Amazon Web Services completes CCAG 2022 pooled audit by European FSI customers

We are excited to announce that Amazon Web Services (Amazon Web Services) has completed its annual Collaborative Cloud Audit Group (CCAG) Cloud Community audit with European financial service institutions (FSIs).

Security at Amazon Web Services is the highest priority. As customers embrace the scalability and flexibility of Amazon Web Services, we are helping them evolve security, identity, and compliance into key business enablers. At Amazon Web Services, we are obsessed with earning and maintaining customer trust, and providing our FSI customers and their regulatory bodies with the assurance that Amazon Web Services has the necessary controls in place to protect their most sensitive material and regulated workloads. The Amazon Web Services Compliance Program helps customers understand the robust controls that are in place at Amazon Web Services. By tying together governance-focused, audit-friendly service features with applicable compliance or audit standards, Amazon Web Services Compliance helps customers to set up and operate in an Amazon Web Services security control environment.

An example of how Amazon Web Services supports customers’ risk management and regulatory efforts is our annual audit engagement with the CCAG. For the fourth year, the CCAG pooled audit thoroughly assessed the Amazon Web Services controls that enable us to help protect our customers’ data and material workloads, while satisfying strict European and national regulatory obligations. CCAG currently represents more than 50 leading European FSIs and has grown steadily since its inception in 2017. Given the importance of cloud computing for the operations of FSI customers, the financial industry is coming under greater regulatory scrutiny. Similar to prior years, the CCAG 2022 audit was conducted based on customers’ right to conduct an audit of their service providers under European Banking Authority (EBA) outsourcing recommendations to cloud service providers (CSPs) . The EBA suggests using pooled audits to use audit resources more efficiently and to decrease the organizational burden on both the clients and the CSP. Figure 1 illustrates the improved cost-effectiveness of pooled audits as compared to individual audits.

Figure 1: Efforts and costs are shared and reduced when a collaborative approach is followed

CCAG audit process

Although there are many security frameworks available, CCAG uses the Cloud Controls Matrix (CCM) of the Cloud Security Alliance (CSA) as the framework of reference for their CSP audits. The CSA is a not-for-profit organization with a mission , as stated on its website, to “promote the use of best practices for providing security assurance within cloud computing, and to provide education on the uses of cloud computing to help secure all other forms of computing.” CCM is specifically designed to provide fundamental security principles to guide cloud vendors and to assist cloud customers in assessing the overall security risk of a cloud provider.

Between February and December 2022, CCAG audited the Amazon Web Services controls environment by following a hybrid approach, remotely and onsite in Seattle (USA), Dublin (IRL), and Frankfurt (DEU). For the scope of the 2022 CCAG audit, the participating auditors assessed Amazon Web Services measures with regards to (1) keeping customer data sovereign, secure, and private , (2) effectively managing threats and vulnerabilities, (3) offering a highly available and resilient infrastructure , (4) preventing and responding rapidly to security events, and (5) enforcing strong authentication mechanisms and strict identity and access management constraint conditions to grant access to resources only under the need-to-know and need-to-have principles.

The scope of the audit encompassed individual services provided by Amazon Web Services, and the policies, controls, and procedures for (and practice of) managing and maintaining them. Customers will still need to have their auditors assess the environments they create by using these services, and their policies and procedures for (and practices of) managing and maintaining these environments, on their side of the shared responsibility lines of demarcation for the Amazon Web Services services involved.

CCAG audit results

CCAG members expressed their gratitude to Amazon Web Services for the audit experience:

“The Amazon Web Services Security Assurance team provided CCAG auditors with the needed logistical and technical assistance, by navigating the Amazon Web Services organization to find the required information, performing advocacy of the CCAG audit rights, creating awareness and education, as well as exercising constant pressure for the timely delivery of information.”

The results of the CCAG pooled audit are available to the participants and their respective regulators only, and provide CCAG members with assurance regarding the Amazon Web Services controls environment, enabling members to work to remove compliance blockers, accelerate their adoption of Amazon Web Services services, and obtain confidence and trust in the security controls of Amazon Web Services.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact Amazon Web Services Support .

Want more Amazon Web Services Security news? Follow us on Twitter .