Important Certifications

1. CJIS. The criterion set by the Criminal Justice Information Services (CJIS) division of the FBI is met by AWS. AWS enters into CJIS security agreements with its clients, which stipulate that the company must either permit or carry out any employee background checks that may be needed under the CJIS Security Policy.
2. Cyber Essentials Plus. Cyber Essentials Plus is a certification program that was launched in the United Kingdom with the backing of the government and the cooperation of the industry. Its purpose is to assist businesses in demonstrating that they have operational protection against typical cyberattacks. Within the context of the UK Government’s “10 Steps to Cyber Security,” it highlights the baseline measures that AWS employs to limit the risk from typical Internet-based attacks. [C]cybersecurity is a priority for the UK Government. It has the backing of industry, including the Confederation of British Industry, the Federation of Small Businesses, and a number of insurance groups that provide benefits to companies who possess this certification. Cyber Essentials lays out the necessary technical controls, and the assurance framework that is related to Cyber Essentials demonstrates how the independent assurance process functions for achieving Cyber Essentials Plus certification through the use of an annual external assessment that is carried out by an accredited assessor. The certification is only valid for use inside the European Union (Ireland) area because of the geographical focus of the certification.
3. The Federal Information Processing Standard (FIPS) Publication 140-2 is a security standard that was created by the United States government. This standard outlines the security standards that must be met by cryptography modules that are used to safeguard sensitive information. SSL terminations in AWS GovCloud (US) run on hardware that has been verified to comply with the FIPS 140-2 standard in order to better serve clients that must meet these criteria. When clients of AWS GovCloud (US) use the environment, AWS works with them to provide the information they need to help manage compliance. This is done in collaboration with customers of AWS GovCloud (US).
4. FISMA and DIACAP are acronyms. AWS makes it possible for federal entities in the United States to comply with the Federal Information Security Management Act and maintain that compliance (FISMA). As part of the approval process for a wide range of government systems, the AWS infrastructure has been reviewed by independent assessors. This was done at the request of the systems’ owners. In accordance with the Risk Management Framework (RMF) process outlined in NIST 800-37 and the DoD Information Assurance Certification and Accreditation Process, a large number of federal civilian and Department of Defense (DoD) organizations have successfully achieved security authorizations for systems that are hosted on Amazon Web Services (AWS) (DIACAP).
5. ISO 9001. AWS has been awarded the ISO 9001 accreditation. Customers that build, move, and manage their quality-controlled IT systems in the AWS cloud are directly supported by the ISO 9001 certification that AWS has earned. Customers have the ability to use the compliance reports provided by AWS as evidence for their very own ISO 9001 programs as well as industry-specific quality programs, such as GxP in the life sciences industry, ISO 13485 in the medical device industry, AS9100 in the aerospace industry, and ISO/TS 16949 in Amazon Web Services. Risk Management and Compliance Page 11 of 81 in the May 2017 issue of automobiles. Customers of Amazon Web Services who do not have quality system needs can nonetheless benefit from the added confidence and transparency that is provided by an ISO 9001 certification.
6. ISO 27001. The Information Security Management System (ISMS) that covers Amazon Web Services’s infrastructure, data centers, and services has been certified to the international standard ISO 27001. ISO 27001/27002 is a global security standard that has seen widespread adoption and lays out requirements and best practices for a systematic approach to managing company and customer information. This approach is based on periodic risk assessments that are appropriate to ever-changing threat scenarios, and ISO 27001/27002 lays out the requirements and best practices for such an approach. In order for a business to be eligible for the certification, they need to demonstrate that they have a methodical and continuing strategy for managing information security risks. These risks may have an effect on the availability, integrity, and confidentiality of customer and corporate information. Amazon’s commitment to sharing meaningful information on our security policies and procedures has been reaffirmed by this certification.
7. PCI DSS Level 1. AWS satisfies the requirements of the Payment Card Industry (PCI) Data Security Standard at the Level 1 level (DSS). Customers have the option of storing, processing, and transferring credit card information in the cloud using apps that may be operated on our technological infrastructure that is PCI compliant. PCI Security Standards Council announced the publication of PCI DSS Cloud Computing Guidelines in February of 2013. Customers that are managing an environment that contains cardholder data may use these recommendations to learn about the factors that go into maintaining PCI DSS controls in the cloud. Customers of Amazon Web Services may now take use of the AWS PCI Compliance Package, which includes the PCI DSS Cloud Computing Guidelines. The AWS PCI Compliance Package includes both the AWS PCI Attestation of Compliance (AoC), which demonstrates that AWS has been successfully validated against standards applicable to a Level 1 service provider under PCI DSS Version 3.1, and the AWS PCI Responsibility Summary, which explains how compliance responsibilities are shared between AWS and our customers in the cloud. Both of these documents can be downloaded from the AWS website.