Amazon Web Services: Risk and Compliance

Abstract

AWS serves a variety of customers, including those in regulated industries.

Through our shared responsibility model, we enable customers to manage risk effectively and efficiently in the IT environment, and provide assurance of effective risk management through our compliance with established, widely recognized, frameworks, and programs.

This paper outlines the mechanisms that AWS has implemented to manage risk on the AWS side of the Shared Responsibility Model, and the tools that customers can leverage to gain assurance that these mechanisms are being implemented effectively.

Introduction

AWS and its customers share control over the IT environment.

Therefore, security is a shared responsibility.

When it comes to managing security and compliance in the AWS Cloud, each party has distinct responsibilities.

A customer’s responsibility depends on which services they are using.

However, in general, customers are responsible for building their IT environment in a manner that aligns with their specific security and compliance requirements.

This paper provides more details about each party’s security responsibilities and the ways customers can benefit from the AWS Risk and Compliance Program.