Amazon CloudWatch
- HIPAA §164.312(b)
- SOC 2 CC7.1, CC7.2
- PCI DSS 11.6.1
- ISO 27001 A.8.16
Audit-ready AWS security
IAM hardening, AWS-native threat detection and audit-ready evidence for HIPAA, SOC 2, PCI DSS, ISO 27001 and four more frameworks, from an AWS Select Tier Services Partner.
Who this is for
Misconfiguration, not sophisticated exploits, is behind most AWS breaches. We harden IAM, deploy AWS-native detection and build the evidence pipeline your auditor reads from.
Who it is for. Regulated SaaS, healthcare and fintech teams on AWS, usually with overlapping scope: HIPAA with SOC 2, or PCI DSS with ISO 27001, and DORA or the EU AI Act on top for EU operators.
Eight frameworks. HIPAA, SOC 2, PCI DSS 4.0.1, ISO 27001:2022, NIST CSF 2.0, GDPR, DORA and the EU AI Act. The first four have their own pages, with control-by-control AWS mappings.
Who does the work. An AWS Select Tier Services Partner with 50+ AWS certifications on staff, working on your side of the shared responsibility line.
Last reviewed.July 2026 — Security Hub AI inventory (managed, self-hosted, and external AI assets), continuous compliance pipeline, Security Agent full-repo review, Audit Manager closure for new customers. Reviewed by FactualMinds AWS-certified architects (Solutions Architect – Professional).
Audit once, evidence four frameworks
Pick the frameworks you are scoped for. The tiles below are the AWS services that produce evidence for each one, with the control IDs they answer. The ones in navy cover every framework you picked: set them up once and the same evidence serves every auditor.
Counts come from the control excerpts on our four framework pages, not from your audit scope. Start from HIPAA, SOC 2, PCI DSS or ISO 27001.
18
AWS services evidence all of HIPAA and SOC 2, across 19 mapped controls.
41 AWS services in total, mapped across 36 controls.
Amazon Inspector
- HIPAA §164.308(a)(5)(ii)(B)
- SOC 2 CC6.8
- PCI DSS 6.2, 6.3.3, 11.3.1
- ISO 27001 A.5.7, A.8.28
AWS Backup
- HIPAA §164.312(c)(1)
- SOC 2 CC7.5
- PCI DSS 6.3.3
- ISO 27001 A.5.30, A.8.10
Amazon Detective
- HIPAA §164.308(a)(1)(ii)(D)
- SOC 2 CC7.4
- ISO 27001 A.8.16
Amazon GuardDuty
- HIPAA §164.308(a)(5)(ii)(B)
- SOC 2 CC6.8, CC7.1, CC7.2
- ISO 27001 A.5.7, A.8.16
AWS CloudTrail
- HIPAA §164.308(a)(1)(ii)(D), §164.312(b)
- SOC 2 CC6.2, CC7.4
- ISO 27001 A.8.2
AWS Config
- HIPAA §164.308(a)(1)(ii)(A), §164.312(b)
- SOC 2 CC7.1
- ISO 27001 A.5.23
AWS PrivateLink and VPC endpoints
- HIPAA §164.312(e)(1)
- SOC 2 CC6.7
- PCI DSS 1.3, 1.4
AWS Security Hub
- HIPAA §164.308(a)(1)(ii)(A), §164.308(a)(6)
- SOC 2 CC7.1, CC7.3
- ISO 27001 A.5.23, A.8.16
AWS Signer
- HIPAA §164.312(c)(1)
- SOC 2 CC6.8
- ISO 27001 A.8.24
AWS Systems Manager
- HIPAA §164.308(a)(6)
- SOC 2 CC7.3
- PCI DSS 6.3.3
IAM Access Analyzer
- HIPAA §164.308(a)(1)(ii)(A)
- SOC 2 CC6.1
- ISO 27001 A.5.15
IAM Identity Center
- HIPAA §164.312(a)(1)
- SOC 2 CC6.1, CC6.2, CC6.6
- ISO 27001 A.5.15, A.8.2
Amazon Cognito
- HIPAA §164.312(a)(1)
- SOC 2 CC6.6
Amazon Security Lake
- HIPAA §164.308(a)(1)(ii)(D)
- SOC 2 CC7.4
AWS IAM
- HIPAA §164.312(a)(1)
- SOC 2 CC6.1, CC6.6
EventBridge
- HIPAA §164.308(a)(6)
- SOC 2 CC7.3
Step Functions
- HIPAA §164.308(a)(6)
- SOC 2 CC7.3
Amazon CloudFront
- HIPAA §164.312(e)(1)
- PCI DSS 6.4.3, 11.6.1
Amazon S3
- HIPAA §164.312(c)(1)
- ISO 27001 A.8.10
AWS Certificate Manager
- HIPAA §164.312(a)(2)(iv)
- ISO 27001 A.8.24
AWS CloudHSM
- HIPAA §164.312(a)(2)(iv)
- ISO 27001 A.8.24
AWS Elastic Disaster Recovery
- SOC 2 CC7.5
- ISO 27001 A.5.30
AWS KMS
- HIPAA §164.312(a)(2)(iv), §164.312(c)(1)
- ISO 27001 A.8.10, A.8.24
AWS Network Firewall
- SOC 2 CC6.7
- PCI DSS 1.2, 1.3
AWS Organizations and SCPs
- SOC 2 CC6.1, CC6.2
- ISO 27001 A.5.15, A.8.2
Amazon Verified Permissions
- HIPAA §164.312(a)(1)
API Gateway
- HIPAA §164.312(e)(1)
AWS Trusted Advisor
- HIPAA §164.308(a)(1)(ii)(A)
Elastic Load Balancing
- HIPAA §164.312(e)(1)
Amazon CodeGuru Reviewer
- PCI DSS 6.2
- ISO 27001 A.8.28
Amazon Q Developer
- PCI DSS 6.2
Amazon VPC
- PCI DSS 1.2
AWS CodePipeline
- ISO 27001 A.8.28
AWS Control Tower
- ISO 27001 A.5.23
AWS Firewall Manager
- PCI DSS 1.2
AWS Lambda
- PCI DSS 11.6.1
AWS Shield
- ISO 27001 A.5.7
AWS Site-to-Site VPN
- PCI DSS 1.4
AWS Transit Gateway
- PCI DSS 1.3
AWS WAF
- PCI DSS 6.4.3
The Security Pillar, applied
The AWS Well-Architected Security Pillar decides whether your next audit is a sprint or a slog. Every engagement maps to its seven design principles.
Implement a strong identity foundation
Centralised identity (IAM Identity Center), least privilege, no long-lived keys, and ABAC at scale.
Maintain traceability
CloudTrail (multi-region, validated, immutable), CloudTrail Lake or Security Lake on OCSF 1.1, and tamper-evident log retention.
Apply security at all layers
Edge (WAF, Shield), network (Network Firewall, security groups), workload (Inspector, GuardDuty), and data (KMS, Macie).
Automate security best practices
AWS Config conformance packs, Security Hub Essentials, IaC guardrails, and auto-remediation for high-confidence findings.
Protect data in transit and at rest
TLS 1.3 (ML-KEM hybrid where supported), KMS-CMK encryption for everything regulated, and key rotation as policy.
Keep people away from data
Read-only access by default, break-glass with MFA, query-based access (Athena, Lake Formation) over direct console access.
Prepare for security events
Documented runbooks, tabletop exercises, and pre-staged forensic tooling (Detective, IAM Access Analyzer, EventBridge response automations).
Run the free Well-Architected assessment
20 questions across the six AWS pillars, Security included, to find hidden risk in IAM, data protection and incident response.
Start the assessmentFour stages
Discovery is read-only: nothing changes in week one. Remediation is IaC-driven, reviewed change by change and reversible. After go-live the evidence pipeline runs without us in the loop.
Week 1
Read-only IAM Access Analyzer, Security Hub baseline scan, Config conformance pack deployment. We learn your environment before we propose anything.
Weeks 2–3
Findings prioritised by exploitability and audit impact. Threat model, IAM blast-radius map, network segmentation review, evidence-pipeline gap analysis.
Weeks 4–8
IaC-driven hardening, WAF/Network Firewall rollout, encryption uplift, multi-account guardrails. Every change reviewed and reversible.
Ongoing
Continuous Security Hub + Config + Amazon Inspector evidence flowing into your GRC tool (Vanta / Drata / Secureframe) on the cadence your auditor expects.
Results we can show
Two published security case studies, each with its architecture, timeline and results.
PCI DSS fintech migration
- 8 wks → 4 daysAnnual QSA audit prep time
- 70%Cardholder data environment scope reduced
- 12 wksTime to PCI DSS architecture
HIPAA telehealth platform
- 8 wksTime to production
- 94%HIPAA controls automated
- 96/100Security Hub score
AWS Select Tier Services Partner
AWS Marketplace seller, 50+ AWS certifications on staff, and a managed SOC that watches GuardDuty, Security Hub and Security Lake around the clock.
Partner credentialsAWS Cloud Security
Vulnerability assessment, network review, IAM hardening, and continuous monitoring.
Explore the serviceCloud Compliance Services
Gap assessment, control implementation, and audit evidence for HIPAA, SOC 2, PCI DSS, ISO 27001 and GDPR.
Explore the serviceManaged SOC & MDR
24/7 detection and response on GuardDuty, Security Hub, Security Lake, and automated containment runbooks.
Explore the serviceAWS Penetration Testing
IAM privilege escalation, S3 misconfiguration, IMDS exploitation, web app, API, and container testing.
Explore the serviceCyber-Led AI
IAM for ML, SageMaker security, prompt-injection defense, and model governance.
Explore the serviceBefore you sign
- We need HIPAA, SOC 2, and PCI DSS — can you handle multi-framework scope?
- Yes. Most regulated SaaS clients land with overlapping scope, so we map the controls once against AWS-native services (Audit Manager, Security Hub, Config) and reuse the same evidence pipeline for each framework. Where the frameworks diverge — for example, PCI DSS 4.0.1 script integrity (Requirement 6.4.3) or HIPAA-specific BAA boundaries — we add the framework-specific controls without duplicating the foundational work. Net effect: a single integrated audit prep instead of three sequential ones.
- What is your AWS-native evidence pipeline now that Audit Manager is closed to new customers?
- AWS Audit Manager closed to new customers on 30 April 2026 — existing customers can keep using it through the announced support window, but every engagement we run now starts on the AWS Config + Security Hub pattern below. The pipeline pairs AWS Config conformance packs (regulator-aligned control sets — CIS AWS Foundations, NIST 800-53 r5, HIPAA, PCI DSS 4.0, FedRAMP Moderate, K-ISMS, RBI, MAS — deployable Organization-wide via CloudFormation StackSets) with Security Hub Essentials on its 2025-revised resource-based pricing. Security Hub runs the continuous standards checks; Config conformance packs hold the rule-by-rule compliance state; CloudTrail Lake or Security Lake (OCSF 1.1) holds the auditable event store. Your team — or our consultants — still owns the policy library, risk assessments, and vendor reviews; the AWS-native stack collects the technical evidence.
- When do we need a 3PAO vs. CPA firm vs. notified body?
- Different frameworks require different assessor types. SOC 2 audits must be conducted by a licensed CPA firm. PCI DSS Level 1 (≥6M transactions/year) requires a Qualified Security Assessor (QSA), and FedRAMP requires a Third Party Assessment Organization (3PAO) listed on the FedRAMP marketplace. ISO 27001 certification requires an accredited certification body (notified body in EU terminology). HIPAA has no formal certification — it is enforced by HHS OCR, so the bar is "demonstrate due diligence" rather than "pass a specific assessor." Our gap-assessment phase always confirms the right assessor type before quoting a timeline.
- Do you provide the BAA, or just the AWS-side controls?
- AWS provides the Business Associate Addendum directly through AWS Artifact — that covers AWS as your subprocessor. We help you (a) confirm you only use HIPAA-eligible services on the workload side, (b) implement the technical safeguards (encryption, access logging, transmission security) under HIPAA §164.312, and (c) draft your downstream BAAs with anyone you share PHI with. We do not act as your covered-entity-side legal counsel — your healthcare attorney owns the BAA terms and Notice of Privacy Practices.
- How do AI workloads (Bedrock, SageMaker) change the compliance scope?
- AI changes the audit conversation in three concrete ways: (1) BAA boundaries shift — your Business Associate Addendum must reflect that a foundation model now processes PHI; AWS Bedrock and Bedrock AgentCore are HIPAA-eligible (AgentCore added February 2026), but every model and feature you use needs to be on the current AWS HIPAA Eligible Services list. (2) SOC 2 CC6.1 (logical access) and CC7.1 (system monitoring) extend to prompt and inference logs; HIPAA §164.312 transmission security and §164.308 access management both apply to inference paths. (3) Risk management documentation expands — NIST AI RMF for US, EU AI Act high-risk Annex III (enforceable 2 August 2026) for EU. Bedrock Guardrails (PII redaction, text and image content filters, denied topics, word filters, contextual grounding, and Automated Reasoning checks for math-validated factuality) are HIPAA-eligible and become evidence for those control extensions. We treat AI compliance as additive on top of HIPAA/SOC 2/PCI DSS — not a replacement.
- What evidence packages do you produce, and who owns them post-engagement?
- You own everything we produce: control narratives mapped to the framework, AWS architecture diagrams (Security Hub findings, Config rules, IAM Access Analyzer reports), the policy library (information security, access control, incident response, vendor management), risk-assessment workbook, and the Audit Manager evidence pipeline. Everything lives in your AWS account and your document repository. The only thing we keep is a redacted reference architecture for our internal patterns library.
- Can you integrate with our existing GRC tool (Vanta, Drata, Secureframe)?
- Yes. We work with Vanta, Drata, Secureframe, and Tugboat Logic regularly. The pattern is consistent: the GRC tool is your control inventory and evidence dashboard for auditors, AWS Config + Security Hub is the source of truth for technical findings, and we wire the read-only AWS integration so the GRC tool reflects live state instead of point-in-time snapshots. We do not push you off your existing tooling — most of our clients arrive with one already in place.
- What does ongoing compliance monitoring cost after the initial engagement?
- Two cost components, with AWS pricing current as of May 2026. AWS-side: Security Hub on its resource-based "Security Hub Essentials" pricing (repriced in 2025) — unlimited checks/findings, billed per protected resource (EC2 instance, container image, Lambda function, IAM principal); typical mid-market spend $300–$1,500/month. AWS Config moved to tiered per-region pricing — $0.001 / $0.0008 / $0.0005 per evaluation across the 100K / 100K–500K / >500K bands. Amazon GuardDuty is $4.00 per million CloudTrail management events plus add-on protection plans (EKS, S3, RDS, Lambda, EC2 Runtime) billed separately. Add Amazon Inspector (per-resource per-month for EC2, ECR, Lambda + code scanning) and CloudTrail Lake / Security Lake storage as needed. Add it all up and mid-market regulated workloads land at $800–$3,500/month for the full security stack. Engagement-side: our managed compliance retainer covers quarterly control reviews, annual policy refresh, audit liaison, and on-call support during your audit window — $4K–$12K/month depending on framework count and account scale. Assessor fees (CPA, QSA, 3PAO, certification body) sit on top and we do not control those.
Start with a free assessment
Our guides share what we know. An engagement applies it to your environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}