A healthcare workload is being moved to AWS.
The evaluation must consider industry regulation, contracts, geography, and the selected services.
Which customer activity is appropriate for compliance planning?
The customer identifies applicable requirements and evaluates its controls alongside the AWS compliance material that applies to the service.
Detailed explanation
AWS certifications describe AWS controls and do not automatically make the customer's design and operations compliant.
AWS certifications describe AWS controls and do not automatically make the customer's design and operations compliant.
Applicable requirements can vary by industry, geography, contract, data, and service choice.
Applicable requirements can vary by industry, geography, contract, data, and service choice.
The customer must identify its obligations and evaluate which controls are inherited from AWS and which it must implement.
The customer must identify its obligations and evaluate which controls are inherited from AWS and which it must implement.
AWS reports cover AWS controls; the customer still needs evidence for its own controls and operations.
AWS reports cover AWS controls; the customer still needs evidence for its own controls and operations.
Check official documentation
Compare the following points with the official documentation.
AWS Artifact User GuideとAWS Risk and Complianceの共有責任の説明を確認する。
What to confirm
自社に適用される要件を特定し、AWS側の資料と自社の統制を分けて評価する。
Key points
- Applicable scope
- Shared responsibility
- Customer controls
Notes
- Environment: AWS公式コンプライアンス資料の確認
- Confirm current service capabilities and compliance guidance in the official AWS documentation.
Foundation review
Requirement discovery
The customer first identifies obligations that apply to the workload.
Inherited versus customer controls
AWS evidence can support inherited controls, while customer operations need their own evidence.