Question

A healthcare startup must confirm that AWS meets specific regulatory attestations (such as HIPAA and SOC) before storing patient data. The compliance officer wants an authoritative, self-service way to understand which AWS services and Regions are covered by these third-party audit programs. Which statement about AWS compliance programs is accurate and helps the officer proceed?

Accepted Answer

AWS undergoes independent third-party audits and publishes the resulting attestations and certifications, which customers can reference to validate that the AWS infrastructure meets specific compliance programs.

Answer

AWS transfers full responsibility for achieving all regulatory certifications to the customer, so the startup must independently audit AWS data centers.

Answer

Compliance certifications apply uniformly to every AWS service in all Regions, so no verification of service or Region scope is ever necessary.

Answer

AWS compliance attestations are only valid if the customer purchases AWS Shield Advanced and enables it across the account.