This document discusses cloud control frameworks and compliance on AWS. It provides an overview of AWS compliance programs and certifications across different regions and standards. It emphasizes that security and compliance are shared responsibilities between AWS and customers. Customers can use AWS services to implement controls that meet their objectives and address risks. The document provides examples of how to structure enterprise-wide, service-specific, and workload-specific controls on AWS. It recommends taking a risk-based approach and focusing on controls needed to achieve strategic objectives. Customers can use industry standard frameworks that AWS already supports as a starting point.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud control fitness
Brian Wagner
Head of FSI Compliance, EMEA
AWS
G R C 2 0 2
Kristen Haught
FSI Compliance Specialist, Americas
AWS

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security and compliance are shared responsibilities

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The AWS control plane is ubiquitous
21 Regions
66 Availability zones
158 Edge locations

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Compliance with global standards
Certifications & Attestations Laws, Regulations, and Privacy Alignments & Frameworks
Cloud Computing Compliance Controls Catalogue (C5) DE ✓ CISPE EU ✓ CIS (Center for Internet Security)
🌐
✓
Cyber Essentials Plus GB ✓ EU Model Clauses EU ✓ CJIS (US FBI) US ✓
DoD SRG US ✓ FERPA US ✓ CSA (Cloud Security Alliance)
🌐
✓
FedRAMP US ✓ GLBA US ✓ Esquema Nacional de Seguridad ES ✓
FIPS US ✓ HIPAA US ✓ EU–US Privacy Shield EU ✓
IRAP AU ✓ HITECH 🌐 ✓ FISC JP ✓
ISO 9001 🌐 ✓ IRS 1075 US ✓ FISMA US ✓
ISO 27001 🌐 ✓ ITAR US ✓ G-Cloud GB ✓
ISO 27017 🌐 ✓ My Number Act JP ✓ GxP (US FDA CFR 21 Part 11) US ✓
ISO 27018 🌐 ✓ Data Protection Act – 1988 GB ✓ ICREA 🌐 ✓
MLPS Level 3 CN ✓ VPAT/Section 508 US ✓ IT-Grundschutz DE ✓
MTCS SG ✓ Data Protection Directive EU ✓ MITA 3.0 (US Medicaid) US ✓
PCI DSS Level 1 💳 ✓ Privacy Act (Australia) AU ✓ MPAA US ✓
SEC Rule 17-a-4(f) US ✓ Privacy Act (New Zealand) NA ✓ NIST US ✓
SOC 1, SOC 2, SOC 3 🌐 ✓ PDPA – 2010 (Malaysia) MY ✓ Uptime Institute Tiers
🌐
✓
PDPA – 2012 (Singapore) SG ✓ Cloud Security Principles GB ✓
🌐 = industry or global standard PIPEDA (Canada) CA ✓
Agencia Española de Protección de Datos ES ✓

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit and certification programs: Global
CSA
Cloud Security
Alliance controls
Annual
ISO 9001
Global quality
standard
Annual
ISO 27001
Security management
controls
Annual
ISO 27017
Cloud-specific
controls
Annual
ISO 27018
Personal data
protection
Annual
PCI DSS Level 1
Payment card standards
Annual
SOC 1
Audit controls
report
Biannual
SOC 2
Security, availability, &
confidentiality report
Biannual
SOC 3
General controls
report
Annual

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit and certification programs: Europe
C5 (Germany)
Operational
security
attestation
Cyber Essentials
Plus (UK)
Cyber threat
protection
ENS High (Spain)
Spanish government
standards
G-Cloud
(UK)
UK government
standards
IT-Grundschutz
(Germany)
Baseline protection
methodology
TISAX
Automotive
industry standard

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit and certification programs: United States
CJIS
Criminal Justice Information
Services
DoD SRG
DoD Data Processing
FedRAMP
GovernmentData Standards
FERPA
Educational Privacy Act
FFIEC
Financial Institutions
Regulation
FIPS
GovernmentSecurity
Standards
FISMA
Federal Information Security
Management
GxP
Quality Guidelines and
Regulations
HIPAA
Protected Health
Information
ITAR
International Arms
Regulations
MPAA
Protected Media Content
NIST
National Institute of
Standards and Technology
SEC Rule 17a-4(f)
Financial Data Standards
VPAT / Section 508
Accessibility Standards

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit and certification programs: Asia Pacific
FISC
(Japan)
Financial industry
information systems
IRAP
(Australia)
Australian security
standards
K-ISMS
(Korea)
Korean information security
MTCS Tier 3
(Singapore)
Multi-tier cloud
security standard
My Number Act
(Japan)
Personal information
protection

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Compliance is a shared responsibility
Your cloud control framework
# Domain Objective Implementation
1
2
3
4
5
6

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
ISO
11
12
13
14
15
16
Use AWS services to create your own controls
PCI
# Req Summary
99.52 ✓
✓
99.53
✓
99.54 ✓
✓
✓
99.55
✓
99.56 ✓
✓
✓
✓
SOC
Control Criteria Test Result
CTRL5 CC1;
CC2
CTRL6 CC3;
CC4
CTRL7 CC5;
CC6;
CC7;
CC8;
CC9
CTRL8 CC6;
CC7
CTRL9 CC5;
CC6;
CC11
Your cloud control framework
# Domain Objective Implementation
1
2
3
4
5
6
def lambda_handler(event`, context):
global AWS_CONFIG_CLIENT
AWS_CONFIG_CLIENT = get_client(‘config', event)
check_defined(event, ‘event’)
invoking_event = json.loads(event[‘invokingEvent’])
rule_parameters = {}
if ‘ruleParameters' in event:
rule_parameters = json.loads(event[‘ruleParameters’])

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control-risk relationship
Strategic
objective n
Risk n
Control
objective n
Control nControl 5Control 4Control 3Control 2Control 1
Control
objective n
Control
objective 3
Control
objective 2
Control
objective 1
Risk 3Risk 2Risk 1
Strategic
objective 3
Strategic
objective 2
Strategic
objective 1
Declarative statement
of intent
Explicit identification of
risk
Outcome-specific
AWS controls
Customer controls

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is a “good” control?
Controls should
Mitigate a specific risk
Have clear acceptance criteria
Controls should not
Define implementation
Control
Is it
testable?
Is the
result
binary?
End
Refactor
Split into
multiple
controls
Yes No
No
Does the
risk still
apply?
DiscardNo
Yes
Yes

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control lineage: Example
New applications with PII in scope will be designed for the
cloud
Unauthorized access to data
Data at rest will be encrypted with an AES-256 key
Strategic
objective n
Risk n
Control
objective n
Control n
Declarative statement
of intent
Explicit identification of
risk
Outcome-specific
AWS controls
Customer controls
AWS services that integrate with AWS KMS for key management use a 256-bit
data key locally to protect customer content.
Amazon EBS volumes will use AWS KMS to encrypt with an approved CMK.

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon EBS volumes will use AWS KMS to encrypt with
an approved CMK
def test_Scenario_12_volumeEncryptedNotWithProperKMSNoSubnetExceptionNoVolumeException(se
ec2_mock.describe_instances = MagicMock(return_value={"Reservations":[{"Instances":[{"S
rule_parameters = {
"VolumeExceptionList": "vol-0003",
"SubnetExceptionList": "subnet-01",
"KmsIdList": "115ff9cc-9beb-4517-bec8-45cabmfrbee6f”
}
configuration = constructConfiguration(
// Truncated. Code can be found at https://github.com/awslabs/aws-config-rules/
resp_expected.append(build_expected_response(
'NON_COMPLIANT’,
'vol-02’,
annotation='This EBS volume is encrypted, but not with a KMS Key listed in the param
assert_successful_evaluation(self, response, resp_expected)
EBSVolume:
Type: AWS::EC2::Volume
DeletionPolicy: Snapshot
Properties:
AutoEnableIO: true
AvailabilityZone: eu-west-1a
Encrypted: true
KmsKeyId: !Ref KmsKeyId
Size: !Ref SizeInGB

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control–risk relationship: Example
Strategic
Objective n
Risk n
Control
Objective n
Control n
• Declarative statement
of intent
• Explicit identification of
risk
• Outcome specific
• AWS controls
• Customer controls
Detect
anomalous
activity
Tampering of
data
Capital analysis stress
testing using
company data
Logging
enabled
Role-based
policies
Prevent
changes to
IAM policies
AWSCA 2.1 –
2.4 in SOC
Employ least
privilege
Segregation of
duties
Unauthorized
changes to
source code
Market risk analysis
using public data
sets
Data is
encrypted end
to end
Unauthorized
access to PII
Credit risk analysis
using customer data
Data is
encrypted at
rest

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of controls to create using AWS
ISO
11
12
13
14
15
16
PCI
# Req Summary
99.52 ✓
✓
99.53
✓
99.54 ✓
✓
✓
99.55
✓
99.56 ✓
✓
✓
✓
SOC
Control Criteria Test Result
CTRL5 CC1;
CC2
CTRL6 CC3;
CC4
CTRL7 CC5;
CC6;
CC7;
CC8;
CC9
CTRL8 CC6;
CC7
CTRL9 CC5;
CC6;
CC11
Your Cloud Control Framework
# Domain Objective Implementatio
n
1
2
3
4
5
6
Enterprise-wide controls
Service-specific controls
Workload-specific
controls
Controls Library

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workload-specific controls
Whenanewstrategicobjectiveisidentified,assesstheriskandidentifythepropercontrolstosecuretheworkload.
All production accounts:
Enable Amazon GuardDuty for
intelligent threat detection and
continuous monitoring of your
AWS accounts and resources.
Log archive account:
Enable S3 Object Lock for Write
Once, Read Many (WORM) data
storage.
Public website:
Exception to allow
public S3 bucket.

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Service-specific controls
Addasteptoyourserviceadoptionframeworktoidentifythecontrolsneededtousetheservicesecurely.
https://docs.aws.amazon.com/AmazonS3/latest/dev/security.html

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enterprise-wide controls
Establishbaselinecontrolsthatshouldbeimplementedacrossyourorganizationregardlessofworkloadandservice.
Logging activity:
Enable AWS CloudTrail and
send all the AWS service
API calls to an Amazon S3
bucket in the log archive
account.
Logging configuration
changes:
Enable AWS Config and
forward the configurations of
AWS resources to the log
archive S3 bucket.
Detect unauthorized access
attempts:
Configure Amazon
CloudWatch alarms and
events to send a notification
of API authentication
failures within an account.

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS benchmarks are technical industry best
practices. This removes guesswork for security
professionals about how to implement
foundational security measures in your AWS
account. The prescribed best practices make
implementation of core AWS security measures
straightforward for security teams and AWS
account owners.
Industry best practices for securing AWS resources:
https://aws.amazon.com/blogs/security/announcing-industry-best-practices-for-
securing-aws-resources/
CIS foundations benchmark:
https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benc
hmark.pdf
CSA is a not-for-profit organization with a mission
to “promote the use of best practices for providing
security assurance within Cloud Computing, and to
provide education on the uses of Cloud Computing
to help secure all other forms of computing.”
AWS CSA landing page: https://aws.amazon.com/compliance/csa/
CSA Consensus Assessments Initiative Questionnaire (CAIQ):
https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-
questionnaire-v3-0-1/
The NIST 800-53 security controls are generally
applicable to US Federal Information Systems.
Federal Information Systems typically must go
through a formal assessment and authorization
process to ensure sufficient protection of
confidentiality, integrity, and availability of
information and information systems.
AWS NIST landing page:
https://aws.amazon.com/compliance/nist/
NIST cybersecurity framework (CSF):
https://d1.awsstatic.com/whitepapers/compliance/NIST_Cybersecurity_Framew
ork_CSF.pdf
Quick start: NIST compliance on AWS:
https://docs.aws.amazon.com/quickstart/latest/compliance-nist/welcome.html
Starting from scratch

23. Your control environment
Your workload

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Growing your control environment
• What business outcome
are you trying to achieve?
• What is the nature of the
data involved?
• What are the resiliency
requirements?
Control 5Control 4Control 3Control 2Control 1
Control
objective n
Control
objective 3
Control
objective 2
Control
objective 1
Risk 3Risk 2Risk 1
Strategic
objective 3
Strategic
objective 2
Strategic
objective 1
Controls library

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Key takeaways
Risk
Take a risk-based approach to your
cloud control environment
Scope
Focus on the controls needed to fulfill
strategic objectives
Head start
Use industry-standard frameworks
that AWS already aligns with
Share the responsibility
Use the AWS tools and services to
meet your objectives

26. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.