Retrieving Compliance Reports with AWS Artifact - Audit Response and Agreement Management
Learn how to retrieve SOC, PCI DSS, and ISO audit reports on demand and apply BAA and GDPR DPA agreements across your entire AWS Organizations structure.
Overview of Artifact
Artifact is a service that provides on-demand access to AWS compliance reports and agreements. When your compliance audit requires evidence of AWS's security controls, you can download SOC reports and ISO certificates from Artifact and submit them to your auditors. BAA and GDPR DPA agreements can also be applied across your entire Organizations structure at once.
Reports and Agreement Management
Artifact Reports provides over 50 types of compliance reports, including SOC 1 (internal controls over financial reporting), SOC 2 (security, availability, and confidentiality), PCI DSS AOC (Payment Card Industry compliance attestation), and ISO 27001 certificates. Artifact Agreements lets you electronically sign BAA (Business Associate Agreements required for HIPAA compliance) and NDA agreements. When you sign an organization agreement from the Organizations management account, it is automatically applied to all member accounts.
Using Reports for Audit Response
Reports available through Artifact Reports span a wide range, including SOC 1/2/3, PCI DSS, ISO 27001/27017/27018, FedRAMP, and HIPAA. When auditors request evidence of AWS's security controls, you download the relevant report and submit it. Some reports require agreement to an NDA (Non-Disclosure Agreement), which you accept electronically at the time of download. Artifact Agreements lets you apply BAA (Business Associate Agreement) and GDPR DPA (Data Processing Addendum) across your entire Organizations structure, eliminating the need for per-account agreement management. Reports are updated periodically, so you should retrieve the latest versions in time for your audit schedule. You can also find detailed coverage of Artifact in related books on Amazon.
Artifact Pricing and Operations
Artifact is free to use. There are no additional charges for downloading reports or managing agreements. From the Organizations management account or a delegated administrator account, you can centrally manage agreements for all member accounts. As an audit response workflow, standardize the process of creating a list of required reports aligned with your annual audit schedule, downloading the latest versions from Artifact, and providing them to your audit team. Under the AWS Shared Responsibility Model, Artifact reports serve as evidence of AWS-side controls; user-side controls must be documented separately.
Summary
Artifact is a free service that provides on-demand access to AWS compliance reports and agreements. You can download audit reports such as SOC 1/2/3, PCI DSS, and ISO 27001 to submit to auditors, and apply BAA and GDPR DPA across your entire Organizations structure, significantly reducing the effort required for audit response.