Security Standards and Compliance
Pump Secure maps its checks to 39 compliance and security frameworks. This page explains the major standards, who they apply to, and how Pump Secure helps you track compliance posture against each one.
How Pump Secure Uses Standards
Pump Secure does not certify your organization as compliant with any standard. Compliance certification requires formal audits, policy documentation, and organizational controls that extend beyond infrastructure configuration.
What Pump Secure does: it continuously checks your AWS resource configurations against the technical controls specified by each standard and reports which controls pass and which fail. This gives you a real-time view of your technical compliance posture and helps you identify gaps before an audit.
Standards by Category
General Cloud Security
AWS Well-Architected Framework The AWS Well-Architected Framework defines best practices across six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Pump Secure checks the security pillar controls. This is the default framework enabled for all Pump Secure users and provides the broadest coverage of common AWS misconfigurations.
Who needs it: Everyone running workloads on AWS. No regulatory requirement, but widely adopted as a baseline.
CIS Controls (versions 1.4 through 6.0) The Center for Internet Security (CIS) Controls are a prioritized set of actions to protect organizations and data from known cyber attack vectors. Pump Secure supports multiple versions so you can match the version required by your organization's security policy or audit scope.
Who needs it: Organizations that follow CIS benchmarks as part of their security program. Common in enterprises, government contractors, and organizations subject to third-party security assessments.
MITRE ATT&CK MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations. Pump Secure maps AWS configuration checks to ATT&CK techniques, helping you understand which attack patterns your current configuration is exposed to.
Who needs it: Security teams focused on threat-informed defense. Useful for red team/blue team exercises and threat modeling.
Regulatory Compliance
SOC 2 SOC 2 (Service Organization Control 2) evaluates an organization's controls related to security, availability, processing integrity, confidentiality, and privacy. Pump Secure checks align with the Trust Services Criteria, focusing on the technical controls an auditor would evaluate.
Who needs it: SaaS companies, cloud service providers, and any organization that handles customer data and undergoes SOC 2 audits.
HIPAA The Health Insurance Portability and Accountability Act requires safeguards for protected health information (PHI). Pump Secure checks cover the technical safeguard requirements, including access controls, audit controls, integrity controls, and transmission security.
Who needs it: Healthcare providers, health plans, healthcare clearinghouses, and their business associates that handle PHI.
PCI DSS (versions 3.2.1 and 4.0) The Payment Card Industry Data Security Standard protects cardholder data. Pump Secure checks map to the technical requirements for network security, access control, vulnerability management, and monitoring.
Who needs it: Any organization that stores, processes, or transmits credit card data. PCI 4.0 is the current version; 3.2.1 is supported for organizations still transitioning.
GDPR The General Data Protection Regulation governs data protection and privacy for individuals in the EU. Pump Secure checks focus on the technical measures required for data protection, including encryption, access controls, and data integrity.
Who needs it: Any organization that processes personal data of EU residents.
US Government and Federal
FedRAMP (Low, Moderate, 20x KSI Low) The Federal Risk and Authorization Management Program standardizes security assessment for cloud services used by US federal agencies. Pump Secure maps checks to FedRAMP baselines at different impact levels.
Who needs it: Cloud service providers seeking FedRAMP authorization or federal agencies evaluating cloud vendor security.
NIST 800 53 (Revisions 4 and 5) NIST Special Publication 800-53 provides a catalog of security and privacy controls for federal information systems. Revision 5 is the current version. Pump Secure checks map to the technical controls in this catalog.
Who needs it: US federal agencies, government contractors, and organizations that use NIST as their control framework.
NIST Cybersecurity Framework (CSF 1.1 and 2.0) The NIST CSF provides a voluntary framework for managing cybersecurity risk. It is organized around five functions: Identify, Protect, Detect, Respond, and Recover. Pump Secure checks map to the Protect and Detect functions.
Who needs it: Any organization looking for a structured approach to cybersecurity risk management. Widely adopted across industries.
CISA The Cybersecurity and Infrastructure Security Agency publishes best practices for securing critical infrastructure. Pump Secure checks align with CISA's technical guidance.
Who needs it: US critical infrastructure operators and organizations following federal cybersecurity guidance.
Financial Services
FFIEC The Federal Financial Institutions Examination Council provides IT security standards for financial institutions regulated by US banking agencies.
Who needs it: US banks, credit unions, and financial institutions subject to federal examination.
Reserve Bank of India (RBI) The RBI publishes information security guidelines for banks and financial institutions operating in India.
Who needs it: Financial institutions regulated by the Reserve Bank of India.
International and Regional
Esquema Nacional de Seguridad (ENS) Spain's national security framework for public administration and organizations providing services to the Spanish public sector.
Who needs it: Organizations operating in or providing services to Spanish government entities.
KISA ISMS-P 2023 The Korea Internet & Security Agency's information security management system certification standard. Available in both English and Korean.
Who needs it: Organizations operating in South Korea or seeking KISA certification.
SecNumCloud 3.2 The French ANSSI (National Cybersecurity Agency) qualification framework for cloud service providers.
Who needs it: Cloud providers seeking French government security qualification.
Cloud Computing Compliance Criteria Catalogue (C5) The German Federal Office for Information Security (BSI) standard for cloud security.
Who needs it: Organizations providing cloud services in Germany or to German government entities.
Cloud Security Frameworks
CSA Cloud Controls Matrix (CCM) 4.0 The Cloud Security Alliance's control framework for cloud computing, organized into 17 domains covering everything from application security to supply chain management.
Who needs it: Organizations seeking alignment with CSA best practices or preparing for CSA STAR certification.
Common Cloud Controls (CCC) A cross-cloud security control framework designed to provide consistent security evaluation across different cloud providers.
Who needs it: Multi-cloud organizations looking for a unified control framework.
Healthcare and Life Sciences
GxP Title 21 CFR Part 11 US FDA regulations governing electronic records and electronic signatures in pharmaceutical and medical device manufacturing.
Who needs it: Pharmaceutical companies, medical device manufacturers, and biotech firms subject to FDA oversight.
GxP EU Annex 11 EU GMP Annex 11 requirements for computerized systems used in pharmaceutical manufacturing.
Who needs it: Pharmaceutical manufacturers operating under EU GMP regulations.
Reading Your Compliance Results
For each active framework, the Pump Secure dashboard shows:
Pass/Fail badge
Whether any checks under this framework have failed. "Passed" means all checks passed. "Failed" means at least one check failed.
Percentage score
The percentage of checks that passed. A score of 97% means 97% of applicable checks passed.
Findings breakdown
In the findings table, the "Frameworks affected" column shows which active frameworks each failed check maps to.
A high score on one framework does not guarantee a high score on another. Frameworks vary in scope and strictness. An account that scores 97% on AWS Well-Architected may score 65% on HIPAA because HIPAA includes controls that the Well-Architected Framework does not cover.
Limitations
Pump Secure evaluates technical infrastructure controls only. Most compliance standards also require:
Organizational policies
Written security policies, incident response plans, employee handbooks
Process controls
Change management procedures, access review cadences, vendor management
Physical security
Data center access, device management, physical media handling
Training
Security awareness training, role-based training programs
Audit artifacts
Evidence collection, control narratives, management assertions
Use Pump Secure findings as one input to your compliance program, not as a substitute for the full program.
Additional Review
AWS AI Readiness Assessment
Alongside the Pump Secure compliance frameworks, Pump can run an AI readiness assessment for customers building or planning generative AI and ML workloads on AWS. This maps to AWS's own guidance for AI workloads: the AWS Well-Architected Generative AI Lens and Machine Learning Lens, which extend the standard Well-Architected Framework Review across all six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability) with AI-specific best practices covering model selection, data architecture, prompt engineering, and responsible AI. Pump maps its checks to the relevant lens controls and reports pass/fail status the same way it does for other frameworks, giving customers a clear view of whether their AWS environment (IAM scoping, data handling, encryption, logging, Bedrock/SageMaker configuration, etc.) is ready to support AI workloads before they scale usage.
Who needs it: Any organization building, evaluating, or scaling generative AI or ML workloads on AWS — including teams using Bedrock, SageMaker, or self-hosted foundation models. It's especially relevant for teams past the prototype stage and moving toward production, since that's typically when gaps in data governance, model access controls, and cost/scaling architecture start to matter. No regulatory body mandates this the way SOC 2 or HIPAA audits do, but it's increasingly expected by risk and compliance stakeholders — and often by customers or investors doing diligence on a company's AI usage — as evidence that AI systems were built on a reviewed architectural foundation rather than assembled ad hoc.
For more information and to be connected to a Pump Solutions Architect, reach out to your Pump Account Manager or support@pump.co.
Last updated
Was this helpful?