Compliance and security on AWS

Since 2012, AWS has leveraged Coalfire’s expertise to help ease your security burden in meeting numerous compliance guidelines. Coalfire provides educational resources to the AWS ecosystem of partners, clients, and prospects on how to leverage AWS’ security investment and what they each need to do.

Coalfire has supported AWS on such compliance frameworks as:

• FedRAMP®: Supported AWS’ initiatives with FedRAMP in both the Agency Authority to Operate (ATO) and FedRAMP® Joint Authorization Board (JAB) Provisional ATO (P-ATO) process for GovCloud and U.S. East/West Regions. This included the formal assessment of the cloud environment and services contained within the authorization boundary to meet FedRAMP requirements.
• DoD SRG: Assessed the organization for Impact Level II authorization, conducting technical testing, privacy review, and controls assessment.

• PCI DSS: Audited to PCI DSS, resulting in a report on compliance (ROC) for various services. This ensures the cardholder data environment (CDE) met compliance through their efforts to increase security around the CDE.
• HITRUST CSF: Worked closely with AWS to successfully assess and certify 74 services across a broad range of AWS offerings and supporting infrastructure within the HITRUST CSF framework. The full assessment project was completed in only 90 days.
• Penetration testing: Identified and exploited critical vulnerabilities, and then provided remediation guidance, which demonstrated that AWS’ network and information assets were protected from threats. These penetration tests were conducted as part of compliance requirements and standalone proactive testing initiatives.