AWS compliance, certifications and attestations

An auditor's report on controls relevant to customers' financial reporting.

HeldVendor page

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

HeldVendor page

A public summary of a SOC 2 examination, readable without an NDA.

HeldVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified privacy information management system extending ISO 27001.

HeldVendor page

A certified quality management system.

HeldVendor page

A certified business continuity management system.

HeldVendor page

A certified IT service management system.

HeldVendor page

A certified AI management system: how a company governs the AI it builds or uses.

HeldVendor page

Authorization to sell a cloud service to US federal agencies.

HighFedRAMP MarketplaceAWS US East/West; AWS GovCloud

A security verification for US state and local government cloud buyers.

HighGovRAMP product list and vendor pageAWS GovCloud (US) (Authorized, Hyperscale Inheritance Authority (HIA), High); AWS US East/West (Authorized, Hyperscale Inheritance Authority (HIA), Moderate)

Cybersecurity Maturity Model Certification for the defense supply chain.

HeldUnverifiedVendor page

The federal security and privacy control catalog (the basis of FedRAMP).

HeldVendor page

Cryptographic modules validated under FIPS 140-2 or 140-3.

FIPS 140-3NIST CMVP and vendor page18 active FIPS 140-3 modules: #5476 Amazon Linux 2023 GnuTLS Cryptographic Module; #5438 Amazon Linux 2023 OpenSSL FIPS Provider; #5429 AWS-LC Cryptographic Module (dynamic); #5369 Amazon Linux 2023 Kernel Cryptographic API; #5332 AWS Scalable Network Crypto Modules, version 1.1; #5314 AWS-LC 3 Cryp

Support for export-controlled defense data under ITAR.

HeldVendor page

Support for the FBI CJIS Security Policy for criminal justice data.

HeldVendor page

Safeguards for federal tax information held by agencies and their vendors.

HeldVendor page

Accessibility conformance reports (VPAT) for US federal buyers.

HeldVendor page

Validated compliance with the card industry data security standard.

HeldVendor page

Compliance with the PCI standard for 3-D Secure card authentication.

HeldVendor page

WORM record retention assessed against SEC Rule 17a-4(f) and FINRA 4511.

HeldVendor page

Alignment with Japan's FISC security guidelines for financial institutions.

HeldVendor page

Readiness for the EU Digital Operational Resilience Act for financial entities.

HeldVendor page

The vendor supports HIPAA-regulated health data and signs a Business Associate Agreement.

HeldVendor page

A certified assessment against the HITRUST CSF.

HeldVendor page

The NHS Data Security and Protection Toolkit self-assessment for suppliers.

HeldVendor page

Support for regulated life-sciences workloads under GMP, GCP and GLP.

HeldVendor page

Support for electronic records and signatures under 21 CFR Part 11.

HeldVendor page

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data. Covered entity of Amazon.com, Inc.

A listing in the Cloud Security Alliance STAR Registry.

Level 2CSA STAR RegistryCAIQ, certification

The UK government-backed baseline security certification.

PlusVendor page

Listing on the UK government's cloud procurement framework.

HeldVendor page

Certification under Spain's Esquema Nacional de Seguridad.

HeldVendor page

An assessment by an ASD-endorsed assessor for Australian government data.

HeldVendor page

Registration on Japan's government cloud security list.

HeldVendor page

Certification under Singapore's Multi-Tier Cloud Security standard.

HeldVendor page

Korea's information security management system certification.

HeldVendor page

An assessment shared through the German automotive industry's exchange.

HeldVendor page

Support for student education records under FERPA.

HeldVendor page