APN Partner Central

AWS Level 1 Managed Security Service Provider Competency

AWS Partner Validation Checklist

January 2024 - 3.0

Self-assessment Spreadsheet

Introduction

The goal of the AWS Specialization Programs is to recognize AWS Partner Network Partners (“AWS Partners”) who demonstrate and maintain technical proficiency and proven customer success in specialized AWS Partner solution areas. The AWS Competency Partner Validation Checklist (“Checklist”) is intended for AWS Partners who are interested in applying for an AWS Specialization. This Checklist provides the criteria necessary to achieve the specialization as a consulting partner. AWS Partners undergo a technical validation of their capabilities upon applying for a specific specialization. AWS leverages in-house expertise and a third-party firm to facilitate the technical validation. AWS reserves the right to make changes to this document at any time and without notice.

Expectation of Parties

It is expected that AWS Partners will review this document in detail before applying for the AWS Competency Program, even if all of the prerequisites are met. If items in this document are unclear and require further explanation, please contact your AWS Partner Development Representative (“PDR”) or AWS Partner Development Manager “(PDM”) as the first step. Your PDR/PDM will contact the program office if further assistance is required.

AWS Partners should complete the Self-Assessment Spreadsheet linked at the top of this page, prior to submitting a program application. Once completed, AWS Partners must submit an application in APN Partner Central. Visit the AWS Competency Program guide for step-by-step instructions on how to submit an application.

AWS will review and aim to respond back with any questions within five business days to initiate scheduling of your technical validation or to request additional information.

AWS Partners should prepare for the technical validation by reading the Checklist, completing a self-assessment using the Checklist, and gathering and organizing objective evidence to share with the reviewer on the day of the technical validation.

AWS recommends that AWS Partners have individuals who are able to speak in-depth to the requirements and the customer examples during the technical validation. The best practice is for the AWS Partner to make the following personnel available for the technical validation: one or more highly-technical AWS certified engineers/architects in the area of competency specialty, an operations manager who is responsible for the operations and support elements, and a business development executive to conduct the overview presentation.

AWS may revoke an AWS Partner’s Competency designation if, at any time, AWS determines in its sole discretion that such AWS Partner does not meet its AWS Competency Program requirements. If an AWS Partner’s AWS Competency designation is revoked, such AWS Partner will (i) no longer receive benefits associated with its designation, (ii) immediately cease use of all materials provided to it in connection with the applicable AWS Competency designation and (ii) immediately cease to identify itself as a member of the AWS Competency.

AWS Partners should ensure that they have the necessary consents to share with the auditor (whether AWS or a third-party) all information contained within the objective evidence or any demonstrations prior to scheduling the audit.

AWS Level 1 Managed Security Service Provider Competency Definition

AWS Level 1 Managed Security Service Provider (MSSP) Competency Partners have demonstrated their technical proficiency and operations meet the requirements for the baseline standard of quality for managed cloud security: Level 1 Managed Security Services (MSS). The Level 1 MSS baseline covers managed security services that protect, monitor, and respond to security events of essential AWS resources and are delivered to customers as a fully managed service. Level 1 MSS benefit the security posture for AWS environments of any size and address the customer security use cases in the following section. Partners must meet all prerequisites and ten (10) baseline technical requirements in this checklist and will be assigned to the Level 1 MSSP Competency category. The ten (10) baseline categories below are required for Partners, six (6) specilization categories are optional for Partners.

AWS Infrastructure Vulnerability Scanning (baseline): Routine scanning of AWS infrastructure resources for known software vulnerabilities. Newly added resources are automatically discovered and available for scanning. AWS metadata for scanned AWS infrastructure is available as part of scan results to better enable reporting and decision making.

AWS Resource Inventory Visibility (baseline): Continuous scanning and reporting of all AWS resources, and their configuration details, updated automatically with newly added or removed resources.

AWS Security Best Practices Monitoring (baseline): Detect when AWS accounts and the configuration of deployed resources do not align to security best practices.

AWS Compliance Monitoring (baseline): Scan AWS environments for compliance standards on two or more of the following: CIS AWS Foundations, PCI DSS, HIPAA, HITRUST, ISO 27001, MITRE ATT@CK, AND SOC2.

Monitor, Triage Security Events (baseline): Continuously monitor aggregated AWS resource logs across network, host, and API layers to analyze and triage security events. Identified alerts are made available for customers to view, allowing them to incorporate remediation into their operational workflows. Remediation guidance is provided with the findings to better enable customers to resolve issues in their environments.

Distributed Denial of Service (DDoS) Mitigation (baseline): A system backed by technology and security experts monitoring 24/7 for Distributed Denial of Service (DDoS) threats.

Managed Intrusion Prevention System (IPS)(baseline): Protection from known and emerging network threats that seek to exploit known vulnerabilities.

Managed Detection and Response for AWS Endpoints (baseline): A combination of technology and cloud security experts working to continuously detect, investigate, and remove threats from within AWS endpoints.

Web Application Firewall (WAF) Management (baseline): A firewall managed service designed to protect web-facing applications and APIs against common exploits.

Modern Compute Security (specialization): 24/7 management of security for container workloads on AWS, including event monitoring and incident response.

Managed Application Security Testing (specialization): Assessments, remediations, and ongoing managed services for detecting and responding to security events in code pipelines and applications.

Data Privacy Event Monitoring (specialization): Monitor and respond to security events generated by the discovery or leakage of sensitive data in unintended locations for workloads on AWS.

Identity Behavior Monitoring (specialization): Solutions and managed services to monitor and respond to security events generated by identity services running in AWS.

Business Continuity and Ransomware Readiness (specialization): Preparing customers for large scale security events such as ransomware by ensuring proper isolation policies and recovery capabilities of critical resources.

Digital Forensics Incident Response (specialization): Provide timely support to incident responders leveraging the telemetry and data collected by the Partner as part of their managed security services for AWS workloads.

AWS Level 1 Managed Security Service Provider Competency Program Prerequisites

The following items will be validated by the AWS Competency Program Manager; missing or incomplete information must be addressed prior to scheduling of the technical validation.

  1. 1.0APN Program Membership

    1. 1.1Program Guidelines

      The AWS Partner must read the Program Guidelines and Definitions before applying to the Level 1 Managed Security Service Provider Competency Program. Click here for Program details.

    2. 1.2AWS Path membership

      AWS Partners must be a member of the Services Path.

      or

      1. AWS Partners must be a member of the Software Path.

    3. 1.3AWS Partner Tier

      Partner must be an AWS Advanced or Premier Tier Partner.

    4. 1.4Foundational Technical Review (FTR - formerly known as TBR)

      For AWS Partners who qualify for prerequisite 1.2 by being a member of the Software Path, the primary software solution used to deliver the AWS Partners Managed Security Service offering must have completed and passed an AWS Foundational Technical Review within the last 24 months. FTRs completed for other solutions in the AWS Partner’s portfolio do not fulfill this requirement.

  2. 2.0Example AWS Customer Deployments

    1. 2.1Production AWS Customer Case Studies

      AWS Partner must privately share with AWS details about four (4) unique examples of Level 1 Managed Security Service Provider projects executed for four (4) unique AWS customers. Each case study must demonstrate how the partner offering was used by a customer to solve a specific Level 1 Managed Security Service Provider customer challenge using AWS.

      In addition to the required case study details provided in AWS Partner Central, the partner must also provide architecture diagrams of the specific customer deployment and information listed in the technical requirements sections of this validation checklist.

      The information provided for these case studies will be used by AWS for validation purposes only. AWS Partner is not required to publish these details publicly.

      AWS Partner can reuse the same case study across different AWS Specialization designations as long as the case study and implementation scope are relevant to those designations. The partner should make sure the existing case study clearly explains the relevance to each designation they are applying for.

      In cases where a case study is used across multiple AWS Partner Specialization applications, the partner must attach a completed self-assessment spreadsheet for each Specialization with all service-specific details provided.

      AWS will accept one case study per customer. Each customer must be a separate legal entity to qualify. The partner may use an example for an internal or affiliate company of the partner if the offering is available to outside customers.

      All case studies must describe deployments that have been performed within the past 18 months and must be for projects that are in production with customers, rather than in a ‘pilot’ or proof of concept stage.

      All case studies provided will be examined in the Documentation Review of the Technical Validation. The partner offering will be removed from consideration if the partner cannot provide the documentation necessary to assess all case studies against each relevant validation checklist item, or if any of the validation checklist items are not met.

    2. 2.2Publicly Available Case Studies

      At least two (2) of the provided case studies must be publicly available examples describing how the AWS Partner used AWS to help solve a specific customer challenge related to Level 1 Managed Security Service Provider. These publicly available examples may be in the form of formal customer case studies, white papers, videos, or blog posts. The partner will provide the publicly available URL (published by the partner) in the AWS Partner Central "Case Study URL' field, which must include the following details:

      • AWS Customer name
      • AWS Partner name
      • AWS Customer challenge that aligns with the scope of the competency and selected category
      • Using both high-level and technical details, describe how AWS was leveraged as part of the AWS Partner solution
      • Outcome(s) and/or quantitative results

      Anonymized Public Case Studies

      In cases where the partner cannot publicly name customers due to the sensitive nature of the customer engagements, the partner may choose to anonymize the public case study. Anonymized public case study details will be published by AWS, but the customer name will remain private. The partner must provide the AWS Customer name in the ‘Company name’ field of the AWS Partner Central case study for validation purposes, but it will not be published by AWS. The case study fields that will be published to Partner Solutions Finder (PSF) by AWS include the ‘Title’, ‘Case Study Description’, and ‘Case Study URL’. The partner will provide the publicly available URL (published by the partner) in the AWS Partner Central‘Case Study URL’ field, which must include the following details:

      • AWS Customer description (e.g. a top 5 US retailer, a Fortune 500 financial institution, etc.)
      • AWS Partner name
      • AWS Customer challenge that aligns with the scope of the competency and selected category
      • Using both high-level and technical details, describe how AWS was leveraged as part of the AWS Partner solution
      • Outcome(s) and/or quantitative results

      For best practice on how to write an accepted Public case study, see the Public Case Study Guide.

  3. 3.0AWS Partner Self-Assessment

    1. 3.1AWS Partner Self-Assessment

      AWS Partner must conduct a self-assessment of their compliance to the requirements of the AWS Level 1 Managed Security Service Provider Consulting Partner Validation Checklist. A version of this checklist is available in spreadsheet format. Links to the appropriate Self-Assessment Spreadsheet can be found at the top of this page.

      • AWS Partner must complete all sections of the Self-Assessment Spreadsheet. For competency with multiple categories, AWS Partners will fill in details for the chosen application Category and mark other Categories as N/A.
      • Completed Self-Assessment Spreadsheet must be uploaded at the time of submitting an application in APN Partner Central.
      • It is recommended that AWS Partner have their AWS Partner Solution Architect, Partner Development Representative (PDR), or Partner Development Manager (PDM) review the completed Self-Assessment Spreadsheet before submitting to AWS. The purpose of this is to ensure the AWS Partner’s AWS team is engaged and working to provide recommendations prior to the validation and to help ensure a positive validation experience.

Level 1 MSSP Requirements

Throughout this checklist recommendations are provided on AWS Services, AWS Solutions, and third party products from AWS Security Competency (ISV) Partners which can help with meeting certain requirements. This is intended to provide AWS Partners an easier way to self-assess if their current tools have been confirmed by AWS to help satisfy the Competency requirements or to offer Partners guidance on tools that can be leveraged to meet a requirement they currently do not meet. The AWS Partner may choose other AWS services or third party solutions that they believe best suits their offering and their customer requirements. It is the responsibility of the AWS Partner to confirm that the AWS service or third party product that they have chosen meets the Level 1 MSSP Competency requirements and aligns to their customer’s needs. Additionally, it is the responsibility of the AWS Partner to ensure that they are using the AWS service or third party product in the correct manner.

General Requirements

These are requirements that are independent of any particular security capability and are focused on how the AWS Partner is delivering their overall service and how they are interacting with their AWS customers. Partners must meet requirements this section to receive the MSSP Level 1 Competency.

  • GEN-001 - Temporary Credentials

    To interact with AWS APIs in a customer’s AWS account or access the customer’s management console the AWS Partner uses temporary credentials. These credentials can be provided via cross account roles or through federation.

    No IAM User access keys are collected to facilitate interaction with a customer’s environment.

    Evidence: User documentation such as a manual, whitepaper, or blog showing the steps to grant partner access to a customer-run account using an External ID generated by the Partner or how to grant customer temporary credentials on a Partner-run account.

  • GEN-002 - IAM Policies

    The AWS Partner is providing guidance to customers on IAM policies that should be created in the customer’s AWS account so that the Partner can properly access and interact with the customer’s AWS account(s). These policies should be properly scoped to least privilege and only cover the access that the Partner needs.

    Evidence: Documentation of partner guidance in the form of training presentations, whitepapers, blogs, or similar customer-facing guidance.

  • GEN-003 - Collection and reporting data across multiple customer AWS resources

    The AWS Partner does not have any hard limits in their platform that limit the number of AWS accounts or AWS resources (EC2 instances, S3 buckets, RDS databases, etc.) within an AWS account that can be consumed and reported on for any one customer.

    Evidence: A screen shot or other documentation showing the ability to report on multiple accounts and resources.

  • GEN-004 - Delivery of security findings

    Security findings related to a customer's environment are regularly delivered to the customer. This delivery must include a summary report of findings or a dashboard for reviewing findings for a customer's environment and can also include APIs a customer can use to programmatically get information about their security findings.

    Evidence: Sample screen shots or other example of a report and describe the frequency that customers get access to that report, such as “on demand”, “event trigger”, or similar.

AWS Infrastructure Vulnerability Scanning (baseline)

The following requirements cover the AWS Partner’s ability to provide vulnerability scanning functionality that allows a customer to evaluate the security and compliance of their AWS infrastructure. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • VULN-001 - Amazon EC2 vulnerability scanning solution

    The AWS Partner provides a vulnerability scanning solution that supports the ability for a customer to perform both un-authenticated and authenticated vulnerability scans of their Amazon Elastic Compute Cloud (Amazon EC2) infrastructure.

    Evidence: Details on the technical solution that is used to solve this requirement.

  • VULN-002 - Resource Metadata

    The AWS Partner’s vulnerability scanning solution supports collection and display of AWS metadata that is related to the Amazon EC2 instances that have findings as a result of a vulnerability scan. This information must include: Amazon EC2 tags, Amazon EC2 instance ID, Amazon EC2 AMI ID, Amazon EC2 public and private IP address, Amazon EC2 public and private DNS address, VPC ID, Subnet ID, region, AWS account ID.

    Evidence: Screen shots showing the display of the necessary metadata information in the dashboard or report that is accessible to the customer.

  • VULN-003 - Detection of new Amazon EC2 instances and Amazon VPC

    The AWS Partner solution supports the ability to automatically detect when new Amazon EC2 instances or Amazon Virtual Private Clouds (Amazon VPCs) are created within the customer’s AWS environment. Alternatively, the solution provides the ability to programmatically provide updates when there are new Amazon EC2 instances or Amazon VPCs that should be scanned. This requirement ensures that customers are not required to do manual configuration within the AWS Partner vulnerability scanning solution to ensure that new Amazon EC2 instances or Amazon VPCs are included in future vulnerability scans.

    This requirement ensures that customers are not required to do manual configuration within the AWS Partner vulnerability scanning solution to ensure that new Amazon EC2 instances or Amazon VPCs are included in future vulnerability scans.

    Evidence: Written description of how the vulnerability scanning solution meets this requirement.

  • VULN-004 - Container vulnerability scanning solution

    The AWS Partner provides a vulnerability scanning solution that supports the ability for a customer to perform both un-authenticated and authenticated vulnerability scans of their container instances.

    Evidence: Details on the technical solution that is used to solve this requirement.

AWS Resource Inventory Visibility (baseline)

The following requirements cover the Partner’s ability to enable a customer to have visibility into the inventory of the AWS resources in their AWS accounts. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • INV-001 - Display of AWS Resource inventory

    The AWS Partner solution supports displaying AWS resource inventory information in a consolidated user interface (UI). This UI supports displaying inventory information by resource type, region, and account. The UI also allows customers to see key configuration attributes of each resource, including tags applied to that resource.

    Evidence: Screen shots showing examples of AWS resource inventory in dashboards or reports that would be available to customers.

  • INV-002 - AWS resource information collection

    The AWS Partner solution supports the ability to collect resource information from a customer’s AWS account in an event driven fashion.

    Initial discovery of AWS resources in a customer’s environment via the relevant AWS describe APIs is allowed for building an initial inventory of AWS resources. After initial resource discovery, additional information on new, updated, or terminated resources is identified through an event driven framework. Examples include consuming data via AWS CloudTrail logs or AWS Config. It is acceptable to make API calls for individual resources to retrieve additional metadata about new or changed assets or to confirm current inventory information.

    Evidence: Written description on how the solution is collecting initial and steady state resource information from a customer’s AWS account.

AWS Security Best Practices Monitoring (baseline)

The following requirements cover the AWS Partner’s ability to identify best practices for AWS resources and identify cases where a customer’s resources do not align to best practices. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • BES-001 - Monitoring for AWS Service Configuration Security Best Practices

    The Partner solution has the ability to report on security best practice violations in a customer’s AWS account. These best practices must cover at least the following AWS services: Amazon EC2, Amazon S3, Amazon Relational Database Service (Amazon RDS), AWS Identity and Access Management (IAM), Amazon VPC, Amazon Elastic Block Store (Amazon EBS), Amazon Elastic File System (Amazon EFS), AWS Key Management Service (AWS KMS).

    Common reference points for best practices with AWS services can be found in the security documentation for a service: https://docs.aws.amazon.com/security/

    Evidence: Screen shots showing examples of best practices detection available within dashboards or reports provided to customers.

AWS Compliance Monitoring (baseline)

The following requirements cover the Partner’s ability to continuously monitor a customer’s AWS accounts for alignment to industry compliance standards. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • COM-001 - Continuous compliance monitoring

    The AWS Partner solution provides continuous compliance monitoring against the configuration a customer’s AWS accounts and the AWS resources that are in a customer’s AWS accounts.

    Continuous compliance monitoring is provided for at least two of the following compliance organizations:

    • CIS AWS Foundations Benchmark v1.2 or 1.3
    • HITRUST v9.3
    • HIPAA
    • ISO 27001:2013
    • MITRE ATT@CK
    • PCI DSS v3.2
    • SOC2

    Evidence: Screen shots showing examples of AWS compliance monitoring for each of the supported compliance organizations.

Monitor, Triage Security Events (baseline)

The following requirements relate to the AWS Partner’s ability to detect threats in a customer’s AWS environment, triage those findings, and engage a customer for remediation of the findings. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

  • EVT-001 - Triage

    AWS Partners can assess and enrich security findings in a customer’s AWS Environment, providing additional context and actionable information to help customers reduce false positives and effectively respond to incidents.

    Evidence: Written description of the Partner’s approach to triaging security findings from a customer’s AWS environment.

  • EVT-002 - Remediation guidance

    For a security finding the AWS Partner has the ability to deliver remediation guidance to the customer so that the customer can resolve the finding in their environment.

    Alternatively, the AWS Partner has the ability and permissions to perform the remediation steps themselves or provides automation that can remediate the finding for the customer.

    Evidence: Screen shots showing examples of reported security findings from an AWS account and the suggested remediation for the finding.

  • EVT-003 - 24/7 response

    The AWS Partner has the ability to detect, triage, and alert customers of high priority security findings on a continuous uninterrupted basis, 24 hours a day and 7 days a week. Alerts provided to customers included remediation guidance for the finding.

    Evidence: Written description of the Partner’s support model for being able to respond to high priority findings in their customer’s AWS accounts on a continuous uninterrupted basis, 24 hours a day and 7 days a week.

  • EVT-004 - Engaging the MSSP for assistance

    The AWS Partner provides the ability for their customers to engage the MSSP support staff on a continuous uninterrupted basis, 24 hours a day and 7 days a week, for assistance with high severity security items.

    Evidence: Written description of how the AWS Partner is enabling their customer to engage their support staff for assistance on a continuous uninterrupted basis, 24 hours a day and 7 days a week.

Distributed Denial of Service (DDoS) Mitigation (baseline)

The following requirements cover the Partner’s ability to guide and assist a customer with a solution to help with protection against DDoS attacks for the applications they are running on AWS. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • DDOS-001 - Customer configuration assistance

    The AWS Partner has the resources and skill sets to assist the customer with choosing and configuring a solution that provides DDoS protection for the applications running in a customer’s AWS accounts.

    DDoS solutions that the Partner recommends must provide protection from layer 3,4, and 7 attacks.

    Evidence: Written description of the solutions that the AWS Partner recommends or supports for DDoS protection of applications running in a customer’s AWS account. Written description of the Partner’s engagement model to help customers with configuration of their chosen or recommended DDoS protection solution.

Managed Intrusion Prevention System (IPS) (baseline)

The following requirements cover the ability for the Partner to provide managed intrusion detection and prevention services for a customer’s AWS account and the workloads running in that account. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • IDP-001 - Agent based solutions

    Agent based solutions that are used to provide intrusion detection and prevention services are able to run on Amazon EC2 instances with the following operating systems:

    • Amazon Linux2
    • RedHat
    • CentOS
    • Ubuntu
    • Windows

    This item is not necessary if the AWS Partner utilizes a network-based solution as outlined in IDP-002.

    Evidence: Written description of the technical solution that the AWS Partner is using to meet this requirement.

  • IDP-002 - Network-based solutions

    Network-based intrusion detection and prevention solutions that are deployed into a customer’s AWS account must support the ability to deploy highly available architectures. This includes:

    • Integration with AWS Auto Scaling
    • Integration with Elastic Load Balancing
    • Ability to run in a multi-Availability Zone (AZ) configuration
    • Support for automated bootstrapping of instances (e.g. via user data scripts)
    • Worker/support nodes must use AWS Lambda/Step Functions instead of long-lived Amazon EC2 instances

    This item is not necessary if the AWS Partner utilizes an agent-based solution as outlined in IDP-001.

    Evidence: Written description of the technical solution that the AWS Partner is using to meet this requirement.

  • IDP-003 - Nitro Amazon EC2 instance support

    Intrusion detection and prevention solutions that the AWS Partner deploys into a customer’s AWS accounts support running on Nitro-based Amazon EC2 instances.

    Solutions support drivers for Elastic Network Adapter (ENA) and NVMe block devices.

    Evidence: Written description of the technical solution that the AWS Partner is using to meet this requirement.

  • IDP-004 - Threat detection - AWS network layer

    The Partner has the ability to detect threats at the network or host level of a customer’s AWS account.

    Evidence: Screen shots showing examples of the technical solution detecting threats at the network or host level for an AWS account.

  • IDP-005 - Threat Detection - AWS API layer

    The Partner has the ability to detect threats at the AWS API layer of a customer’s AWS account.

    AWS APIs refers to APIs, provided by AWS, for interacting with the AWS resources in a customer’s AWS account. This does not cover APIs that a customer has created and deployed for their own applications. An example of a threat detection at the AWS API layer is: detecting the use of IAM access keys from an IP address space that is not normally used by the customer.

    Evidence: Screen shots showing examples of AWS API layer detections that are being detected by the AWS Partner’s solution.

  • IDP-006 - AWS aware tooling

    The AWS Partner’s threat detection tools and reporting are AWS aware and contain AWS metadata on the affected AWS resources from a customer’s AWS account. While the metadata information about each AWS resource will vary, minimal metadata for any AWS resource should include: resource tags, region, account, resource identifiers that can be used in the AWS console and APIs to find the specific resource. Beyond the minimum metadata additional metadata provided about an AWS resource should contribute to helping the customer make an informed decision about the resource that is experiencing a reported threat.

    Evidence: Screen shots showing the use of a AWS metadata from a customer’s AWS account as part of the reporting of threats that are delivered in a dashboard or report for customers.

  • IDP-007 - Threat Detection - Network or host level

    The Partner has the ability to detect threats at the network or host level of a customer’s AWS account.

    Evidence: Screen shots showing examples of the technical solution detecting threats at the network or host level for an AWS account.

Managed Detection and Response for AWS Endpoints (baseline)

The following requirements cover the ability of the Partner to provide and support solutions for managed detection and response for AWS based endpoints. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • MEDR-001 - Operating System support

    Endpoint solutions provided by the AWS Partner have the ability to run on the following Amazon EC2 operating systems:

    • Amazon Linux2
    • RedHat
    • CentOS
    • Ubuntu
    • Windows

    Evidence: Written description of the technical solution that the Partner is using to meet this requirement.

  • MEDR-002 - Endpoint metadata support

    The solution that the AWS Partner provides for a customer’s AWS based endpoints supports the ability to ingest and display AWS metadata about the EC2 instance that a deployed agent is running on.

    Metadata collected and displayed should include at least: Amazon EC2 tags, Amazon EC2 instance ID, Amazon EC2 AMI ID, Amazon EC2 public and private IP address, Amazon EC2 public and private DNS address, Amazon VPC ID, Subnet ID, region, account ID.

    Evidence: Screen shot showing the use of AWS metadata in the dashboard or report that supports data from the endpoint solution.

  • MEDR-003 - Working agent identification

    The solution that the partner supports for running on a customer’s AWS-based endpoint provides the ability to identify Amazon EC2 instances without a working agent.

    Evidence: Screen shot showing the ability to detect instances without a working agent for a customer’s AWS account.

  • MEDR-004 - Container support

    The AWS Partner supports a solution that protects containers and integrates with at least one of the following AWS container services:

    • Amazon Elastic Container Service (Amazon ECS)
    • Amazon Elastic Kubernetes Service (Amazon EKS)
    • AWS Fargate

    Evidence: Written description of the technical solution that is used to support this requirement.

  • MEDR-005 - Base Endpoint Detection and Response capabilities

    The solution that the AWS Partner supports offers four key capabilities for Endpoint Detection and Response (EDR) as defined by Gartner: detect security incidents, contain the incident at the endpoint, investigate security incidents, and provide remediation guidance.

    Evidence: Written description of the technical solution that is used to support this requirement.

Managed Web Application Firewall (WAF) (baseline)

The following requirements cover the ability of the Partner to provide solutions and support related to customers deploying Web Application Firewall (WAF) technology to protect their applications running in AWS. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • WAF-001 - OWASP top 10 support

    WAF solutions that the AWS Partner supports have the ability to address the OWASP top 10 web application security risks.

    Evidence: Written description of the technical solutions that the Partner recommends or supports to meet this requirement.

  • WAF-002 - Guidance on rule authoring

    The AWS Partner has the ability to guide a customer on how to author WAF rules for the WAF solutions that the Partner recommends and supports.

    Evidence: Written description on how the AWS Partner meets the needs of their customers for this requirement.

  • WAF-003 - WAF log consumption

    The AWS Partner has the ability to consume log data from a customer’s WAF environments on AWS and provide threat analytics and insights on additional rules that should be authored to address observed threats.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

Modern Compute Security (specialization)

The following requirements cover the ability of the Partner to provide managed container workload security event monitoring and response running in AWS. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • MODC-001 - Container image vulnerability scanning

    The AWS Partner provides a vulnerability scanning solution that supports the ability scan container images for both operating system and programming language vulnerabilities. Scanning solution must be capable of both continuous and on-push scanning and support at minimum 3 of the Operating Systems (Alpine Linux, Amazon Linux, CenOS Linux, Debian Server) and 3 of the Programing Languages (C#, Golang, Java, Javascript, PHP, Python, Ruby, Rust).

    Evidence: Details on the technical solution that is used to meet this requirement.

  • MODC-002 - Container Threat Detection

    Partner has policies and procedures for continuously monitoring cluster activity to identify malicious or suspicious behavior that represents potential threats to container workloads. Threats detected must include the following:

    • Clusters accessed by known malicious actors or Tor nodes
    • API operations performed by anonymous users
    • Privilege-escalation techniques such as launch of a container with root-level access to the underlying Amazon Elastic Compute Cloud (Amazon EC2) host.

    The solution protects containers on at least one of the following AWS container services:

    • Amazon Elastic Container Service (Amazon ECS)
    • Amazon Elastic Kubernetes Service (Amazon EKS)
    • AWS Fargate

    Evidence: Written description of the technical solution that is used to support this requirement.

  • MODC-003 - Patch Management

    The AWS Partner provides a mechanism for upgrading instances with the latest operating system and application versions.

    Evidence: Provide an example of a policy used for maintaining appropriate security patch levels in container instances.

Managed Application Security Testing (specialization)

The following requirements cover the ability of the Partner to provide an initial solution and ongoing managed services for detecting and responding to security events in code pipelines and applications. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • AST-001 - Code Reviews and Application Development

    AWS Partner provides code-level security expertise and guidance. The Partner either directly develops application code that implements security best practices or provides code review services for customers to proactively identify security issues and address them in custom code bases. These services leverage a combination of automated static analysis, dynamic analysis, and expert reviews.

    Evidence: One of the following - customer testimonial, Git/bug tracker history, or publications.

  • AST-002 - Runtime Application and Self-Protection (RASP)

    AWS Partner must provide RASP solution and monitor events in their managed services.

    Evidence: Details of RASP security that can detect and block security attacks and anomalies from inside a running application.

  • AST-003 - Penetration Testing

    AWS Partner has an understanding of AWS penetration testing policies and works with customers to conduct tests, implement processes around regular penetration testing/vulnerability scanning of their applications and infrastructure, while still complying with AWS policies. AWS Partner works with customers to resolve any identified vulnerabilities to ensure that their applications meet a target security bar and their AWS environment meets the standards of AWS Well-Architected Framework.

    Evidence: A sample of a customer penetration test results report that was supplied to a customer. IP Addresses or other sensitive data may be redacted.

  • AST-004 - Managed Pipeline Scanning service

    Managed service automates vulnerability scanning of the CI/CD pipeline and reports events for analysis/response. Service provides scans of code, least privilege access, patch management, and network ports and protocols.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • AST-005 - Dynamic Code Analysis

    Partner performs Dynamic Code Analysis for post-production apps, collect/triage the events, and either provide remediation guidance or resolve the events.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • AST-006 - Static Code Analysis

    AWS Partner performs Static Code Analysis for pre-production apps, collect/triage the events, and either provide remediation guidance or resolve the events.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

Data Privacy Event Monitoring (specialization)

The following requirements cover the ability of the Partner to provide solutions and ongoing managed services to monitor for security events generated by the discovery of sensitive data in unintended locations of the customers’ AWS environment(s), encryption key and certificate management, malware-infected files, and unintended transmission of sensitive data. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • DPEM-001 - Data Encryption and Key Management

    Partner must provide details on how they manage cryptographic keys, including rotation and recovery strategies.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • DPEM-002 - Certificate Management (SSL/TLS)

    Partner must monitor SSL/TLS certs for expiration, ensure that keys are stored securely, and implement HSTS (HTTP Strict Transport Security) by default.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • AST-003 - Discover and classify sensitive data

    AWS Partner must provide managed sensitive data discovery services and monitor security events for analysis. Additionally, Partner must alert when sensitive data is not stored in an inappropriate location.

    Evidence: Partner must describe the tools and techniques they use to scan for sensitive data and to mark it according to the appropriate classification.

  • AST-004 - Amazon S3 Malware Scanning

    Partner must provide the ability to scan for malware in S3 in an API-based, Event-based, or scheduled fashion. Documentation must be accessible to customers and clearly describe the scanning approach.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • AST-005 - Data Loss Prevention (DLP)

    AWS Partner must scan data at rest (storage) and data in motion (network) in order to determine when sensitive data is improperly used or exchanged.

    Evidence: A screenshot showing how the system marks data with the appropriate classification.

Identity Behavior Monitoring (specialization)

The following requirements cover the ability of the Partner to provide solutions and ongoing managed services to monitor and respond to security events generated by identity services running in AWS. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • IDBM-001 - Access Management

    Partner solution must provide visibility of identity access rights to assets such as how identities map to assets.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • IDBM-002 - Anomalous Access Behavior Detection

    Partner service must detect and alert when a user accesses resources in an anomalous way (e.g. outside of work hours or from a new location).

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • IDBM-003 - Multi-Factor Authentication Management

    AWS Partner can manage MFA tokens for the customer, ensuring at minimum, root, administrator, auditor, and back-up accounts are secured with MFA.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • IDBM-004 - Secrets Management

    Partner must provide a solution for managing passwords, keys, and other secrets that does not store them in plain text anywhere.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • IDBM-005 - Adaptive Authentication

    Partner solution uses historic logs to recommend policy updates in-line with least privilege.

    Evidence: Provide an example of a recommended policy update that was automatically generated.

  • IDBM-006 - Single Sign On (SSO)

    Partner is capable of providing integrations with major authentication vendors so customers can have a combined view of all of their AWS accounts and non-AWS accounts.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • IDBM-007 - AWS-Supported Identity Provider

    Partner can manage identity provider events from AWS Supported Identity Provider (requires integration with AWS SSO via SCIM).

    Evidence: Show that the external identity provider has been tested with AWS SSO SCIM implementation.

  • IDBM-008 - Privilege Access Management (PAM)

    Partner has the ability to provide access to key resources through PAM integration on supported operating systems and monitor events.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • IDBM-009 - Identity Federation

    Partner solutions can federate customer employees, contractors, and partners (workforce) to AWS accounts and business applications, and add federation support to public-facing web/mobile applications.

    Evidence: Must provide support for at least three commonly used open identity standards: Security Assertion Markup Language 2.0 (SAML 2.0), Open ID Connect (OIDC), and OAuth 2.0.

  • IDBM-010 - Identity Governance & Administration (IGA)

    Partner solution provides and monitors events for least privilege and separation of duties across the lifecycle of joiners, movers, and leavers.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

Business Continuity and Ransomware Readiness (specialization)

The following requirements cover the ability of the Partner to provide and/or manage an existing Business Continuity solution including documented processes/workflow for AWS environment(s) to recover from an interruption such as a mass encryption event (ransomware). This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • BCRR-001 - Business Continuity Plan

    AWS Partner provides customers with a written business continuity plan including the following:

    • Backup and Restore strategy
    • Risk Management strategy (accounting for customers’ priorities, constraints, risk tolerances, assumptions)
    • Business Environment (customers’ mission, objectives, stakeholders are documented and details information is included to describe cybersecurity roles, responsibilities, and risk management decisions)
    • Assets (data, personnel, devices, systems, and facilities that enable the customer to achieve business purposes are documented)
    • Supply Chain Risk Management

    Evidence: A sample of a customer Business Continuity Plan that includes a Recovery Point Objectives (RPO) and Recovery Time Objective (RTO).

  • BCRR-002 - Isolated Backup Storage

    Partner’s solution isolates backups from the production network with separate access roles and separate MFA access, similar to audit accounts. Recommend making back-ups immutable.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • BCRR-003 - Disaster Recovery

    Partner solution keeps critical customer operations up and running in the event of a major system failure.

    Evidence: Written process for recovering back-ups, written frequency of testing Continuity of Operations (COOP) plan, or written plan for on-prem or multi-cloud recovery into AWS.

  • BCRR-004 - Conduct Recovery Drills

    Partner must perform a disaster recovery test at least twice per year to demonstrate customer environments can be recovered to operational state from the backups. Customers need to be included in the process so they are also prepared for a real event.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • BCRR-005 - Ransomware Response Plan

    Partner solution includes a Ransomware response plan template that addresses each of the requirements in the NIST National Cybersecurity Center of Excellence (NCCoE) Practice Guides (NIST 1800-11, 1800-25, and 1800-26).

    Evidence: Provide an example of a recommended policy update that was automatically generated.

  • BCRR-006 - Anti-Ransomware Solution

    Partner must have experience in providing customers with anti-Ransomware solutions and monitoring for events.

    Evidence: Architecture image of the anti-ransomware solution with AWS Services, 3rd party products, and areas of customization.

  • BCRR-007 - Anti-Ransomware Managed services

    Partner must be experienced in providing customers with 24/7 managed services for anti-Ransomware Software products.

    Evidence: Customer-facing sales documentation and internal procedural documentation such as Standard Operating Procedures (SOPs), runbooks, and playbook in their application.

  • BCRR-008 - Anti-Ransomware Deployment services

    Partner must be experienced in providing customers with anti-Ransomware deployment services.

    Evidence: anti-Ransomware software deployment documentation and/or automation that is used by individuals in their company or equivalent assets in their application.

  • BCRR-009 - Ransomware Protection

    Partner must provide Ransomware protection solution that includes mitigation of host and network attack vectors as well as policy enforcement such as patch management.

    Evidence: Architecture image.

  • BCRR-010 - Ransomware Awareness

    Partner can provide an Anti-Ransomware solution that includes inventory of digital assets, logging, reporting, vulnerability management, and event detection.

    Evidence: Architecture image.

  • BCRR-011 - Ransomware Response

    Partner can provide an Anti-Ransomware solution that includes secure backup, immutable storage, investigation, and analytics capabilities.

    Evidence: Architecture image.

  • BCRR-012 - Anti-phishing solution and awareness training

    Partner can provide a solution that scans email for malicious messages and common phishing tactics. The solution must include detection, remediation actions, and training.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

Digital Forensics Incident Response (specialization)

The following requirements cover the ability of the Partner to provide timely support to incident responders leveraging the telemetry and data collected by the Partner as part of their managed security services delivered to customers in AWS. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • DFIR-001 - Forensics and Evidence Collection

    Partner must have the ability and a documented process for conducting an investigation into an incident and collecting evidence in the appropriate legal format for government investigations in the event that law enforcement or other legal proceedings occur as a result of the investigation.

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • DFIR-002 - Separate Forensics Account

    Partner solution must include a separate AWS account for forensics investigations with access policies following least privilege access. Amazon VPC subnets in the Forensics account should have no internet gateways and Security Groups should be highly restrictive, and deny all ports that aren’t related to the requirements of the forensics tools. The account activity must be auditable at minimum logging all connection activity (SSH, RDP).

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

  • AST-003 - Discover and classify sensitive data

    Partner solution must be capable of collecting at least 5 of the below data sources:

    • All EC2 instance metadata
    • Amazon EBS disk snapshots
    • EBS disks streamed to S3
    • Memory dumps
    • Memory captured through hibernation on the root EBS volume
    • CloudTrail logs
    • AWS Config rule findings
    • Amazon Route 53 DNS resolver query logs
    • VPC Flow Logs
    • AWS Security Hub findings
    • Elastic Load Balancing access logs
    • AWS WAF logs
    • Custom application logs
    • System logs
    • Security logs
    • Any third-party logs

    Evidence: Written description of the technical solution that the AWS Partner is using to solve this requirement.

Resources

AWS Specialization Program Guide
Provides step-by-step instructions when applying for an AWS Specialization.
AWS Specialization Program Benefits Guide
Provides a deeper description of the program benefits.
AWS Competency Application Process
Provides high-level visibility into the AWS Competency application process and timelines for associated process steps.
AWS Competency & SDP Common Customer Example Requirement Calibration Guide
Provides control-by-control best practices, resources to implement, good example responses.
How to build a microsite
Provides guidance on how to build a microsite to highlight your AWS Specialization.
How to build a public case study
Provides guidance on how to build a public customer case study that will showcase your success with AWS Customers.
How to build an architecture diagram
Provides guidance on how to build an architecture diagrams that will meet the prerequisites of the Program.
Well Architected Website
Learn about the Well Architected Framework and its approach.
SaaS Best Practices
Provides best practices on SaaS
Changes between previous and current versions
Change Log
Deployment Pipeline Reference Architecture
Learn about the stages and actions for different types of pipelines that exist in modern systems.