Compliance

Last reviewed: August 2026

Overview

Compliance in the cloud follows a shared responsibility model, dividing accountability between vendor and user. Vendors get their infrastructure layer’s security controls certified, while users must ensure their workload configurations meet regulatory requirements.

Compliance by Country

Public procurement certifications, personal data protection laws, and industry-specific regulations vary by country and region, directly affecting architectural decisions such as region selection, data residency, and isolation level. Country-specific details are covered in the relevant country document.

Korea — ISMS-P, CSAP, financial-sector/network segregation, sovereign FM: Korea overview · Compliance (Korea)
United States — FedRAMP, HIPAA, ITAR/EAR, state privacy laws, AI policy: US overview
EU — GDPR and data sovereignty, DORA, NIS2 and the AI Act, member-state schemes, sovereign AI: EU overview
Japan — ISMAP, APPI, Government Cloud, AI landscape: Japan overview
Singapore — MTCS, PDPA, GCC/IM8, AI governance: Singapore overview

Major International Certifications

ISO/IEC 27001:2022 — Information Security Management System

An international standard for information security management. Most global CSPs hold this by default. The 2022 revision is the current standard; certificates for the prior 2013 version expired on October 31, 2025. Organizations that haven’t yet transitioned to the 2022 version must obtain new certification (or transition recertification).

Key changes: controls were restructured from 114 to 93, with 11 new controls added, including “threat intelligence,” “cloud service security,” and “data masking.”

ISO/IEC 42001 — AI Management System

An international standard management system certification for the development and operation of AI systems. It provides a framework for responsible AI governance.

OCI’s AI services (Enterprise AI, AI Services) obtained ISO/IEC 42001 certification in June 2026
Oracle Cloud Compliance

SOC 1 / SOC 2 / SOC 3

Audit reports based on AICPA (American Institute of Certified Public Accountants) standards, frequently requested by enterprise customers.

SOC 1 — financial reporting controls
SOC 2 — security, availability, processing integrity, confidentiality, privacy
SOC 3 — public summary version of SOC 2

Each vendor’s SOC reports are confidential materials, downloaded after a customer agreement through channels such as AWS Artifact or the Azure Service Trust Portal.

Industry-specific regulations

Industry	Key regulation	Applicable region	Notes
Healthcare	HIPAA, HITRUST	United States
Card payments	PCI DSS v4.0.1	Global	v4.0 (2024-03-31, superseding v3.2.1) → v4.0.1 (2024-06 errata). As of 2025-03-31, all –50 previously “future-dated” v4.0 requirements are mandatory
Public sector (US)	FedRAMP / FedRAMP 20x	US federal	20x: an automation-first process that shortens months-long manual authorization into OSCAL-based, machine-readable evidence and automated verification (fedramp.gov/20x)
Public sector (EU)	C5 (Germany), ENS (Spain), etc.	EU
Privacy (EU)	GDPR	EU
AI (EU)	EU AI Act	EU	GPAI obligations applied 2025-08-02; sanction powers and Article 50 transparency obligations took effect 2026-08-02 (synthetic-content marking has a grace period until 2026-12-02 for systems already on the market). High-risk AI deferred by Digital Omnibus — standalone 2027-12-02, product-embedded 2028-08-02. Full text
Finance (EU)	DORA	EU	Applicable since 2025-01-17. CTPP (Critical Third-Party Provider) designation process ongoing. Details

Check each vendor’s certification status on their AWS Compliance Programs, Azure Trust Center, Google Cloud Compliance, and Oracle Cloud Compliance pages.

Vendor Compliance Hubs

The full list of certifications and how to access reports is managed at each vendor’s official hub.

Vendor	Hub
AWS	AWS Compliance Programs, AWS Artifact (reports)
Azure	Microsoft Trust Center, Service Trust Portal
Google Cloud	Google Cloud Compliance Resource Center, Google Compliance Reports Manager
OCI	Oracle Cloud Compliance

How Compliance Is Operated in the Cloud

The core of an audit isn’t the certification itself but how controls are maintained in day-to-day operations.

1. Automate guardrails

Manual management leads to gaps, so policies should be codified as IaC.

Vendor	Tools
AWS	AWS Config, AWS Security Hub, SCP (Service Control Policy)
Azure	Azure Policy, Microsoft Defender for Cloud
Google Cloud	Organization Policy, Security Command Center
OCI	OCI Security Zones, OCI Cloud Guard

2. Audit trails

Log every change as an audit record and retain it long-term in a central repository.

Vendor	Audit logs
AWS	AWS CloudTrail
Azure	Azure Monitor Activity Log
Google Cloud	Cloud Audit Logs
OCI	OCI Audit

3. Access control and least privilege

Least privilege, MFA, and key rotation are covered in IAM and Access Control.

4. Data protection

5. Continuous monitoring

Rather than aligning controls only around audit time, run an ongoing detection system. All major vendors offer a compliance dashboard.

AWS Security Hub — automated checks against CIS Benchmark, NIST, PCI DSS. Covered in detail in Security Posture Management
Azure Defender for Cloud — Secure Score plus automated compliance standard assessment
Google Cloud Security Command Center — compliance framework mapping
OCI Cloud Guard — automatic misconfiguration detection

Reader Checklist

Things to verify when considering compliance in a multi-cloud environment:

Has sensitivity classification of the data you process/store been completed? (personal information, financial information, confidential information, etc.)
Have you identified the legal requirements that apply to that data? (applicable jurisdiction(s))
Does the vendor you intend to use hold the necessary certifications in that region?
Have you clearly defined user responsibilities under the shared responsibility model?
Have you automated day-to-day operational controls such as audit logging, access control, and encryption?
Is unified auditing possible across a multi-cloud environment? (watch for fragmentation across individual vendor dashboards)

Ongoing Practices

Manage certification renewal cycles — most certifications run on a 3-year validity period with an annual follow-up or surveillance audit (e.g., ISO 27001). For country-specific certification cycles, see the country guides, and add renewal dates to your calendar.
Continuous compliance — instead of manual checks, use AWS Config, Azure Policy, or Google Cloud Organization Policy to detect policy violations in real time.
Policy drift detection — regularly check for differences between IaC and the actual environment to maintain compliance status.

Common Mistakes

Relying solely on vendor certification while neglecting user responsibilities — even if the vendor holds ISO 27001 or similar certification, VPC, IAM, and encryption configuration remain the user’s responsibility and will be flagged in an audit
Aligning controls only at audit time and letting drift accumulate otherwise — cleaning up only right before the annual review lets compliance violations accumulate in daily operations
Applying uniform security levels to all data without classification — over-protection drives costs up, while under-protection creates regulatory violations

Checklist

Have you completed sensitivity classification (personal information, financial information, confidential information) of the data you process/store?
Are you running continuous compliance with real-time policy violation detection via AWS Config, Azure Policy, or similar tools?
Are certification renewal schedules (ISO 27001 surveillance audits and country-specific certifications) registered and managed on a calendar?

References

Country regulators and local certification links live in the Korea, United States, EU, Japan, and Singapore guides.