Compliance frameworks define security and operational requirements for specific industries or use cases. Cloud providers help by being compliant themselves and by providing tools that aid customer compliance, but the customer's compliance work is real and unavoidable.
This page covers the major frameworks and the cloud-specific aspects.
The most-asked-about framework. SOC 2 is an attestation about controls around security, availability, processing integrity, confidentiality, and privacy.
Two types:
Type 2 is what customers usually want.
The Trust Services Criteria — broadly:
The criteria are general; the implementation is specific to your environment. SOC 2 is more about "do you have a process and follow it" than "do you do specific things."
AWS, GCP, Azure are themselves SOC 2 compliant. They publish reports. Customers use the providers' compliance as part of their own (the controls the provider handles count toward your compliance).
Most companies use a compliance platform (Vanta, Drata, Secureframe) to automate evidence collection.
US healthcare data regulation. Required for handling Protected Health Information (PHI).
AWS, GCP, Azure offer HIPAA-eligible service lists. Sign a BAA with the provider; only use HIPAA-eligible services for PHI.
The list is not all services. Specific limitations: some services can't be used for PHI; some can with specific configurations.
HIPAA violations are expensive. Be deliberate.
Payment Card Industry Data Security Standard. Required for handling credit card data.
12 requirements covering:
Levels (1-4) based on transaction volume; higher levels need external audits.
Major clouds are PCI-compliant. Use compliant services; configure correctly.
Most modern apps avoid most PCI scope by using payment processors. The processor handles cards; you handle tokens.
EU privacy regulation. Applies if you handle EU resident data.
Major clouds offer DPAs. They're compliant as data processors; you're the controller and bear most obligations.
GDPR is broad and the EU enforcement is real (4% of global revenue penalties).
Compliance is ongoing, not one-time:
Most frameworks require ongoing monitoring, not just point-in-time audits. Tools (Vanta, Drata) automate evidence collection.
Annual or more frequent. Identify risks; document mitigations.
Every third-party service has compliance implications. Track them; renew BAAs and DPAs.
External audits annually for most frameworks. Document everything; provide evidence on request.
Frameworks evolve. SOC 2 added new criteria; GDPR has clarifications; PCI-DSS 4.0 changes things. Stay current.
Provider services that are listed as in-scope for your framework. Avoid services that aren't.
Most frameworks require audit logging. Centralize from day one; you'll need it for evidence.
Encrypt at rest and in transit by default. Some frameworks require it; even when not required, it's good practice.
Quarterly or annual reviews of who has access to what. Required by most frameworks.
Production separate from dev/staging. Required for some frameworks.