OPS01-BP04 Evaluate compliance requirements
Regulatory, industry, and internal compliance requirements are an important driver for defining your organization’s priorities. Your compliance framework may preclude you from using specific technologies or geographic locations. Apply due diligence if no external compliance frameworks are identified. Generate audits or reports that validate compliance.
If you advertise that your product meets specific compliance standards, you must have an internal process for ensuring continuous compliance. Examples of compliance standards include PCI DSS, FedRAMP, and HIPAA. Applicable compliance standards are determined by various factors, such as what types of data the solution stores or transmits and which geographic regions the solution supports.
Desired outcome:
-
Regulatory, industry, and internal compliance requirements are incorporated into architectural selection.
-
You can validate compliance and generate audit reports.
Common anti-patterns:
-
Parts of your workload fall under the Payment Card Industry Data Security Standard (PCI-DSS) framework but your workload stores credit cards data unencrypted.
-
Your software developers and architects are unaware of the compliance framework that your organization must adhere to.
-
The yearly Systems and Organizations Control (SOC2) Type II audit is happening soon and you are unable to verify that controls are in place.
Benefits of establishing this best practice:
-
Evaluating and understanding the compliance requirements that apply to your workload will inform how you prioritize your efforts to deliver business value.
-
You choose the right locations and technologies that are congruent with your compliance framework.
-
Designing your workload for auditability helps you to prove you are adhering to your compliance framework.
Level of risk exposed if this best practice is not established: High
Implementation guidance
Implementing this best practice means that you incorporate compliance requirements into your architecture design process. Your team members are aware of the required compliance framework. You validate compliance in line with the framework.
Customer example
AnyCompany Retail stores credit card information for customers. Developers on the card storage team understand that they need to comply with the PCI-DSS framework. They’ve taken steps to verify that credit card information is stored and accessed securely in line with the PCI-DSS framework. Every year they work with their security team to validate compliance.
Implementation steps
-
Work with your security and governance teams to determine what industry, regulatory, or internal compliance frameworks that your workload must adhere to. Incorporate the compliance frameworks into your workload.
-
Validate continual compliance of AWS resources with services like AWS Compute Optimizer and AWS Security Hub.
-
-
Educate your team members on the compliance requirements so they can operate and evolve the workload in line with them. Compliance requirements should be included in architectural and technological choices.
-
Depending on the compliance framework, you may be required to generate an audit or compliance report. Work with your organization to automate this process as much as possible.
-
Use services like AWS Audit Manager to generate validate compliance and generate audit reports.
-
You can download AWS security and compliance documents with AWS Artifact.
-
Level of effort for the implementation plan: Medium. Implementing compliance frameworks can be challenging. Generating audit reports or compliance documents adds additional complexity.
Resources
Related best practices:
-
SEC01-BP03 Identify and validate control objectives - Security control objectives are an important part of overall compliance.
-
SEC01-BP06 Automate testing and validation of security controls in pipelines - As part of your pipelines, validate security controls. You can also generate compliance documentation for new changes.
-
SEC07-BP02 Define data protection controls - Many compliance frameworks have data handling and storage policies based.
-
SEC10-BP03 Prepare forensic capabilities - Forensic capabilities can sometimes be used in auditing compliance.
Related documents:
Related videos:
Related examples:
Related services:
