5 AWS Compliance Concepts Free Online FlashCards

What are the three broad categories of AWS compliance programs?

Certifications and attestations; laws, regulations, and privacy programs; and alignments and frameworks.

Do AWS compliance programs establish that a customer is compliant?

AWS programs provide assurance about AWS-operated services and infrastructure, but customers must still ensure their applications, data, and business processes meet applicable requirements.

Does an AWS framework alignment necessarily mean certification?

An alignment provides mappings, guidance, or related features; it does not necessarily mean AWS or a customer has been certified against the framework.

What should you verify about an AWS compliance program's coverage?

Coverage can vary by program, service, Region, and environment. Verify that the specific AWS offering and scope match the use case.

What does “security of the cloud” mean?

Security of the cloud covers AWS-operated underlying infrastructure, including facilities, hardware, networking, and the virtualization layer.

What does “security in the cloud” mean for customers?

Customers secure their workloads and configure the services they use. For example, an EC2 customer manages the guest operating system and installed software.

What is an inherited compliance control?

Inherited controls are operated by AWS, such as physical and environmental safeguards. Customers may rely on AWS evidence for that portion, subject to the program's scope.

What is a shared control? Give the patching example.

Shared controls involve related responsibilities for both parties. AWS patches its infrastructure, while the customer patches guest operating systems and applications they manage.

What is a customer-specific compliance control?

These are controls the customer implements for its workload or organization, such as deciding who can access data, training employees, or enforcing application-level approvals.

Which responsibilities remain with a customer using S3?

S3 reduces the customer's infrastructure-management burden, but the customer remains responsible for data, access permissions, and appropriate configuration.

What does AWS Artifact provide?

AWS Artifact provides on-demand access to AWS security and compliance documents, including reports and certifications, as well as certain AWS agreements.

How does AWS Audit Manager help with assessments?

AWS Audit Manager helps organize assessments and collect evidence from sources such as AWS Config, AWS Security Hub CSPM, and AWS CloudTrail.