How does AWS Comply to the Cloud Security Principles listed in UK NCSC Cloud Security Guidance

AWS complies with the UK NCSC's 14 Cloud Security Principles through a shared responsibility model, where AWS is responsible for the security of the cloud, while customers are responsible for security in the cloud.

AWS has designed and manages its infrastructure in alignment with best security practices and various IT security standards that map to the NCSC Cloud Security Principles. AWS provides detailed information about how it fulfills its responsibility for cloud security in the companion whitepaper "Using AWS in the Context of NCSC UK's Cloud Security Principles."

For specific principles, AWS implements various controls:

1. Data in transit protection: AWS enables encryption for services like Elastic Load Balancing, API Gateway, OpenSearch Service, Redshift, and S3.

2. Asset protection and resilience: AWS implements encryption for CodeBuild artifacts, DynamoDB tables, EBS volumes, Kinesis Streams, and enables backups and replication for various services.

3. Operational security: AWS provides capabilities for logging, monitoring, and secure management through services like CloudTrail, CloudWatch, and GuardDuty.

4. Secure user management: AWS implements IAM-related controls to enforce principles of least privilege and multi-factor authentication.

5. External interface protection: AWS provides capabilities to restrict public access, enable VPC isolation, and manage network traffic.

AWS also complies with numerous international security standards and certifications including SOC 1/ISAE 3402, SOC 2, SOC 3, FISMA, DIACAP, FedRAMP, PCI DSS Level 1, ISO 9001, ISO 27001, ISO 27017, and ISO 27018, which overlap with many of the NCSC principles.

AWS provides conformance packs through AWS Config that map to the NCSC Cloud Security Principles, helping customers implement the appropriate controls on their side of the shared responsibility model.
Sources
Implement controls - Using AWS in the Context of NHS Cloud Security Guidance
Operational Best Practices for NCSC Cloud Security Principles - AWS Config
Using AWS in the Context of NHS Cloud Security Guidance - Using AWS in the Context of NHS Cloud Security Guidance
Security and compliance - Overview of Amazon Web Services