Skip to main content
A heavy forged iron padlock, sixteenth century
ISO 27001 A.8.28 Secure coding

ISO 27001:2022 on AWS

ISMS to Certification in 6 Months.

Book a Free ISO 27001 Readiness Assessment

9 controlsAudit onceFAQThe hub

ISO 27001 at a glance

ISO 27001:2022 transition closed in October 2025 — every certificate is now on the 2022 baseline with the 2024 climate amendment. We build the ISMS, deploy AWS-native controls for Annex A.5–A.8, and prepare the notified-body audit package.

Framework

ISO/IEC 27001 — Information Security Management Systems

Version

ISO/IEC 27001:2022 with Amendment 1:2024 (climate change considerations) — IAF transition closed October 2025

Regulator

International Organization for Standardization (ISO) — certified by accredited certification bodies (notified bodies in EU)

Assessor

Accredited certification body (ANAB, UKAS, IAF members). Certification audit is two-stage: Stage 1 (documentation review) + Stage 2 (implementation audit). Surveillance audits annually; recertification every 3 years.

Scope

Any organization seeking objective signal of information security maturity — common for enterprise SaaS expanding to EU/APAC, B2B vendors, and platforms in regulated supply chains.

Who engages on ISO 27001

  • Enterprise SaaS expanding into EU and APAC where ISO 27001 is the dominant procurement signal
  • B2B platforms in regulated supply chains (defense, finance, healthcare partners)
  • Companies layering ISO 27001 on top of an existing SOC 2 — most controls overlap
  • EU operators preparing for NIS2 or DORA where ISO 27001 is the baseline expectation

Where AWS stopsfor ISO 27001

What AWS does, what you do, and where the line moves under this framework.

The general split

AWS owns

  • AWS holds ISO 27001:2022, ISO 27017:2015 (cloud-specific controls), and ISO 27018:2019 (PII in public clouds) certifications — current attestations on AWS Artifact
  • AWS infrastructure controls inherit into your ISMS via the Statement of Applicability
  • AWS publishes the ISO 27001:2022 → AWS Service Catalog mapping for Annex A controls

Joint

  • A.6 People controls (awareness, training, screening) — AWS provides the training platform options; you operate the program
  • A.8 Technological controls implementation — AWS provides the services; you configure them
  • Internal audit and management review — your responsibility, but AWS Config and Security Hub generate the inputs

You own

  • Clauses 4–10: ISMS scope, leadership, planning, support, operation, performance evaluation, improvement
  • A.5 Organizational controls (37 controls) — policies, roles, threat intelligence, vendor management
  • A.6 People controls (8 controls) — screening, awareness, disciplinary process, NDA
  • A.7 Physical controls (14 controls) — mostly inherited from AWS for cloud workloads
  • A.8 Technological controls (34 controls) — IAM, encryption, logging, change management, capacity management
  • Risk treatment plan, Statement of Applicability (SoA), internal audit program

Controls

9 ISO 27001 controls in 2 families, each mapped to the AWS services that satisfy it.

Excerpts from the full matrix we deliver. Your audit scope drives the final mapping.

Annex A.5 — Organizational Controls4 controls

A.5 is the largest control category in ISO 27001:2022 (37 controls). Most are policy and process — but each requires a technical signal that proves it operates.

ControlAWS servicesImplementation note
A.5.7 Threat intelligenceGuardDuty (threat detection feed), AWS Shield Threat Intelligence, Amazon Inspector + KEV catalogThreat intelligence integrated into vulnerability prioritization; documented in the ISMS as the threat intelligence source.
A.5.15 Access controlIAM Identity Center, IAM Access Analyzer, Service Control PoliciesCentralized access control via Identity Center; Access Analyzer findings feed the access review cadence.
A.5.23 Information security for use of cloud servicesAWS Config, Security Hub, AWS Control TowerCloud security baseline enforced via Control Tower; drift detection via Config.
A.5.30 ICT readiness for business continuityAWS Backup, AWS Elastic Disaster Recovery, Multi-AZ + Multi-Region patternsDocumented recovery procedures; quarterly DR tests with results in the ISMS.
Annex A.8 — Technological Controls5 controls

A.8 (34 controls) is the heaviest mapping to AWS-native services — most controls have a 1:1 service correspondence.

ControlAWS servicesImplementation note
A.8.2 Privileged access rightsIAM Identity Center break-glass roles, AWS Organizations SCPs, CloudTrail privileged action alertingBreak-glass procedure documented; privileged action alerts sent to security team within 5 minutes.
A.8.10 Information deletionS3 Lifecycle policies, AWS Backup retention rules, KMS key deletionData retention policy mapped to S3 lifecycle; cryptographic erasure via KMS key deletion for sensitive workloads.
A.8.16 Monitoring activitiesCloudWatch, Security Hub, GuardDuty, DetectiveContinuous monitoring across security and operational events; documented runbooks for response.
A.8.24 Use of cryptographyKMS-CMK, CloudHSM, ACM Private CA, AWS SignerCryptographic policy documented; key inventory maintained; ML-KEM hybrid TLS for long-lived data flows.
A.8.28 Secure codingCodeGuru Reviewer, Amazon Inspector code scanning, CodePipeline approval gatesSecure SDLC enforced via pipeline; static analysis and dependency scanning on every PR.

Audit once, evidence four frameworks

Pick the frameworks you are scoped for. The tiles below are the AWS services that produce evidence for each one, with the control IDs they answer. The ones in navy cover every framework you picked: set them up once and the same evidence serves every auditor.

Counts come from the control excerpts on our four framework pages, not from your audit scope. Start from HIPAA, SOC 2, PCI DSS or ISO 27001.

21

AWS services evidence the 9 ISO 27001 controls we map.

41 AWS services in total, mapped across 36 controls.

Amazon CloudWatch

  • HIPAA §164.312(b)
  • SOC 2 CC7.1, CC7.2
  • PCI DSS 11.6.1
  • ISO 27001 A.8.16

Amazon Inspector

  • HIPAA §164.308(a)(5)(ii)(B)
  • SOC 2 CC6.8
  • PCI DSS 6.2, 6.3.3, 11.3.1
  • ISO 27001 A.5.7, A.8.28

AWS Backup

  • HIPAA §164.312(c)(1)
  • SOC 2 CC7.5
  • PCI DSS 6.3.3
  • ISO 27001 A.5.30, A.8.10

Amazon Detective

  • HIPAA §164.308(a)(1)(ii)(D)
  • SOC 2 CC7.4
  • ISO 27001 A.8.16

Amazon GuardDuty

  • HIPAA §164.308(a)(5)(ii)(B)
  • SOC 2 CC6.8, CC7.1, CC7.2
  • ISO 27001 A.5.7, A.8.16

AWS CloudTrail

  • HIPAA §164.308(a)(1)(ii)(D), §164.312(b)
  • SOC 2 CC6.2, CC7.4
  • ISO 27001 A.8.2

AWS Config

  • HIPAA §164.308(a)(1)(ii)(A), §164.312(b)
  • SOC 2 CC7.1
  • ISO 27001 A.5.23

AWS Security Hub

  • HIPAA §164.308(a)(1)(ii)(A), §164.308(a)(6)
  • SOC 2 CC7.1, CC7.3
  • ISO 27001 A.5.23, A.8.16

AWS Signer

  • HIPAA §164.312(c)(1)
  • SOC 2 CC6.8
  • ISO 27001 A.8.24

IAM Access Analyzer

  • HIPAA §164.308(a)(1)(ii)(A)
  • SOC 2 CC6.1
  • ISO 27001 A.5.15

IAM Identity Center

  • HIPAA §164.312(a)(1)
  • SOC 2 CC6.1, CC6.2, CC6.6
  • ISO 27001 A.5.15, A.8.2

Amazon CodeGuru Reviewer

  • PCI DSS 6.2
  • ISO 27001 A.8.28

Amazon S3

  • HIPAA §164.312(c)(1)
  • ISO 27001 A.8.10

AWS Certificate Manager

  • HIPAA §164.312(a)(2)(iv)
  • ISO 27001 A.8.24

AWS CloudHSM

  • HIPAA §164.312(a)(2)(iv)
  • ISO 27001 A.8.24

AWS Elastic Disaster Recovery

  • SOC 2 CC7.5
  • ISO 27001 A.5.30

AWS KMS

  • HIPAA §164.312(a)(2)(iv), §164.312(c)(1)
  • ISO 27001 A.8.10, A.8.24

AWS Organizations and SCPs

  • SOC 2 CC6.1, CC6.2
  • ISO 27001 A.5.15, A.8.2

AWS CodePipeline

  • ISO 27001 A.8.28

AWS Control Tower

  • ISO 27001 A.5.23

AWS Shield

  • ISO 27001 A.5.7

AWS PrivateLink and VPC endpoints

  • HIPAA §164.312(e)(1)
  • SOC 2 CC6.7
  • PCI DSS 1.3, 1.4

AWS Systems Manager

  • HIPAA §164.308(a)(6)
  • SOC 2 CC7.3
  • PCI DSS 6.3.3

Amazon CloudFront

  • HIPAA §164.312(e)(1)
  • PCI DSS 6.4.3, 11.6.1

Amazon Cognito

  • HIPAA §164.312(a)(1)
  • SOC 2 CC6.6

Amazon Security Lake

  • HIPAA §164.308(a)(1)(ii)(D)
  • SOC 2 CC7.4

AWS IAM

  • HIPAA §164.312(a)(1)
  • SOC 2 CC6.1, CC6.6

AWS Network Firewall

  • SOC 2 CC6.7
  • PCI DSS 1.2, 1.3

EventBridge

  • HIPAA §164.308(a)(6)
  • SOC 2 CC7.3

Step Functions

  • HIPAA §164.308(a)(6)
  • SOC 2 CC7.3

Amazon Q Developer

  • PCI DSS 6.2

Amazon Verified Permissions

  • HIPAA §164.312(a)(1)

Amazon VPC

  • PCI DSS 1.2

API Gateway

  • HIPAA §164.312(e)(1)

AWS Firewall Manager

  • PCI DSS 1.2

AWS Lambda

  • PCI DSS 11.6.1

AWS Site-to-Site VPN

  • PCI DSS 1.4

AWS Transit Gateway

  • PCI DSS 1.3

AWS Trusted Advisor

  • HIPAA §164.308(a)(1)(ii)(A)

AWS WAF

  • PCI DSS 6.4.3

Elastic Load Balancing

  • HIPAA §164.312(e)(1)

How the evidence keeps flowing

AWS Audit Manager closed to new customers on 30 April 2026. This pipeline is what we ship now, and it runs after we leave.

AWS-published Operational Best Practices for ISO 27001 conformance pack, mapped to Annex A controls.

Continuous standards checks; findings tagged to Annex A control IDs feed the SoA.

Policies, procedures, SoA, risk treatment plan, internal audit reports — owned by your team, structured for the certification body.

Vanta, Drata, Secureframe, or Tugboat Logic with the ISO 27001:2022 framework template — control inventory and evidence dashboard.

What you get, week by week

A date-bound engagement, not an open-ended retainer. Every deliverable is itemised in the statement of work.

Weeks 1–4 — ISMS Foundation

Weeks 1–4

  • ISMS scope statement (clauses 4.3) — what is in, what is out
  • Risk assessment methodology (clause 6.1) and risk treatment plan
  • Statement of Applicability (SoA) — every Annex A control with applicability and implementation status
  • Information security policy and supporting topic-specific policies (clause 5.2)

Weeks 5–12 — Control Implementation

Weeks 5–12

  • A.8 Technological controls deployed (IAM, encryption, logging, monitoring, change management)
  • A.5 Organizational controls documented and operating (vendor management, threat intelligence, business continuity)
  • A.6 People controls (awareness training, role-based screening, NDAs) operationalized
  • Internal audit program established (clause 9.2) — first audit completed

Months 4–6 — Operating Period

4–6 months

  • Continuous control operation — minimum 3 months for the certification body to assess effectiveness
  • Management review (clause 9.3) — first review completed
  • Corrective actions for findings from internal audit (clause 10.1)

Stage 1 + Stage 2 Audit

6–10 weeks

  • Stage 1 — documentation review (typically 1 week of fieldwork)
  • 4–6 weeks remediation window for any Stage 1 findings
  • Stage 2 — implementation audit (typically 2 weeks of fieldwork)
  • Certification decision and ISO 27001:2022 certificate issued (valid 3 years)

Deeper reading on ISO 27001, and the frameworks (in navy) most teams certify alongside it.

ISO 27001 Certification on AWS: ISMS Implementation Guide for 2026

ISO 27001:2022 on AWS: ISMS scope, 93 Annex A mapping, Stage 1/2 evidence. July 2026 stage checklist.

Read the guide

How to Set Up AWS Control Tower for Multi-Account Governance

AWS Control Tower automates multi-account management: it sets up guardrails, enforces compliance policies, and centralizes billing. This guide covers setup, customization, and production governance patterns.

Read the guide

AWS Multi-Account Strategy: Landing Zone Best Practices

A single AWS account is fine for week one. By month six, audit teams, security reviewers, and your CFO will all want their own boundary. How to structure AWS Organizations with Control Tower and a landing zone that doesn't have to be re-architected at scale.

Read the guide

SOC 2 Type II on AWS

CC1–CC9 trust services criteria mapped to AWS-native controls, evidence pipeline, and a CPA-firm-ready audit package — for SaaS founders facing enterprise procurement.

See the framework

HIPAA on AWS

PHI architecture, BAA boundaries, HIPAA-eligible services, §164.312 technical safeguards, and audit-ready evidence — for healthcare platforms, telehealth, and digital-health startups.

See the framework

Common questions

Did ISO 27001:2022 actually change again in 2024?
Yes — Amendment 1:2024 was published February 2024 and added climate-change considerations to clauses 4.1 (understanding the organization and its context) and 4.2 (understanding the needs and expectations of interested parties). The amendment is non-substantive in technical terms but auditors will check that your context-of-the-organization assessment includes climate-related risks (data-center power, regional flooding, supply chain disruption from extreme weather). The IAF transition window from ISO 27001:2013 to ISO 27001:2022 closed in October 2025 — every accredited certificate is now on the 2022 baseline with the 2024 amendment.
How much does ISO 27001 overlap with SOC 2?
High — typically 70–80% of controls overlap. ISO 27001:2022 has 93 Annex A controls; SOC 2 has the Common Criteria CC1–CC9 plus optional categories. Most platforms with SOC 2 Type II already operate the technical controls ISO 27001 expects. The gap is usually in the formal ISMS structure: ISO requires a documented Statement of Applicability, a risk treatment plan with residual risk acceptance, an internal audit program, and a management review cycle — all of which SOC 2 does not formally require. Layering ISO 27001 on top of SOC 2 is typically a 4–6 month effort, not a fresh build.
Do we need ISO 27017 and ISO 27018 too?
Depends on your customers. ISO 27017:2015 adds cloud-specific guidance (relationship between cloud service customer and provider, virtual machine isolation, customer monitoring). ISO 27018:2019 adds PII protection in public clouds. AWS holds both certifications, so the inherited controls flow through. For your own certification: most B2B SaaS only needs 27001 — but enterprise customers in EU and APAC increasingly ask for 27017 and 27018 in the SoA. We recommend including both as scope items in the initial certification rather than adding them as a separate engagement later.
Notified body vs certification body — what is the difference?
For ISO 27001 in non-EU jurisdictions, the term is "accredited certification body" — accredited by an IAF member (ANAB in US, UKAS in UK, JIPDEC in Japan, etc.). In EU regulatory contexts (e.g., NIS2), the term "notified body" may apply to specific certification schemes. For an ISO 27001:2022 certificate, the certification body must be IAF-accredited. Common choices: BSI, TÜV SÜD, DNV, Schellman, A-LIGN, Bureau Veritas. Pick a certification body whose accreditation matches your customer geography — a UKAS-accredited certificate carries weight in UK and EU; an ANAB-accredited certificate carries weight in US.
How long does first ISO 27001 certification take on AWS?
Realistic timeline: 6–9 months from start to certificate. Breakdown: 4 weeks ISMS foundation (scope, risk assessment, SoA, policies), 8 weeks control implementation, 3–4 months operating period (the certification body needs to see the ISMS operating, not just designed), 1 week Stage 1 audit, 4–6 weeks remediation, 2 weeks Stage 2 audit, 2–4 weeks certification decision. Renewals run on a 3-year cycle with annual surveillance audits. Companies with mature SOC 2 Type II tend to land at 4–5 months; companies starting from scratch land at 9–12 months.
Can we use Vanta or Drata for ISO 27001?
Yes — Vanta, Drata, Secureframe, and Tugboat Logic all ship ISO 27001:2022 framework templates with the 93 Annex A controls pre-mapped. The GRC tool serves the same role as in SOC 2: control inventory, evidence collection, and an auditor-facing dashboard. Your certification body will spend less time in fieldwork if the GRC tool is wired to AWS Config and Security Hub for live evidence. Note: GRC tools do not write your Statement of Applicability or risk treatment plan — those are bespoke documents that require human judgement on residual risk acceptance.
Engraved cutaway diagram of a Chubb detector lock showing its bolt and six tumblers, about 1850

Ready for ISO 27001?

2-week read-only assessment. We map your AWS environment to the 93 Annex A controls, gauge ISMS maturity, and quote the realistic certification timeline. No retainer commitment.

Book a Free ISO 27001 Readiness Assessment

Back to the Security & Compliance hub

Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.