Principle 4: Governance framework

The service provider should have a security governance framework which coordinates and directs its management of the service and information within it. Any technical controls deployed outside of this framework will be fundamentally undermined.

The responsibility for fulfilling this requirement falls solely on AWS; the customer need do no more than satisfy themselves that AWS does so.