ISO AWS refers to the set of ISO and IEC certifications that Amazon Web Services holds for its infrastructure and services, covering information security, privacy, cloud security, business continuity, service management and quality. These certificates prove that AWS runs a managed security programme, but they do not make your own organisation ISO certified. Therefore, anyone who builds on AWS must still define their own scope, implement their own controls and pass their own audit.
This article explains which standards AWS holds, what a certificate truly covers, where your responsibilities begin, and how European businesses can reason about the data residency question that sits behind many ISO conversations.
Which ISO certifications does AWS hold?
AWS holds certifications for ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019, 22301:2019, 20000-1:2018 and 9001:2015, together with the CSA STAR CCM v4.0 attestation, according to the AWS ISO certified overview. Each standard addresses a different risk area.
| Standard | Focus | Why it matters to a customer |
|---|---|---|
| ISO/IEC 27001:2022 | Information security management system | Baseline evidence of a managed security programme |
| ISO/IEC 27017:2015 | Cloud-specific security controls | Clarifies provider and customer duties in the cloud |
| ISO/IEC 27018:2019 | Protection of personal data in public clouds | Supports privacy assessments |
| ISO/IEC 27701:2019 | Privacy information management | Links security controls to privacy obligations |
| ISO/IEC 22301:2019 | Business continuity | Evidence of resilience planning |
| ISO/IEC 20000-1:2018 | IT service management | Evidence of structured service delivery |
| ISO 9001:2015 | Quality management | Evidence of consistent processes |
In addition, the CSA STAR CCM v4.0 entry shows alignment with the Cloud Security Alliance control framework, which some procurement teams request alongside ISO documents.
What does it mean when a company is ISO certified?
A company is ISO certified when an independent, accredited body has audited its management system against a published standard and confirmed that it conforms. The certificate is evidence of process and control maturity, not a guarantee that incidents will never occur.
For ISO/IEC 27001, the audited object is the information security management system, usually shortened to ISMS. AWS states that its ISO/IEC 27001:2022 certification is based on an ISMS and is performed by independent third-party auditors, as described in the AWS ISO/IEC 27001:2022 FAQ. The same source identifies EY CertifyPoint as the verifier and notes that the certifier is accredited by the Dutch Accreditation Council, a member of the International Accreditation Forum.
The audit process itself follows a recognised pattern. The audit process typically includes two stages, followed by surveillance audits and recertification within a certification cycle, which commonly runs for three years. Consequently, a valid certificate always has a scope, an issue date, an expiry date and a named certification body. Readers who want the fundamentals first can consult vBoxx's explanation of what ISO 27001 is and why it matters for business security.
What does an AWS ISO certificate cover, and what does it not?
An AWS ISO certificate covers a defined set of services, Regions and data centres, and nothing beyond that scope. AWS itself states that its ISO/IEC 27001:2022 certification applies to a specified scope, with the covered Regions and services listed in its certification materials.
This has three practical consequences:
- Service scope. A service that is not named in the certificate is not covered by it, even if other services in the same Region are.
- Regional scope. A Region absent from the certificate falls outside the claim.
- Layer scope. The certificate addresses the infrastructure and operations that AWS controls. It says nothing about how you configure identity, encryption, logging or network rules in your own account.
In other words, the certificate is an input to your risk assessment, not a substitute for one. The document is a point-in-time statement, so you should always check the issue and expiry dates before attaching it to a tender or a supplier questionnaire.
Does AWS ISO certification make my organisation ISO certified?
No, AWS ISO certification does not make your organisation certified. Under the shared responsibility model, AWS certifies its part of the stack, and you remain accountable for yours.
AWS makes this explicit in its March 2026 guide. The AWS Security Blog states that customers remain responsible for defining their ISMS scope, implementing controls and demonstrating conformity during certification audits. The same guide covers clauses 4 to 10 and selected Annex A controls, and discusses mapping controls to AWS services, evidence collection and audit readiness.
What you can inherit and what you must own is easiest to see side by side:
- Inherited from AWS: physical security of data centres, hardware lifecycle, and the operation of the underlying virtualisation layer.
- Owned by you: user access management, data classification, encryption key handling, patching of your own workloads, incident response procedures and staff awareness.
- Shared in practice: logging, monitoring and backup, where AWS provides the tooling but you decide how it is configured and reviewed.
Therefore, an auditor will ask you for your own risk register, your own Statement of Applicability and your own evidence, even when your workloads run on a certified provider.
How to use AWS ISO certificates in your own compliance work
You can use AWS ISO certificates as supplier evidence inside your own ISMS, provided you record what you relied on and why. A structured approach keeps the audit conversation short.
- Download the current certificate and scope statement. Confirm the services and Regions you use appear in the scope.
- Record the supplier in your register. Note the certificate number, certification body, validity dates and the controls you inherit from it.
- Map controls to services. Match each Annex A control you claim to the AWS service or internal procedure that satisfies it.
- Collect your own evidence. Configuration exports, access reviews, change records and incident logs belong to you.
- Review on a schedule. Check the certificate again at each renewal and at every annual supplier review.
In addition, technical hardening topics often appear in audit findings. Related reading on this subject includes vBoxx's material on AWS patch management and AWS penetration testing, both of which illustrate where customer responsibility starts. Organisations that need an external view of security risk may also consult a specialist such as Alma Risk, a UK security consultancy offering risk management and protective services.
What a certificate cannot tell you: jurisdiction and data residency
An ISO certificate cannot tell you which legal system can compel access to your data. This is the question that many European buyers eventually reach, and it sits outside the scope of any security management standard.
ISO/IEC 27001 audits whether controls are designed and operated. It does not assess foreign legal reach, for example the US CLOUD Act, which can apply to providers headquartered in the United States regardless of where servers are located. Nevertheless, a GDPR-focused organisation must weigh this factor alongside technical security, since data protection law concerns lawful access as much as encryption.
Several questions help separate the two concerns:
- Which entity owns and operates the data centres?
- Are data, metadata, backups and support tooling all kept within the EU?
- Which legal jurisdiction applies to the provider and its parent company?
- Is a data processing agreement available on request?
vBoxx addresses this from a different starting point. Its infrastructure is in-house, hosted in EU-owned and EU-operated data centres in the Netherlands, and data, metadata, backups and support tooling remain inside the EU. A data processing agreement is available on request. For a closer look at how certification and location interact, see vBoxx's page on ISO 27001 and data residency. Likewise, the discussion of AWS data centre security provides useful context on what physical certification does and does not settle.
How to prepare for an audit when your workloads run on AWS
Audit preparation on AWS comes down to proving that your controls operate consistently over time, with evidence that is easy to retrieve. Teams that treat evidence as a continuous task, rather than a pre-audit scramble, tend to pass with fewer findings.
Start with a clear scope statement. Decide which accounts, applications and business units fall inside the ISMS, and document the boundary. Subsequently, link each in-scope asset to an owner and a risk assessment, because auditors normally sample from that list.
Next, focus on the controls that most often produce findings in cloud environments:
- Access control: documented joiner, mover and leaver procedures, plus periodic access reviews.
- Data loss prevention: classification rules and technical safeguards, as discussed in vBoxx's article on data loss prevention on AWS.
- Monitoring and response: defined alerting, a tested incident procedure and, where relevant, managed detection and response, which vBoxx covers in its note on AWS MDR.
- Credential hygiene: enforced password policy and a managed vault rather than shared spreadsheets.
Finally, remember the certification cycle. After the initial two-stage audit, surveillance audits follow during the three-year period, so evidence collection should continue throughout that time. Organisations in regulated sectors sometimes add an independent compliance monitoring partner, for instance Holistic Compliance Management Solutions, which provides compliance and training services to financial service providers.
Alternatives to relying on a hyperscaler certificate
A hyperscaler certificate is one input among several, and a smaller European provider with its own ISO 27001 certification can meet the same assurance need while offering a simpler jurisdictional position. The choice depends on workload type, team size and regulatory exposure.
For a small or mid-sized business, the practical differences often look like this:
- Complexity: a hyperscaler offers broad services but requires careful configuration to stay inside the certified scope. A focused provider offers fewer services with simpler operation.
- Support: vBoxx provides personal support, and its infrastructure is operated in-house.
- Track record: vBoxx has over 20 years of experience, more than 50,000 active end users and over 150 partners. It was also awarded best cloud services company in the Netherlands 2025 by Global 100.
- Migration: free migration services reduce the effort of moving from an existing platform.
Many organisations only need a few capabilities: file storage and sharing, email and calendar, a password vault, backups and a few servers. These are covered by vBoxxCloud, vBoxxConnect and vBoxxVault, as well as virtual and dedicated servers and backup for Microsoft 365 and Google Workspace. For specific hosting needs such as Apple hardware, there is also Mac mini hosting in Europe.
Web presence is a related consideration. If your compliance work extends to customer-facing sites and campaigns, a development partner such as Black Phoenix can build websites and web shops with security and conversion in mind.
What is an AWS certification, and is it the same as an ISO certificate?
An AWS certification is a personal credential awarded to an individual who passes an AWS exam, whereas an ISO certificate is an organisational attestation about a management system. The two are unrelated, although the search term "iso aws" often leads people to confuse them.
Personal AWS credentials show that a professional understands the platform. They have no bearing on whether your company meets ISO/IEC 27001. Consequently, hiring a certified engineer helps you configure AWS well, yet it does not replace an ISMS, an internal audit or an external certification audit.
FAQ
How long is an ISO 27001 certificate valid?
An ISO 27001 certificate is typically valid for three years, subject to surveillance audits. During that period the certification body performs surveillance audits, and a recertification audit is required before the cycle ends.
Can I show an AWS ISO certificate to my own customers?
You can reference it as evidence that a supplier in your chain is certified, but you cannot present it as your own certification. Customers will usually ask for your own scope, Statement of Applicability and the dates of your most recent audit.
Does ISO certification guarantee GDPR compliance?
No, ISO 27001 and GDPR are separate frameworks. The standard supports many GDPR security obligations, but GDPR also requires a lawful basis for processing, data subject rights handling and a data processing agreement with suppliers.
Your next step is to list the services and Regions you currently use, then check each against the supplier's current certificate scope and expiry date. If you would rather keep storage, communication, passwords and backups with a European provider that runs its own ISO 27001-certified infrastructure in the Netherlands, vBoxx offers personal support and free migration, and you can get a free trial to see how it fits your own compliance requirements.
