The Payment Card Industry (PCI) Data Security Standard (DSS) is an information security standard defined by the Payment Card Industry Security Standards Council. PCI certification is required for organizations (merchants and service providers) that process credit card payments. The certification is designed to prevent credit card fraud through increased controls around data and its exposure to compromise. The standard applies to all organizations which hold, process, or exchange cardholder information from any card branded with the logo of one of the card brands.

The AWS services listed below and their supporting infrastructures are PCI DSS compliant. This compliance has been validated by an authorized independent Qualified Security Assessor.

Conversely, PCI "certification" is a term reserved for those merchants who require certification to process credit card transactions. AWS, as a service provider, does not directly manage cardholder environments (and therefore, unlike merchants, does not require certification). AWS provides a secure environment that has been validated by a QSA, allowing merchants to establish a secure cardholder environment and to achieve their own certification, having confidence that their underlying technology infrastructure is compliant. Achieving PCI DSS 3.1 validation for AWS helps our customers obtain their own PCI certification.

Service provider levels are defined as:

Level 1: Any service provider that stores, processes and/or transmits over 300,000 transactions annually

Level 2: Any service provider that stores, processes and/or transmits less than 300,000 transactions annually

Our PCI Service Provider status means that customers who use our services to store, process or transmit cardholder data can rely on our PCI compliance validation for the technology infrastructure as they manage their own compliance and certification, including PCI audits and responses to incidents. Our service provider compliance covers all requirements as defined by PCI DSS for physical infrastructure service providers. Moving the cardholder environment to AWS can simplify your own PCI compliance by relying on our PCI Compliance.

Our PCI compliance further demonstrates our commitment to information security at every level. Compliance with the DSS standard, validated by an independent third-party audit, confirms that our security management program is comprehensive and follows leading practices. This validation provides more clarity and assurance for customers evaluating the breadth and strength of our security practices.

All merchants manage their own PCI certification. For the portion of the PCI cardholder environment deployed in AWS, your QSA can rely on our PCI compliance, but you will still be required to satisfy all other PCI compliance and testing requirements, including how you manage the cardholder environment that you host with AWS.

Upon request, for customers pursuing PCI certification, AWS will provide a PCI Compliance Package that includes authoritative compliance documentation from the AWS QSA. This includes the QSA’s Attestation of Compliance document and AWS PCI DSS Controls Responsibility Summary, also published by the QSA, which contains:

An Executive Summary, including a business description and the description of the in-scope environment. This content is aligned to that contained in the AWS Report on Compliance. Customer Implementation Considerations, including implementation details to be considered relevant to a PCI environment. Responsibility of PCI Requirements for a Customer’s Environment, which is a detailed matrix of PCI DSS controls and the description of responsibility for each individual control.

The content of this package aid in a customer’s PCI audit by clarifying which controls under PCI DSS are their responsibility vs. which controls are AWS’ responsibility.

The AWS PCI Compliance Package is provided to customers under NDA who request it through their business development contact. If a customer does not know their business development representative, they can contact customer support directly at http://aws.amazon.com/compliance/contact/.

No. AWS conducts PCI compliance assessments separately from other compliance initiatives. PCI assessors are not required to rely on Service Organization Control (SOC 1) reports to complete their certification evaluation or testing; AWS can provide formal PCI documentation upon request.

Yes, numerous AWS customers have successfully deployed and certified part or all of their cardholder environments on AWS. AWS does not disclose the customers who have achieved PCI certification, but does regularly work with customers and their PCI assessors in planning for, deploying, certifying, and performing quarterly scanning of a cardholder environment on AWS.

Yes, AWS is listed on both the Visa Global Registry of Service Providers and the MasterCard Compliant Service Provider List.

The Service Provider listings further demonstrate that AWS successfully validated PCI DSS compliance with an on-site assessment, based on the report of an independent QSA, and has met all applicable Visa and MasterCard program requirements. The listing also provides the name of the QSA and the Valid Through (for Visa) or Attestation of Compliance (for MasterCard) dates.

No. The AWS environment is a virtualized, multi-tenant environment. AWS has effectively implemented security management processes, PCI controls, and other compensating controls that effectively and securely segregate each customer into its own protected environment. This secure architecture has been validated by an independent QSA and was found to be in compliance with all requirements of DSS version 3.1 published in April 2015. Merchants who process, store, and/or transmit credit card data on the AWS infrastructure can be PCI compliant, including Level 1 merchants.

In February 2013, the PCI Security Standards Council released PCI DSS Cloud Computing Guidelines. These guidelines provide customers who are managing a cardholder data environment with considerations for maintaining PCI DSS controls in the cloud. AWS has incorporated the PCI DSS Cloud Computing Guidelines into the AWS PCI Compliance Package for customers. The AWS PCI Compliance Package includes the AWS PCI Attestation of Compliance (AoC), which shows that AWS has been successfully validated against standards applicable to a Level 1 service provider under PCI DSS Version 3.1, and the AWS PCI Responsibility Summary, which explains how compliance responsibilities are shared between AWS and our customers in the cloud.

No. A merchant can obtain certification without a physical walkthrough of a service provider’s data center if the service provider is Level 1 PCI compliant (such as AWS). A merchant’s QSA can rely on the work performed by our QSA, which included an extensive review of the physical security of our data centers.

Yes. AWS manages forensic investigations in alignment with DSS requirement A 1.4. Customers or their designated Qualified Incident Response Assessors (QIRA) can contact AWS as required to perform forensic investigations.

No. The entire infrastructure that supports in-scope services is compliant and there is no separate environment or special API to use. Any server or data object deployed in or using these services is in a PCI compliant environment, globally.

Yes. There are ten international regions compliant with the PCI DSS standard: US East (Northern Virginia), US West (Oregon), US West (Northern California), AWS GovCloud (US) (Oregon), EU (Ireland), EU (Frankfurt), Asia Pacific (Singapore), Asia Pacific (Tokyo), Asia Pacific (Sydney), and South America (São Paulo). These regions are included in the independent QSA validation scope. PCI is a global standard and does not change based on geography.

Yes. You can download the standard directly from the PCI Security Standards Council.