Compliance on AWS
Pick the Right Frameworks — Don't Audit Twice.
What this hub covers
Most regulated SaaS, healthcare, and fintech teams arrive with overlapping framework scope — HIPAA plus SOC 2, or PCI DSS plus ISO 27001 — and EU operators now stack DORA and the EU AI Act on top. The guides below cover the specific controls each framework expects, where AWS-native services already satisfy the control, and where your engineering team has to configure or attest. For technical evidence automation (conformance packs, safe auto-remediation, audit-ready exports), start with continuous compliance automation. Written from inside paid audit engagements, not from auditor handbooks.
11 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
AWS Data Residency and Sovereignty in 2026: Regions, Inference Boundaries, and What Actually Stays in Country
The AWS European Sovereign Cloud reached GA in Brandenburg on January 15, 2026, but most EU SaaS workloads still fit standard EU regions plus DPA/SCC. This guide separates data at rest, inference routing (Bedrock geographic vs global profiles), and when sovereign cloud is worth the premium.
Read the guideHIPAA on AWS: The Compliance Lead's Audit-Ready Checklist
An audit-prep checklist for Compliance Leads, Security Officers, and CISOs: BAA execution, documented Security Risk Assessments, workforce training, audit cadence, and the evidence packages OCR investigators expect.
Read the guideHow to Implement a HIPAA-Compliant Architecture on AWS — An Engineer's Build Guide
HIPAA on AWS build guide: BAA via Artifact, eligible services, KMS/VPC/RDS/S3 patterns. July 2026 engineering checklist.
Read the guideHow to Achieve SOC 2 Type II Compliance on AWS (2026 Checklist)
SOC 2 Type II certification proves your controls are effective over 6-12 months. This guide covers the compliance roadmap, AWS security controls, documentation requirements, and audit preparation for 2026 certification.
Read the guidePCI DSS Compliance on AWS: Architecture Guide for Fintech
A practical architecture guide for PCI DSS compliance on AWS: CDE scoping, the 12 requirements mapped to AWS services, network design, encryption, logging, and audit readiness for payment-processing applications.
Read the guideISO 27001 Certification on AWS: ISMS Implementation Guide for 2026
ISO 27001:2022 on AWS: ISMS scope, 93 Annex A mapping, Stage 1/2 evidence. July 2026 stage checklist.
Read the guideNIST Cybersecurity Framework 2.0 on AWS: Implementation & Maturity Guide
NIST CSF 2.0 on AWS: Govern + six functions, tiers, 800-53/171/CMMC. July 2026 Tier-3 checklist.
Read the guideGDPR Compliance on AWS: A Practical Guide for SaaS Companies
GDPR compliance on AWS for SaaS companies handling EU resident data. Region selection, the AWS DPA, data subject rights automation, RoPA documentation, breach notification, and the technical controls regulators expect.
Read the guideNIS2 Directive on AWS: A Practical Compliance Guide for EU Critical Infrastructure
NIS2 on AWS: Essential/Important scope, Art. 21 measures, 24h/72h clocks, supply chain. July 2026 checklist.
Read the guideDORA Compliance on AWS: A Practical Guide for EU Financial Entities and ICT Third-Party Providers
DORA on AWS since Jan 2025: RoI, TLPT/TIBER-EU, incident clocks, Artifact addendum. July 2026 readiness checklist.
Read the guideEU AI Act on AWS: A Practical Compliance Guide for High-Risk AI on Bedrock and SageMaker
EU AI Act compliance on AWS: risk classification, prohibited practices, GPAI obligations, the high-risk Annex III framework (now due 2 December 2027 after the Digital Omnibus delay), and the AWS-native control mapping using Bedrock Guardrails, SageMaker Model Cards, and Audit Manager governance.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
Cloud Compliance Services — HIPAA, SOC 2, PCI DSS on AWS
Cloud compliance services — HIPAA, SOC 2, PCI DSS, ISO 27001, GDPR. Expert consulting from FactualMinds.
Explore the serviceAWS Well-Architected Review — Free Assessment
Free AWS Well-Architected Review from FactualMinds. Identify risks, compliance gaps, and optimization opportunities.
Explore the serviceGovernance & Multi-Account
Multi-account is where compliance scope is either won or quietly lost. Control Tower, landing-zone topology, automated conformance packs, and drift detection — the patterns that hold scope at 50+ accounts.
Open the hubIAM & Access Control
Least-privilege patterns, workforce SSO with identity propagation, customer auth, and fine-grained Cedar-policy authorization.
Open the hubAI Security
Know every AI asset across accounts, then harden inference: prompt injection, PII leakage, hallucinations, and regulated model deployment.
Open the hubCommon questions
- Which framework should we tackle first?
- It depends on contract gating and customer pressure. SaaS companies usually start with SOC 2 Type II because enterprise procurement requires it. Healthcare platforms must satisfy HIPAA before any PHI touches the system. Fintech with card data needs PCI DSS scope reduction before scaling. ISO 27001 is best layered on top of SOC 2 — most controls overlap. EU financial entities and their ICT third-party providers must hit DORA, in force since 17 January 2025, and any organization deploying high-risk AI into the EU has the EU AI Act on its critical path with Annex III obligations enforceable from 2 August 2026.
- Can we reuse evidence across frameworks?
- Yes — that is the entire reason multi-framework control mapping exists. We map controls once against AWS-native services (Security Hub Essentials, AWS Config conformance packs, Amazon Inspector, IAM Access Analyzer) and reuse the same evidence pipeline for SOC 2, HIPAA, PCI DSS 4.0.1, NIST 800-53 r5, and ISO 27001:2022. Framework-specific controls — PCI DSS 4.0.1 script integrity (Requirement 6.4.3, enforceable since 31 March 2025), HIPAA-specific BAA boundaries, NIS2 24-hour early-warning timeline, DORA threat-led penetration testing, and EU AI Act risk-management documentation — get added on top without duplicating the foundational work.
- Does DORA apply to us, and what does AWS provide?
- DORA (Regulation (EU) 2022/2554) applies to banks, payment institutions, e-money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, pension funds, credit rating agencies, and the ICT third-party service providers (including hyperscalers) that serve them — in force since 17 January 2025 with penalties up to 2% of global annual turnover. AWS provides DORA-aligned attestations through AWS Artifact and signs the DORA-compliant addendum on request. Your side covers the ICT risk management framework, third-party register (Article 28), threat-led penetration testing (TLPT under TIBER-EU), and the major-incident reporting workflow on the ESA timeline.
- When does the EU AI Act start enforcing for our deployment?
- The EU AI Act has a phased timeline. Prohibited-practice rules and AI literacy obligations applied from 2 February 2025. Governance, notified bodies, and General-Purpose AI (GPAI) model obligations applied from 2 August 2025. High-risk Annex III obligations (the bulk of the framework — risk management, data governance, technical documentation, transparency, human oversight, accuracy/robustness/cybersecurity) become enforceable from 2 August 2026 with penalties up to €35M or 7% of worldwide turnover.
- Did ISO 27001:2022 change again in 2024?
- Yes — ISO/IEC 27001:2022 received Amendment 1:2024 (published February 2024) which added climate-change considerations to clauses 4.1 and 4.2. The amendment is non-substantive in technical terms but auditors will check that your context-of-the-organization assessment includes climate-related risks (data-center power, regional flooding, supply chain). The IAF transition window from ISO 27001:2013 to ISO 27001:2022 closed in October 2025 — every accredited certificate is now on the 2022 (with 2024 amendment) baseline.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}