AWS renews PCI DSS and PCI 3DS compliance, expands scope to new services and region

AWS Renews Key Payment Certifications

Amazon Web Services (AWS) has completed the renewal of its Payment Card Industry Data Security Standard (PCI DSS) and Three Domain Secure (PCI 3DS) certifications. These certifications are crucial for organizations that process, store, or transmit credit card information.

Expanded Scope for Compliance

As part of this renewal, AWS has expanded the scope of its compliance to include three additional AWS services. The Asia Pacific (New Zealand) region has also been added to the certified scope. This expansion allows customers in these new areas and using these services to maintain compliance when handling payment card data.

Compliance Resources for Customers

The PCI DSS and PCI 3DS compliance packages provide an Attestation of Compliance (AOC), which validates AWS against the standards, and an AWS Responsibility Summary. The Responsibility Summary guides customers on their role in securing payment card data on AWS. These resources are accessible through AWS Artifact, a self-service portal for compliance reports.

Third-Party Validation

AWS's compliance was evaluated by Coalfire, a third-party Qualified Security Assessor (QSA). This independent assessment confirms that AWS meets the necessary security standards for handling payment card information.

Impact on Regulated Workloads

This refreshed certification offers customers increased flexibility in deploying regulated workloads. By expanding the compliant services and regions, AWS aims to reduce the compliance overhead for customers operating within the payment card industry.