Question

A financial services company must produce quarterly evidence packages mapped to the PCI DSS control framework for external auditors. The security team already uses AWS Config rules across all accounts in an AWS Organizations setup. Auditors require a repeatable, framework-organized collection of evidence (configuration snapshots, compliance check results, and CloudTrail activity) that maps individual controls to the underlying AWS resource data, with the ability to delegate manual attestation for controls that AWS services cannot automatically assess. Which approach best meets these requirements with the least custom development?

Accepted Answer

Deploy AWS Audit Manager with the prebuilt PCI DSS framework, enabling it to collect evidence automatically from AWS Config, CloudTrail, and other sources while allowing manual evidence uploads for controls requiring attestation.

Answer

Deploy an AWS Config conformance pack aligned to PCI DSS across the organization and export the compliance scores to an S3 bucket for auditors to review.

Answer

Enable the Security Hub PCI DSS standard in all accounts and use the security score dashboard as the evidence package for auditors.

Answer

Build a custom Lambda solution that queries Config, CloudTrail, and Security Hub APIs, then compiles the results into framework-mapped reports stored in S3.