AWS Compliance Programs

AWS continually maintains a high bar for security and compliance across all of our global operations. Security is our top priority. AWS regularly undergoes independent third-party attestation audits to provide assurance that control activities are operating as intended. More specifically, AWS is audited against a variety of global and regional security frameworks dependent on region and industry. Currently, AWS offers over 300 security, compliance, and governance services and features. AWS supports 143 security standards and compliance certifications.

The results of these audits are documented by the assessing body and made available for all customers through AWS Artifact. AWS Artifact is a no-cost, self-service portal for on-demand access to AWS compliance reports. When new reports are released, they are made available in AWS Artifact, allowing customers to continuously monitor the security and compliance of AWS with immediate access to new reports.

Customers can take advantage of internationally recognized certifications and accreditations, demonstrating compliance with rigorous international standards, such as ISO 27017 for cloud security, ISO 27018 for cloud privacy, ISO 27701 for privacy information management, SOC 1, SOC 2 and SOC 3, PCI DSS Level 1 and others. AWS also helps customers meet local and regional data protection standards such as BSI's Cloud Computing Compliance Criteria Catalogue (C5), a German government-backed attestation, and the EU-wide GDPR CISPE Data Protection Code of Conduct (CISPE Code).

ISO/IEC 27701

The AWS ISO/IEC 27701:2019 certification demonstrates that AWS has implemented privacy-specific controls as part of a comprehensive privacy information management system. It validates that AWS has appropriate technical and organizational measures in place to protect personal data, including safeguards for cross-border transfers, data subject rights management, and privacy by design.

Customers can access the AWS ISO 27701 certification through AWS Artifact and use it as evidence when conducting their own compliance assessments.

ISO/IEC 27701:2019 is an international standard for privacy information management. This certification extends ISO/IEC 27001 to include specific privacy requirements, making it particularly relevant for GDPR compliance. As a Privacy Information Management System (PIMS) standard, ISO 27701 provides a framework for managing personal data and assists organizations in complying with various privacy regulations, including the GDPR. AWS's certification covers the implementation of privacy-specific controls and demonstrates our commitment to protecting personal data through a comprehensive privacy management system. The certification scope includes AWS's role as both a processor and controller, aligning with our dual role under the GDPR.

Cloud Computing Compliance Criteria Catalog (C5)

Customers can use the C5 attestation to evaluate how legal requirements, such as data privacy regulations, internal policies, or specific risk environments, relate to their use of cloud computing services on AWS. C5 provides a structured framework for assessing security controls and supports compliance reviews by IT, legal, and risk teams.

C5 is an attestation scheme backed by the German government and introduced by the Federal Office for Information Security (BSI). It was designed to help organizations demonstrate operational security against common cyber threats, based on the German government's security recommendations for cloud providers.

The standard defines technical and organizational security requirements relevant to both cybersecurity and data protection. It also includes disclosures on data location, service provisioning, jurisdiction, certifications, and service scope. C5 aligns with the IT-Grundschutz model and introduces cloud-specific control expectations.

Customers and compliance advisors can use the AWS C5 report as formal assurance of the security measures AWS has in place, especially when migrating or operating regulated workloads in Germany or the EU. The report is available through AWS Artifact, AWS’s self-service portal for on-demand compliance reports.

The CISPE Data Protection Code of Conduct

CISPE (Cloud Infrastructure Services Providers in Europe) is a coalition of cloud computing leaders serving millions of European customers. The CISPE Data Protection Code of Conduct (CISPE Code) is the first pan-European data protection code of conduct for cloud infrastructure service providers under Article 40 of the GDPR. It was approved by the EDPB in May 2021 and formally adopted by the French Data Protection Authority (CNIL), acting as the competent supervisory authority, in June 2021.

The CISPE Code confirms that cloud infrastructure providers meet GDPR processor requirements and have been independently verified for compliance. It also goes further by requiring providers to offer services that store and process data exclusively within the EEA.

Cloud infrastructure service providers must also commit that they will not access or use any customer data, except as necessary to provide and maintain the declared services. In particular, the cloud infrastructure service providers must commit to not use customer data for their own purposes, including for data mining, profiling or direct marketing. Ernst and Young CertifyPoint (EYCP) independently certified AWS services listed on the CISPE Public Register complying with the CISPE Code. EYCP was the first "monitoring body" accredited by CNIL to verify cloud infrastructure provider's compliance with the CISPE Code.

More than 100 AWS services certified as compliant with the Cloud Infrastructure Services Providers in Europe (CISPE) Data Protection Code of Conduct. They are registered in CISPE’s public register and can also be found within AWS Services in scope of the AWS Compliance Program. This alignment with the CISPE requirements demonstrates our ongoing commitment to adhere to the heightened expectations for data protection by cloud service providers.

AWS supports more security standards and compliance certifications than any other cloud provider, and is continuously reviewing the needs of our customers as the regulatory environment evolves.

Additional Resources on Compliance Programs

For more detailed information about the AWS compliance programs, reports, and third-party attestations, see AWS Compliance Programs. For service-specific information, see AWS services in scope by Compliance Program.