Mapping Controls to Compliance Frameworks

Regulations and standards like PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR define what secure handling of data must look like.

Passing the exam and running a real business both require mapping AWS controls to these frameworks so you can prove compliance to auditors.

Compliance, like security, is shared.

• AWS certifies its infrastructure against many frameworks.
• You are responsible for configuring your workloads compliantly on top of it.

Inheriting AWS's certifications does not make your application automatically compliant.

AWS Artifact is the portal for AWS's compliance reports and agreements.

You download SOC reports, ISO certificates, PCI attestations, and accept agreements like a Business Associate Addendum (BAA) for HIPAA. Auditors often want these to verify the AWS side of compliance.

AWS Audit Manager continuously collects evidence and maps it to framework controls.

Using prebuilt frameworks for PCI, HIPAA, and others, it gathers configuration and activity evidence automatically, turning compliance reporting from a manual scramble into an ongoing process.

Each control maps to one or more AWS capabilities. For example:

• Encryption-at-rest requirements map to KMS.
• Access logging maps to CloudTrail.
• Least privilege maps to IAM and Access Analyzer.

Knowing these mappings is core exam knowledge.

PCI DSS protects cardholder data. On AWS you address it with encryption (KMS), network segmentation (VPC, security groups), logging (CloudTrail, Config), and access control (IAM).

A PCI conformance pack and Audit Manager framework help demonstrate the technical controls.

HIPAA governs protected health information. AWS supports it via a BAA and a list of HIPAA-eligible services.

You must use eligible services, encrypt PHI in transit and at rest, and log access. Only eligible services may process PHI under the agreement.

Modern compliance is continuous, not a once-a-year scramble.

• Config conformance packs check controls constantly.
• Security Hub standards score posture against benchmarks.
• Audit Manager gathers evidence over time.

Together they keep you audit-ready year-round.

Some frameworks demand data stay in specific regions or jurisdictions.

You enforce residency with region restrictions via SCPs, and you keep data in compliant regions. AWS's region isolation means data does not leave a region unless you move it.

Security Hub security standards, such as the AWS Foundational Best Practices and CIS benchmark, are themselves curated control mappings.

Each control corresponds to a recognized best practice, and the compliance score shows how your environment measures up. This makes Security Hub a practical bridge between AWS configuration and framework expectations.

To meet a framework: download AWS's evidence from Artifact, configure workloads with the mapped services, enforce checks with conformance packs and Security Hub, and collect evidence with Audit Manager.

Compliance is an architecture plus an ongoing process.

Find the right portal.

You learned to map controls to frameworks.

• Compliance is shared; AWS certifies infrastructure, you configure workloads.
• Artifact provides reports and agreements; Audit Manager gathers evidence.
• Conformance packs and Security Hub enable continuous compliance.