets
regulator requirements

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Prepare for and pass an audit on AWS
Evidence of intent: Design documentation or process diagram that details approach
Records of action: The audit trail of records detailing what actions were taken
Key considerations:
• Document application-centric design information
• Develop repeatable, auditable controls
• Implement with AWS security best practices
• Enforce and Monitor with defined or custom Config Rules
https://aws.amazon.com/whitepapers/aws-security-best-practices/

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Develop a cloud governance model
Common Global Regulatory Principles:
• Cloud Governance: Have appropriate oversight for
cloud services
• Data Security and Privacy: Design for Data Security
& Privacy
• Disaster Recovery/Business Continuity: Focus on
Application Resiliency
• Incident Response: Understand Incident
Management & Response
• Global Financial
Services Regulatory
Principles Whitepaper In
AWS Artifact

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Use AWS services to build secure and
compliant solutions… at scale
Document as you design and develop:
• Access controls: Promote least privilege – for operations, access to customer data, and
customer use
• Logging: Document what is being captured in the logs, where the logs are being stored,
access rights, log scanning/alarming, and retention.
• Data Protection: Identify and document all locations where customer data is at rest and the
use of encryption. Document data flows and where encryption is being utilized while data is
in transit.
• Backup and Recovery: Document how data is backed up to a secure durable location and
demonstrate that the backed up data is retrievable to restore into the operational
environment and resume the service.

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Use AWS services to build secure and
compliant solutions… at scale
Document as you design and develop:
• Customer data: Document where the service stores customer data including customer
content and service attributes, the retention period on storage, how and by whom the data
is being accessed, and the contents of the data.
• Third-Party Software: Document third-party software including access control and access to
or storage of customer data .
• Subcontractor/3rd Party Access: Prevent any vendor, subcontractor, or intern access to
customer content and service attributes along with reviewing the controls in place to
manage that access.

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Use AWS services to build secure and
compliant solutions… at scale
Repeatable,
auditable
processes!

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Use AWS services to build secure and
compliant solutions… at scale
Repeatable,
auditable
processes!

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Use AWS services to build secure and
compliant solutions… at scale
https://www.youtube.com/watch?v=goX61THbKuA

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Quickly demonstrate security and
compliance to your prospective customers
http://www.argomi.com/compliance
Think about your buyer’s regulatory requirements!

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Executive Briefing in FedRAMP Partner Package of Artifact
Quickly demonstrate security and
compliance to your prospective customers

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Artifact:
ü Document that you have assessed AWS
ü Point your customer to use Artifact for free
ü Audit reports against many global and regional
security standards are available
Point your customers to AWS Artifact to
assess security of the cloud

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Security Starts
• on Day One
• Compliance Loves
• Automation
• Regulated Industries
Run in the Cloud
Remember

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
aws.amazon.com/activate
Other resources

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Risk Management: AWS Artifact
• Global Financial
Services Regulatory
Principles Whitepaper
• PCI DSS Attestation of
Compliance and
Responsibility
Summary
• Regulatory workbooks
– for example:
Australian Prudential
Regulation Authority
(APRA) “Management
of Security Risk in IT”
CPG 234 Workbook
https://aws.amazon.com/artifact/
APRA

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tech: AWS Quickstarts
• NIST Quickstart • PCI DSS Quickstart
• Data Lake Foundation
on AWS Quickstart
https://aws.amazon.com/quickstart/
Amazon
S3
Amazon
Redshift
Amazon
Athena

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Business: AWS Cloud Adoption Framework
https://aws.amazon.com/professional-services/CAF/