Compliance Frameworks
Complete AWS compliance checklists, best practices, and service mappings for 41 frameworks — from SOC 2 to Essential Eight.
Global & ISO
8 frameworks
ISO 27001
ISO 27001 — International standard for Information Security Management Systems (ISMS). Pavora maps AWS security findings to ISO 27001 controls for continuous compliance monitoring and audit-ready reporting.
ISO 27017
ISO 27017 — Cloud-specific security controls extending ISO 27001 for cloud providers and customers. Pavora maps AWS security findings to ISO 27017 controls for continuous compliance monitoring and audit-ready reporting.
ISO 27018
ISO 27018 — Privacy standard for protecting PII in public cloud environments. Pavora maps AWS security findings to ISO 27018 controls for continuous compliance monitoring and audit-ready reporting.
SOC 2
SOC 2 — Service Organization Control 2 — Trust Services Criteria for security, availability, and confidentiality. Pavora maps AWS security findings to SOC 2 controls for continuous compliance monitoring and audit-ready reporting.
GDPR
GDPR — EU General Data Protection Regulation — data protection and privacy for EU residents. Pavora maps AWS security findings to GDPR controls for continuous compliance monitoring and audit-ready reporting.
CSA CCM 4.0
CSA CCM 4.0 — Cloud Security Alliance Cloud Controls Matrix — comprehensive cloud security control framework. Pavora maps AWS security findings to CSA CCM 4.0 controls for continuous compliance monitoring and audit-ready reporting.
MITRE ATT&CK
MITRE ATT&CK — Adversarial tactics, techniques, and common knowledge framework mapped to cloud environments. Pavora maps AWS security findings to MITRE ATT&CK controls for continuous compliance monitoring and audit-ready reporting.
COBIT 2019
COBIT 2019 — Control Objectives for Information Technologies — enterprise IT governance and management framework. Pavora maps AWS security findings to COBIT 2019 controls for continuous compliance monitoring and audit-ready reporting.
NIST & Federal
8 frameworks
NIST CSF
NIST CSF — NIST Cybersecurity Framework 2.0 — Govern, Identify, Protect, Detect, Respond, Recover. Pavora maps AWS security findings to NIST CSF controls for continuous compliance monitoring and audit-ready reporting.
NIST 800-53
NIST 800-53 — Security and Privacy Controls for Information Systems and Organizations. Pavora maps AWS security findings to NIST 800-53 controls for continuous compliance monitoring and audit-ready reporting.
NIST 800-171
NIST 800-171 — Protecting Controlled Unclassified Information (CUI) in non-federal systems. Pavora maps AWS security findings to NIST 800-171 controls for continuous compliance monitoring and audit-ready reporting.
NIST AI RMF
NIST AI RMF — AI Risk Management Framework — governance and risk management for AI systems. Pavora maps AWS security findings to NIST AI RMF controls for continuous compliance monitoring and audit-ready reporting.
FedRAMP
FedRAMP — Federal Risk and Authorization Management Program — security assessment for federal cloud use. Pavora maps AWS security findings to FedRAMP controls for continuous compliance monitoring and audit-ready reporting.
CISA
CISA — Cybersecurity and Infrastructure Security Agency directives and binding operational directives. Pavora maps AWS security findings to CISA controls for continuous compliance monitoring and audit-ready reporting.
CMMC 2.0
CMMC 2.0 — Cybersecurity Maturity Model Certification — required for US defense contractors. Pavora maps AWS security findings to CMMC 2.0 controls for continuous compliance monitoring and audit-ready reporting.
SSDF
SSDF — Secure Software Development Framework — NIST guidelines for secure software practices. Pavora maps AWS security findings to SSDF controls for continuous compliance monitoring and audit-ready reporting.
CIS & Cloud
8 frameworks
CIS AWS v1.4
CIS AWS v1.4 — CIS AWS Foundations Benchmark v1.4 — security configuration best practices for AWS. Pavora maps AWS security findings to CIS AWS v1.4 controls for continuous compliance monitoring and audit-ready reporting.
CIS AWS v1.5
CIS AWS v1.5 — CIS AWS Foundations Benchmark v1.5 — updated AWS security baseline. Pavora maps AWS security findings to CIS AWS v1.5 controls for continuous compliance monitoring and audit-ready reporting.
CIS AWS v2.0
CIS AWS v2.0 — CIS AWS Foundations Benchmark v2.0 — expanded cloud security controls. Pavora maps AWS security findings to CIS AWS v2.0 controls for continuous compliance monitoring and audit-ready reporting.
CIS AWS v3.0
CIS AWS v3.0 — CIS AWS Foundations Benchmark v3.0 — latest AWS security baseline with modern service coverage. Pavora maps AWS security findings to CIS AWS v3.0 controls for continuous compliance monitoring and audit-ready reporting.
CIS GCP v2.0
CIS GCP v2.0 — CIS Google Cloud Platform Foundations Benchmark v2.0. Pavora maps AWS security findings to CIS GCP v2.0 controls for continuous compliance monitoring and audit-ready reporting.
AWS FSBP
AWS FSBP — AWS Foundational Security Best Practices — AWS-authored security standard. Pavora maps AWS security findings to AWS FSBP controls for continuous compliance monitoring and audit-ready reporting.
AWS WA
AWS WA — AWS Well-Architected Framework — six pillars of cloud architecture excellence. Pavora maps AWS security findings to AWS WA controls for continuous compliance monitoring and audit-ready reporting.
OWASP Cloud
OWASP Cloud — OWASP Top 10 Cloud-Native Application Security Risks. Pavora maps AWS security findings to OWASP Cloud controls for continuous compliance monitoring and audit-ready reporting.
Finance & Health
8 frameworks
PCI-DSS 4.0
PCI-DSS 4.0 — Payment Card Industry Data Security Standard v4.0 — protecting cardholder data in the cloud. Pavora maps AWS security findings to PCI-DSS 4.0 controls for continuous compliance monitoring and audit-ready reporting.
HIPAA
HIPAA — Health Insurance Portability and Accountability Act — protecting protected health information (PHI). Pavora maps AWS security findings to HIPAA controls for continuous compliance monitoring and audit-ready reporting.
FFIEC
FFIEC — Federal Financial Institutions Examination Council — IT examination handbook for financial institutions. Pavora maps AWS security findings to FFIEC controls for continuous compliance monitoring and audit-ready reporting.
SOX
SOX — Sarbanes-Oxley Act — financial reporting controls for publicly traded companies. Pavora maps AWS security findings to SOX controls for continuous compliance monitoring and audit-ready reporting.
NYDFS 500
NYDFS 500 — New York Department of Financial Services Cybersecurity Regulation. Pavora maps AWS security findings to NYDFS 500 controls for continuous compliance monitoring and audit-ready reporting.
DORA
DORA — Digital Operational Resilience Act — EU financial sector ICT risk management. Pavora maps AWS security findings to DORA controls for continuous compliance monitoring and audit-ready reporting.
RBI
RBI — Reserve Bank of India — cybersecurity framework for banks and financial institutions. Pavora maps AWS security findings to RBI controls for continuous compliance monitoring and audit-ready reporting.
GxP
GxP — Good Practice quality guidelines for pharmaceutical and life sciences regulated environments. Pavora maps AWS security findings to GxP controls for continuous compliance monitoring and audit-ready reporting.
Regional & National
9 frameworks
UK Cyber Essentials
UK Cyber Essentials — UK government-backed cybersecurity certification — basic technical controls. Pavora maps AWS security findings to UK Cyber Essentials controls for continuous compliance monitoring and audit-ready reporting.
BSI C5
BSI C5 — Cloud Computing Compliance Controls Catalogue — German BSI cloud security standard. Pavora maps AWS security findings to BSI C5 controls for continuous compliance monitoring and audit-ready reporting.
ENS
ENS — Esquema Nacional de Seguridad — Spain national security framework for eGovernment. Pavora maps AWS security findings to ENS controls for continuous compliance monitoring and audit-ready reporting.
NIS2
NIS2 — Network and Information Systems Directive 2 — EU-wide cybersecurity legislation. Pavora maps AWS security findings to NIS2 controls for continuous compliance monitoring and audit-ready reporting.
APRA CPS 234
APRA CPS 234 — Australian Prudential Regulation Authority — information security for financial sector. Pavora maps AWS security findings to APRA CPS 234 controls for continuous compliance monitoring and audit-ready reporting.
AUS ISM
AUS ISM — Australian Government Information Security Manual — cybersecurity for government systems. Pavora maps AWS security findings to AUS ISM controls for continuous compliance monitoring and audit-ready reporting.
Essential Eight
Essential Eight — Australian Signals Directorate Essential Eight — pragmatic mitigation strategies. Pavora maps AWS security findings to Essential Eight controls for continuous compliance monitoring and audit-ready reporting.
K-ISMS
K-ISMS — Korea Information Security Management System — personal information protection. Pavora maps AWS security findings to K-ISMS controls for continuous compliance monitoring and audit-ready reporting.
CCPA/CPRA
CCPA/CPRA — California Consumer Privacy Act / California Privacy Rights Act — US state privacy law. Pavora maps AWS security findings to CCPA/CPRA controls for continuous compliance monitoring and audit-ready reporting.