> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/pump-secure/security-standards-and-compliance.md). # Security Standards and Compliance Pump Secure maps its checks to 39 compliance and security frameworks. This page explains the major standards, who they apply to, and how Pump Secure helps you track compliance posture against each one. ### How Pump Secure Uses Standards Pump Secure does not certify your organization as compliant with any standard. Compliance certification requires formal audits, policy documentation, and organizational controls that extend beyond infrastructure configuration. What Pump Secure does: it continuously checks your AWS resource configurations against the technical controls specified by each standard and reports which controls pass and which fail. This gives you a real-time view of your technical compliance posture and helps you identify gaps before an audit. ### Standards by Category #### General Cloud Security **AWS Well-Architected Framework**\ The AWS Well-Architected Framework defines best practices across six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Pump Secure checks the security pillar controls. This is the default framework enabled for all Pump Secure users and provides the broadest coverage of common AWS misconfigurations. **Who needs it:** Everyone running workloads on AWS. No regulatory requirement, but widely adopted as a baseline. **CIS Controls (versions 1.4 through 6.0)**\ The Center for Internet Security (CIS) Controls are a prioritized set of actions to protect organizations and data from known cyber attack vectors. Pump Secure supports multiple versions so you can match the version required by your organization's security policy or audit scope. **Who needs it:** Organizations that follow CIS benchmarks as part of their security program. Common in enterprises, government contractors, and organizations subject to third-party security assessments. **MITRE ATT\&CK**\ MITRE ATT\&CK is a knowledge base of adversary tactics and techniques based on real-world observations. Pump Secure maps AWS configuration checks to ATT\&CK techniques, helping you understand which attack patterns your current configuration is exposed to. **Who needs it:** Security teams focused on threat-informed defense. Useful for red team/blue team exercises and threat modeling. #### Regulatory Compliance **SOC 2**\ SOC 2 (Service Organization Control 2) evaluates an organization's controls related to security, availability, processing integrity, confidentiality, and privacy. Pump Secure checks align with the Trust Services Criteria, focusing on the technical controls an auditor would evaluate. **Who needs it:** SaaS companies, cloud service providers, and any organization that handles customer data and undergoes SOC 2 audits. **HIPAA**\ The Health Insurance Portability and Accountability Act requires safeguards for protected health information (PHI). Pump Secure checks cover the technical safeguard requirements, including access controls, audit controls, integrity controls, and transmission security. **Who needs it:** Healthcare providers, health plans, healthcare clearinghouses, and their business associates that handle PHI. **PCI DSS (versions 3.2.1 and 4.0)**\ The Payment Card Industry Data Security Standard protects cardholder data. Pump Secure checks map to the technical requirements for network security, access control, vulnerability management, and monitoring. **Who needs it:** Any organization that stores, processes, or transmits credit card data. PCI 4.0 is the current version; 3.2.1 is supported for organizations still transitioning. **GDPR**\ The General Data Protection Regulation governs data protection and privacy for individuals in the EU. Pump Secure checks focus on the technical measures required for data protection, including encryption, access controls, and data integrity. **Who needs it:** Any organization that processes personal data of EU residents. #### US Government and Federal **FedRAMP (Low, Moderate, 20x KSI Low)**\ The Federal Risk and Authorization Management Program standardizes security assessment for cloud services used by US federal agencies. Pump Secure maps checks to FedRAMP baselines at different impact levels. **Who needs it:** Cloud service providers seeking FedRAMP authorization or federal agencies evaluating cloud vendor security. **NIST 800 53 (Revisions 4 and 5)**\ NIST Special Publication 800-53 provides a catalog of security and privacy controls for federal information systems. Revision 5 is the current version. Pump Secure checks map to the technical controls in this catalog. **Who needs it:** US federal agencies, government contractors, and organizations that use NIST as their control framework. **NIST Cybersecurity Framework (CSF 1.1 and 2.0)**\ The NIST CSF provides a voluntary framework for managing cybersecurity risk. It is organized around five functions: Identify, Protect, Detect, Respond, and Recover. Pump Secure checks map to the Protect and Detect functions. **Who needs it:** Any organization looking for a structured approach to cybersecurity risk management. Widely adopted across industries. **CISA**\ The Cybersecurity and Infrastructure Security Agency publishes best practices for securing critical infrastructure. Pump Secure checks align with CISA's technical guidance. **Who needs it:** US critical infrastructure operators and organizations following federal cybersecurity guidance. #### Financial Services **FFIEC**\ The Federal Financial Institutions Examination Council provides IT security standards for financial institutions regulated by US banking agencies. **Who needs it:** US banks, credit unions, and financial institutions subject to federal examination. **Reserve Bank of India (RBI)**\ The RBI publishes information security guidelines for banks and financial institutions operating in India. **Who needs it:** Financial institutions regulated by the Reserve Bank of India. #### International and Regional **Esquema Nacional de Seguridad (ENS)**\ Spain's national security framework for public administration and organizations providing services to the Spanish public sector. **Who needs it:** Organizations operating in or providing services to Spanish government entities. **KISA ISMS-P 2023**\ The Korea Internet & Security Agency's information security management system certification standard. Available in both English and Korean. **Who needs it:** Organizations operating in South Korea or seeking KISA certification. **SecNumCloud 3.2**\ The French ANSSI (National Cybersecurity Agency) qualification framework for cloud service providers. **Who needs it:** Cloud providers seeking French government security qualification. **Cloud Computing Compliance Criteria Catalogue (C5)**\ The German Federal Office for Information Security (BSI) standard for cloud security. **Who needs it:** Organizations providing cloud services in Germany or to German government entities. #### Cloud Security Frameworks **CSA Cloud Controls Matrix (CCM) 4.0**\ The Cloud Security Alliance's control framework for cloud computing, organized into 17 domains covering everything from application security to supply chain management. **Who needs it:** Organizations seeking alignment with CSA best practices or preparing for CSA STAR certification. **Common Cloud Controls (CCC)**\ A cross-cloud security control framework designed to provide consistent security evaluation across different cloud providers. **Who needs it:** Multi-cloud organizations looking for a unified control framework. #### Healthcare and Life Sciences **GxP Title 21 CFR Part 11**\ US FDA regulations governing electronic records and electronic signatures in pharmaceutical and medical device manufacturing. **Who needs it:** Pharmaceutical companies, medical device manufacturers, and biotech firms subject to FDA oversight. **GxP EU Annex 11**\ EU GMP Annex 11 requirements for computerized systems used in pharmaceutical manufacturing. **Who needs it:** Pharmaceutical manufacturers operating under EU GMP regulations. ### Reading Your Compliance Results For each active framework, the Pump Secure dashboard shows: | Element | What it means | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- | | Pass/Fail badge | Whether any checks under this framework have failed. "Passed" means all checks passed. "Failed" means at least one check failed. | | Percentage score | The percentage of checks that passed. A score of 97% means 97% of applicable checks passed. | | Findings breakdown | In the findings table, the "Frameworks affected" column shows which active frameworks each failed check maps to. | A high score on one framework does not guarantee a high score on another. Frameworks vary in scope and strictness. An account that scores 97% on AWS Well-Architected may score 65% on HIPAA because HIPAA includes controls that the Well-Architected Framework does not cover. ### Limitations Pump Secure evaluates **technical infrastructure controls only**. Most compliance standards also require: | Compliance area | What Pump Secure does not cover | | ----------------------- | ----------------------------------------------------------------------- | | Organizational policies | Written security policies, incident response plans, employee handbooks | | Process controls | Change management procedures, access review cadences, vendor management | | Physical security | Data center access, device management, physical media handling | | Training | Security awareness training, role-based training programs | | Audit artifacts | Evidence collection, control narratives, management assertions | Use Pump Secure findings as one input to your compliance program, not as a substitute for the full program. #### **Additional Review** **AWS AI Readiness Assessment** Alongside the Pump Secure compliance frameworks, Pump can run an AI readiness assessment for customers building or planning generative AI and ML workloads on AWS. This maps to AWS's own guidance for AI workloads: the AWS Well-Architected Generative AI Lens and Machine Learning Lens, which extend the standard Well-Architected Framework Review across all six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability) with AI-specific best practices covering model selection, data architecture, prompt engineering, and responsible AI. Pump maps its checks to the relevant lens controls and reports pass/fail status the same way it does for other frameworks, giving customers a clear view of whether their AWS environment (IAM scoping, data handling, encryption, logging, Bedrock/SageMaker configuration, etc.) is ready to support AI workloads before they scale usage. **Who needs it:** Any organization building, evaluating, or scaling generative AI or ML workloads on AWS — including teams using Bedrock, SageMaker, or self-hosted foundation models. It's especially relevant for teams past the prototype stage and moving toward production, since that's typically when gaps in data governance, model access controls, and cost/scaling architecture start to matter. No regulatory body mandates this the way SOC 2 or HIPAA audits do, but it's increasingly expected by risk and compliance stakeholders — and often by customers or investors doing diligence on a company's AI usage — as evidence that AI systems were built on a reviewed architectural foundation rather than assembled ad hoc. For more information and to be connected to a Pump Solutions Architect, reach out to your Pump Account Manager or . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.pump.co/pump-secure/security-standards-and-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.