APN Partner Central

AWS Level 1 Managed Security Service Provider Competency

AWS Partner Validation Checklist

February 2024 - 3.1

This AWS Level 1 Managed Security Service Provider Competency Checklist updated to version (3.1) has gone into effect on February 17, 2024. Partners may choose to use the previous checklist version (3.0) until May 17, 2024 when the checklist will no longer be in effect. All applications submitted after May 17, 2024 are required to comply with the current Validation Checklist requirements.

Self-assessment Spreadsheet

Introduction

The goal of the AWS Specialization Programs is to recognize AWS Partner Network Partners (“AWS Partners”) who demonstrate and maintain technical proficiency and proven customer success in specialized AWS Partner solution areas. The AWS Competency Partner Validation Checklist (“Checklist”) is intended for AWS Partners who are interested in applying for an AWS Specialization. This Checklist provides the criteria necessary to achieve the specialization as a consulting partner. AWS Partners undergo a technical validation of their capabilities upon applying for a specific specialization. AWS leverages in-house expertise and a third-party firm to facilitate the technical validation. AWS reserves the right to make changes to this document at any time and without notice.

Expectation of Parties

It is expected that AWS Partners will review this document in detail before applying for the AWS Competency Program, even if all of the prerequisites are met. If items in this document are unclear and require further explanation, please contact your AWS Partner Development Representative (“PDR”) or AWS Partner Development Manager “(PDM”) as the first step. Your PDR/PDM will contact the program office if further assistance is required.

AWS Partners should complete the Self-Assessment Spreadsheet linked at the top of this page, prior to submitting a program application. Once completed, AWS Partners must submit an application in APN Partner Central. Visit the AWS Competency Program guide for step-by-step instructions on how to submit an application.

AWS will review and aim to respond back with any questions within five business days to initiate scheduling of your technical validation or to request additional information.

AWS Partners should prepare for the technical validation by reading the Checklist, completing a self-assessment using the Checklist, and gathering and organizing objective evidence to share with the reviewer on the day of the technical validation.

AWS recommends that AWS Partners have individuals who are able to speak in-depth to the requirements and the customer examples during the technical validation. The best practice is for the AWS Partner to make the following personnel available for the technical validation: one or more highly-technical AWS certified engineers/architects in the area of competency specialty, an operations manager who is responsible for the operations and support elements, and a business development executive to conduct the overview presentation.

AWS may revoke an AWS Partner's Competency designation if, at any time, AWS determines in its sole discretion that such AWS Partner does not meet its AWS Competency Program requirements. If an AWS Partner's AWS Competency designation is revoked, such AWS Partner will (i) no longer receive benefits associated with its designation, (ii) immediately cease use of all materials provided to it in connection with the applicable AWS Competency designation and (ii) immediately cease to identify itself as a member of the AWS Competency.

AWS Partners should ensure that they have the necessary consents to share with the auditor (whether AWS or a third-party) all information contained within the objective evidence or any demonstrations prior to scheduling the audit.

AWS Level 1 Managed Security Service Provider Competency Definition

AWS Level 1 Managed Security Service Provider (MSSP) Competency Partners have demonstrated their technical proficiency and operations meet the requirements for the baseline standard of quality for managed cloud security: Level 1 Managed Security Services (MSS). The Level 1 MSS baseline covers managed security services that protect, monitor, and respond to security events of essential AWS resources and are delivered to customers as a fully managed service. Level 1 MSS benefit the security posture for AWS environments of any size and address the customer security use cases in the following categories.

Partners are required to fulfill all prerequisites, general requirements, and the requirements within the nine baseline categories outlined in this checklist. The six specialization categories are optional. However, if a partner chooses to pursue a specialization category, they must satisfy all its associated requirements.

  • AWS Infrastructure Vulnerability Scanning (baseline): Routine scanning of AWS infrastructure resources for known software vulnerabilities. Newly added resources are automatically discovered and available for scanning. The AWS metadata for scanned AWS infrastructure is available as part of scan results to better enable reporting and decision making.

  • AWS Resource Inventory Visibility (baseline): Continuous scanning and reporting of all AWS resources, and their configuration details, updated automatically with newly added or removed resources.

  • AWS Security Best Practices Monitoring (baseline): Detect when AWS accounts and the configuration of deployed resources do not align to security best practices.

  • AWS Compliance Monitoring (baseline): Scan AWS environments for compliance standards on two or more of the following: CIS AWS Foundations, PCI DSS, HIPAA, HITRUST, ISO 27001, MITRE ATTACK, and SOC 2.

  • Monitor and Triage Security Events (baseline): Continuously monitor aggregated AWS resource logs across network, host, and API layers to analyze and triage security events. Identified alerts are made available for customers to view, allowing them to incorporate remediation into their operational workflows. Remediation guidance is provided with the findings to better enable customers to resolve issues in their environments.

  • Distributed Denial of Service (DDoS) Mitigation (baseline): A system backed by technology and security experts monitoring 24/7 for Distributed Denial of Service (DDoS) threats.

  • Managed Intrusion Prevention System (IPS) (baseline): Protection from known and emerging network threats that seek to exploit known vulnerabilities.

  • Managed Detection and Response (MDR) for AWS Endpoints (baseline): A combination of technology and cloud security experts working to continuously detect, investigate, and remove threats from within AWS endpoints.

  • Web Application and API Protection (WAAP) Management (baseline): A firewall managed service designed to protect web-facing applications and APIs against common exploits.

  • Modern Compute Security (specialization): 24/7 management of security for container workloads on AWS, including event monitoring and incident response.

  • Managed Application Security Testing (specialization): Assessments, remediations, and ongoing managed services for detecting and responding to security events in code pipelines and applications.

  • Data Protection Event Monitoring (specialization): Monitor and respond to security events related to the protection of data integrity, availability, and confidentiality. This includes events generated by the discovery or leakage of sensitive data in unintended locations, detection of data manipulation, and data erasure for workloads on AWS.

  • Identity Behavior Monitoring (specialization): Solutions and managed services to monitor and respond to security events generated by identity services running in AWS.

  • Business Continuity and Ransomware Readiness (specialization): Preparing customers for large scale security events such as ransomware by ensuring proper isolation policies and recovery capabilities of critical resources.

  • Digital Forensics Incident Response (specialization): Provide timely support to incident responders leveraging the telemetry and data collected by the Partner as part of their managed security services for AWS workloads.

AWS Level 1 Managed Security Service Provider Competency Program Prerequisites

The following items will be validated by the AWS Competency Program Manager; missing or incomplete information must be addressed prior to scheduling of the technical validation.

  1. 1.0APN Program Membership

    1. 1.1Program Guidelines

      The AWS Partner must read the Program Guidelines and Definitions before applying to the Level 1 Managed Security Service Provider Competency Program. Click here for Program details.

    2. 1.2AWS Path membership

      AWS Partners must be a member of the Services Path.

      or

      1. AWS Partners must be a member of the Software Path.

    3. 1.3AWS Partner Tier

      Partner must be an AWS Advanced or Premier Tier Partner.

    4. 1.4Foundational Technical Review (FTR - formerly known as TBR)

      For AWS Partners who qualify for the prerequisite 1.2 by being a member of the Software Path, the primary software solution used to deliver the AWS Partners Managed Security Service offering must have completed and passed an AWS Foundational Technical Review within the last 24 months. FTRs completed for other solutions in the AWS Partner's portfolio do not fulfill this requirement.

  2. 2.0Example AWS Customer Deployments

    1. 2.1Production AWS Customer Case Studies

      AWS Partner must privately share with AWS details about four (4) unique examples of Level 1 Managed Security Service Provider projects executed for four (4) unique AWS customers. Each case study must demonstrate how the partner offering was used by a customer to solve a specific Level 1 Managed Security Service Provider customer challenge using AWS.

      In addition to the required case study details provided in AWS Partner Central, the partner must also provide architecture diagrams of the specific customer deployment and information listed in the technical requirements sections of this validation checklist.

      The information provided for these case studies will be used by AWS for validation purposes only. AWS Partner is not required to publish these details publicly.

      AWS Partner can reuse the same case study across different AWS Specialization designations as long as the case study and implementation scope are relevant to those designations. The partner should make sure the existing case study clearly explains the relevance to each designation they are applying for.

      In cases where a case study is used across multiple AWS Partner Specialization applications, the partner must attach a completed self-assessment spreadsheet for each Specialization with all service-specific details provided.

      AWS will accept one case study per customer. Each customer must be a separate legal entity to qualify. The partner may use an example for an internal or affiliate company of the partner if the offering is available to outside customers.

      All case studies must describe deployments that have been performed within the past 18 months and must be for projects that are in production with customers, rather than in a ‘pilot’ or proof of concept stage.

      All case studies provided will be examined in the Documentation Review of the Technical Validation. The partner offering will be removed from consideration if the partner cannot provide the documentation necessary to assess all case studies against each relevant validation checklist item, or if any of the validation checklist items are not met.

    2. 2.2Publicly Available Case Studies

      At least two (2) of the provided case studies must be publicly available examples describing how the AWS Partner used AWS to help solve a specific customer challenge related to Level 1 Managed Security Service Provider. These publicly available examples may be in the form of formal customer case studies, white papers, videos, or blog posts. The partner will provide the publicly available URL (published by the partner) in the AWS Partner Central "Case Study URL' field, which must include the following details:

      • AWS Customer name
      • AWS Partner name
      • AWS Customer challenge that aligns with the scope of the competency and selected category
      • Using both high-level and technical details, describe how AWS was leveraged as part of the AWS Partner solution
      • Outcome(s) and/or quantitative results

      Anonymized Public Case Studies

      In cases where the partner cannot publicly name customers due to the sensitive nature of the customer engagements, the partner may choose to anonymize the public case study. Anonymized public case study details will be published by AWS, but the customer name will remain private. The partner must provide the AWS Customer name in the ‘Company name’ field of the AWS Partner Central case study for validation purposes, but it will not be published by AWS. The case study fields that will be published to Partner Solutions Finder (PSF) by AWS include the ‘Title’, ‘Case Study Description’, and ‘Case Study URL’. The partner will provide the publicly available URL (published by the partner) in the AWS Partner Central‘Case Study URL’ field, which must include the following details:

      • AWS Customer description (e.g. a top 5 US retailer, a Fortune 500 financial institution, etc.)
      • AWS Partner name
      • AWS Customer challenge that aligns with the scope of the competency and selected category
      • Using both high-level and technical details, describe how AWS was leveraged as part of the AWS Partner solution
      • Outcome(s) and/or quantitative results

      For best practice on how to write an accepted Public case study, see the Public Case Study Guide.

  3. 3.0AWS Partner Self-Assessment

    1. 3.1AWS Partner Self-Assessment

      AWS Partner must conduct a self-assessment of their compliance to the requirements of the AWS Level 1 Managed Security Service Provider Consulting Partner Validation Checklist. A version of this checklist is available in spreadsheet format. Links to the appropriate Self-Assessment Spreadsheet can be found at the top of this page.

      • AWS Partner must complete all sections of the Self-Assessment Spreadsheet. For competency with multiple categories, AWS Partners will fill in details for the chosen application Category and mark other Categories as N/A.
      • Completed Self-Assessment Spreadsheet must be uploaded at the time of submitting an application in APN Partner Central.
      • It is recommended that AWS Partner have their AWS Partner Solution Architect, Partner Development Representative (PDR), or Partner Development Manager (PDM) review the completed Self-Assessment Spreadsheet before submitting to AWS. The purpose of this is to ensure the AWS Partner’s AWS team is engaged and working to provide recommendations prior to the validation and to help ensure a positive validation experience.

Level 1 MSSP Requirements

Throughout this checklist, recommendations are provided on AWS Services, AWS Solutions, and third-party products from AWS Security Competency (ISV) Partners that could assist in meeting specific requirements. These suggestions aim to aid AWS Partners in self-assessing whether their current tools align with Competency requirements or to offer guidance on tools that can fulfill unmet requirements. AWS Partners retain the choice to opt for other AWS services or third-party solutions they deem most suitable for their offerings and customer needs. However, it remains the responsibility of the AWS Partner to ensure that the chosen AWS service or third-party product fulfills Level 1 MSSP Competency requirements and aligns with their customers' needs. Additionally, it is the responsibility of the AWS Partner to ensure that they are using the AWS service or third-party product in the correct manner.

General Requirements

These are requirements that are independent of any particular security capability and are focused on how the AWS Partner is delivering their overall service and how they are interacting with their AWS customers. Partners must meet requirements this section to receive the MSSP Level 1 Competency.

  • GEN-001 - Temporary Credentials

    To interact with AWS APIs within customer's AWS account or access the customer's management console, the AWS Partner uses temporary credentials. These credentials can be provided via cross-account roles or federation.

    No IAM User access keys are gathered or stored to facilitate interaction with a customer's environment.

    Evidence: User documentation such as a manual, white paper, or blog demonstrating the process of granting partner access to a customer's account using an External ID generated by the Partner, or guidelines on how to provide temporary credentials to the customer within a Partner-run account.

  • GEN-002 - IAM Policies

    The AWS Partner offers guidance to customers regarding the creation of IAM policies within the customer's AWS account. These policies are intended to facilitate the Partner's appropriate access and interaction with the customer's AWS account(s). The guidance emphasizes scoping policies to least privilege, ensuring they cover only the necessary access required by the Partner.

    Evidence: Documentation showcasing partner guidance, presented in the form of training presentations, white papers, blogs, or other customer-facing guidance materials.

  • GEN-003 - Collection and Reporting Data Across Multiple Customer AWS Resources

    The AWS Partner's platform does not impose any hard limits on the number of AWS accounts or AWS resources, such as EC2 instances, S3 buckets, RDS databases, etc., that can be utilized and reported on for a single customer.

    Evidence: A screenshot or other documentation demonstrating the platform's capability to report on and manage multiple accounts and resources.

  • GEN-004 - Delivery of Security Findings

    Security findings related to a customer's environment are regularly delivered to the customer. This delivery must include a summary report of findings or a dashboard for reviewing findings for a customer's environment and can also include APIs a customer can use to programmatically get information about their security findings.

    Evidence: Sample screenshots or similar examples demonstrating the format and content of a report. Describe the frequency at which customers access this report, such as 'on demand,' 'event-triggered,' or a similar frequency.

AWS Infrastructure Vulnerability Scanning (baseline)

The following requirements cover the AWS Partner's ability to provide vulnerability scanning functionality that allows a customer to evaluate the security and compliance of their AWS infrastructure. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • VULN-001 - Amazon EC2 vulnerability Scanning Solution

    The AWS Partner offers a vulnerability scanning solution that facilitates customers to conduct both unauthenticated and authenticated vulnerability scans on their Amazon Elastic Compute Cloud (Amazon EC2) infrastructure.

    Evidence: Elaborate on the technical solution utilized to fulfill this requirement.

  • VULN-002 - Resource Metadata

    The AWS Partner's vulnerability scanning solution supports collection and display of the AWS metadata that is related to the Amazon EC2 instances that have findings as a result of a vulnerability scan. This information must include: Amazon EC2 tags, Amazon EC2 instance ID, Amazon EC2 AMI ID, Amazon EC2 public and private IP address, Amazon EC2 public and private DNS address, VPC ID, Subnet ID, region, AWS account ID.

    Evidence: Screenshots displaying the visibility of essential metadata in the dashboard or report accessible to the customer.

  • VULN-003 - Detection of new Amazon EC2 instances and Amazon VPC

    The AWS Partner's solution includes automated detection capabilities for newly created Amazon EC2 instances or Amazon Virtual Private Clouds (VPCs) within the customer's AWS environment. Alternatively, the solution offers programmatic updates to notify about new Amazon EC2 instances or Amazon VPCs that necessitate scanning. This functionality eliminates the necessity for customers to manually configure the AWS Partner's vulnerability scanning solution to include new instances or VPCs in subsequent vulnerability scans.

    Evidence: A written explanation detailing how the vulnerability scanning solution fulfills this requirement.

  • VULN-004 - Container Vulnerability Scanning Solution

    The AWS Partner's vulnerability scanning solution enables customers to conduct both unauthenticated and authenticated vulnerability scans on their container instances.

    Evidence: Detailed information about the technical solution employed to meet this requirement.

AWS Resource Inventory Visibility (baseline)

The following requirements cover the Partner's ability to enable a customer to have visibility into the inventory of the AWS resources in their AWS accounts. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • INV-001 - Display of AWS Resource Inventory

    The AWS Partner solution facilitates the display of AWS resource inventory information through a unified user interface (UI). This UI offers comprehensive inventory details categorized by resource type, region, and account. Additionally, customers can access key configuration attributes of each resource, including their associated tags.

    Evidence: Screenshots demonstrating the representation of AWS resource inventory in dashboards or reports accessible to customers.

  • INV-002 - AWS Resource Information Collection

    The AWS Partner solution supports the ability to collect resource information from customer's AWS account in an event-driven fashion.

    Initial discovery of AWS resources in the customer's environment via the relevant AWS describe APIs is allowed for building an initial inventory of AWS resources. After initial resource discovery, additional information on new, updated, or terminated resources is identified through an event-driven approach. Examples include consuming data via AWS CloudTrail logs or AWS Config. It is acceptable to make API calls for individual resources to retrieve additional metadata about new or changed assets or to confirm current inventory information.

    Evidence: A written explanation outlining the approach used by the solution to gather both initial and ongoing resource information from the customer's AWS account.

AWS Security Best Practices Monitoring (baseline)

The following requirements cover the AWS Partner's ability to identify best practices for AWS resources and identify cases where customer's resources do not align to best practices. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • BES-001 - Monitoring for AWS Service Configuration Security Best Practices

    The Partner solution has the ability to report on security best practice violations within customer's AWS account. These best practices must cover at least the following AWS services: Amazon EC2, Amazon S3, Amazon Relational Database Service (RDS), AWS Identity and Access Management (IAM), Amazon Virtual Private Cloud (VPC), Amazon Elastic Block Store (Amazon EBS), Amazon Elastic File System (Amazon EFS), AWS Key Management Service (AWS KMS).

    Common reference points for best practices with AWS services can be found in the security documentation for a service: https://docs.aws.amazon.com/security/

    Evidence: Screenshots demonstrating examples of best practices detection available within dashboards or reports provided to customers.

AWS Compliance Monitoring (baseline)

The following requirements cover the Partner's ability to continuously monitor customer's AWS accounts for alignment to industry compliance standards. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • COM-001 - Continuous Compliance Monitoring

    The AWS Partner solution delivers ongoing compliance monitoring across the configurations of the customer's AWS accounts and their associated AWS resources.

    Continuous compliance monitoring is provided for at least two of the following compliance standards/frameworks/regulations:

    • CIS AWS Foundations Benchmark
    • HITRUST
    • HIPAA
    • ISO 27001
    • MITRE ATTACK
    • PCI DSS
    • SOC 2

    Evidence: Screenshots demonstrating examples of AWS compliance monitoring for each of the supported compliance standards/frameworks/regulations.

Monitor and Triage Security Events (baseline)

The following requirements relate to the AWS Partner's ability to detect threats in customer's AWS environment, triage those findings, and engage a customer for remediation of the findings. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • EVT-001 - Triage

    AWS Partners can assess and enrich security findings in customer's AWS environment, providing additional context and actionable information to help customers reduce false positives and effectively respond to incidents.

    Evidence: A written description of the Partner's approach to triaging security findings from customer's AWS environment.

  • EVT-002 - Remediation Guidance

    The AWS Partner can provide guidance for remediating identified security findings within a customer's environment. Additionally, they possess permissions and capabilities to execute remediation actions directly or offer automated processes to resolve identified security findings on behalf of the customer.

    Evidence: Screenshots or examples demonstrating reported security findings within an AWS account alongside the corresponding recommended remediation steps or guidance provided by the AWS Partner.

  • EVT-003 - 24/7 Response

    The AWS Partner is equipped to continuously detect, prioritize, and promptly alert customers regarding high-priority security findings round the clock, 24/7. These alerts include guidance for remediation of the identified findings in their AWS accounts.

    Evidence: A written description of the Partner's support model for being able to respond to high-priority findings in their customer's AWS accounts on a continuous uninterrupted basis, 24 hours a day and 7 days a week.

  • EVT-004 - Engaging the MSSP for Assistance

    The AWS Partner provides the ability for their customers to engage the MSSP support staff on a continuous uninterrupted basis, 24 hours a day and 7 days a week, for assistance with high-severity security items.

    Evidence: A written description of how the AWS Partner is enabling their customer to engage their support staff for assistance on a continuous uninterrupted basis, 24 hours a day and 7 days a week.

Distributed Denial of Service (DDoS) Mitigation (baseline)

The following requirements cover the Partner's ability to guide and assist a customer with a solution to help with protection against DDoS attacks for the applications they are running on AWS. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • DDOS-001 - Customer Configuration Assistance

    The AWS Partner possesses the necessary resources and expertise to guide customers in selecting and setting up a DDoS protection solution for applications operating within their AWS accounts.

    The DDoS protection solutions recommended or supported by the Partner are required to offer safeguards against layer 3, 4, and 7 attacks.

    Evidence: A comprehensive written description detailing the specific DDoS protection solutions endorsed or supported by the AWS Partner for securing applications within customer's AWS account. Additionally, an articulated engagement model outlining how the Partner assists customers in configuring their selected or recommended DDoS protection solution.

Managed Intrusion Prevention System (IPS) (baseline)

The following requirements cover the ability for the Partner to provide managed intrusion detection and prevention services for customer's AWS account and the workloads running in that account. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • IDP-001 - Agent-Based Solutions

    Agent-based solutions that are used to provide intrusion detection and prevention services are able to run on Amazon EC2 instances with the following operating systems:

    • Amazon Linux2
    • RedHat
    • CentOS
    • Ubuntu
    • Windows

    This item is not necessary if the AWS Partner utilizes a network-based solution as outlined in IDP-002.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to meet this requirement.

  • IDP-002 - Network-Based Solutions

    Network-based intrusion detection and prevention solutions deployed within customers' AWS accounts are required to support highly available architectures, including the following components:

    • Integration with AWS Auto Scaling
    • Integration with Elastic Load Balancing (ELB)
    • Ability to run in a multi-Availability Zone (AZ) configuration
    • Support for automated bootstrapping of instances (e.g., via user data scripts)
    • Worker/support nodes must use AWS Lambda/Step Functions rather than relying on long-lived Amazon EC2 instances

    This item is not necessary if the AWS Partner utilizes an agent-based solution as outlined in IDP-001.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to meet this requirement.

  • IDP-003 - Nitro Amazon EC2 Instance Support

    Intrusion detection and prevention solutions that the AWS Partner deploys into customer's AWS accounts support running on Nitro-based Amazon EC2 instances.

    Solutions support drivers for Elastic Network Adapter (ENA) and NVMe block devices.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to meet this requirement.

  • IDP-004 - Threat Detection - AWS Network or Host Layer

    The Partner has the ability to detect threats at the network or host level of customer's AWS account.

    Evidence: Screenshots demonstrating examples of the technical solution detecting threats at the network or host level for an AWS account.

  • IDP-005 - Threat Detection - AWS API Layer

    The Partner has the ability to detect threats at the AWS API layer of customer's AWS account.

    AWS APIs refers to APIs, provided by AWS, for interacting with the AWS resources in customer's AWS account. This does not cover APIs that a customer has created and deployed for their own applications. An example of a threat detection at the AWS API layer is: detecting the use of IAM access keys from an IP address space that is not normally used by the customer.

    Evidence: Screenshots demonstrating examples of AWS API layer detections that are being detected by the AWS Partner's solution.

  • IDP-006 - AWS Aware Tooling

    The threat detection tools utilized by the AWS Partner incorporate AWS-awareness and contain the detailed AWS metadata related to affected resources within a customer's AWS account. While the specific metadata information for each AWS resource may vary, essential metadata should encompass resource tags, region, account, and resource identifiers that facilitate locating the particular resource through AWS console or APIs. Additionally, supplementary metadata provided about an AWS resource should contribute to the customer's informed decision-making regarding the reported threat.

    Evidence: Screenshots demonstrating the use of the AWS metadata from customer's AWS account as part of the reporting of threats that are delivered in a dashboard or report for customers.

Managed Detection and Response (MDR) for AWS Endpoints (baseline)

The following requirements cover the ability of the Partner to provide and support solutions for managed detection and response for AWS based endpoints. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • MEDR-001 - Operating System Support

    Endpoint solutions provided by the AWS Partner have the ability to run on the following Amazon EC2 operating systems:

    • Amazon Linux2
    • RedHat
    • CentOS
    • Ubuntu
    • Windows

    Evidence: A written description of the technical solution that the Partner utilizes to meet this requirement.

  • MEDR-002 - Endpoint Metadata Support

    The solution provided by the AWS Partner for endpoints within the customer's AWS environment supports the ability to ingest and display the AWS metadata about the EC2 instance on which a deployed agent is running.

    Metadata collected and displayed should include at least: Amazon EC2 tags, Amazon EC2 instance ID, Amazon EC2 AMI ID, Amazon EC2 public and private IP addresses, Amazon EC2 public and private DNS addresses, Amazon VPC ID, Subnet ID, region, and account ID.

    Evidence: Screenshots showing the use of the AWS metadata in the dashboard or report that supports data from the endpoint solution.

  • MEDR-003 - Working Agent Identification

    The solution supported by the partner for deployment on the customer's AWS-based endpoints includes the capability to identify Amazon EC2 instances lacking a functional agent.

    Evidence: Screenshots demonstrating the detection of instances without a working agent within the customer's AWS account.

  • MEDR-004 - Container Support

    The AWS Partner supports a solution that protects containers and integrates with at least one of the following AWS container services:

    • Amazon Elastic Container Service (Amazon ECS)
    • Amazon Elastic Kubernetes Service (Amazon EKS)
    • AWS Fargate

    Evidence: A written description of the technical solution that is used to support this requirement.

  • MEDR-005 - Basic Endpoint Detection and Response (EDR) Capabilities

    The solution supported by the AWS Partner encompasses four fundamental Endpoint Detection and Response (EDR) capabilities defined by Gartner: detection of security incidents, containment of incidents at the endpoint, investigation of security incidents, and provision of remediation guidance.

    Evidence: A written description of the technical solution that is used to support this requirement.

Web Application and API Protection (WAAP) Management (baseline)

The following requirements cover the ability of the Partner to provide solutions and support related to customers deploying Web Application and API Protection (WAAP) technology to protect their applications running in AWS. This is a baseline category. Partners must meet all requirements in this section to receive the MSSP Level 1 Competency.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • WAAP-001 - Addressing Critical Security Risks

    Application protection solutions, potentially including but not limited to Web Application Firewall (WAF) solutions, bot management solutions, API Security solutions, AI Firewalls, that the AWS Partner supports have the ability to address a variety of critical security risks that may include areas such as OWASP Top 10 web application security risks, OWASP API Security Top 10 risks, OWASP Machine Learning Security Top 10 risks, and OWASP Top 10 for Large Language Model Applications security risks, among others.

    Evidence: A written description of the technical solutions that the Partner recommends or supports to meet this requirement.

  • WAAP-002 - Guidance on Rule Authoring

    The AWS Partner has the ability to guide a customer on how to author rules for the application protection solutions, potentially including but not limited to Web Application Firewall (WAF) solutions, bot management solutions, API Security solutions, AI Firewalls, that the Partner recommends and supports.

    Evidence: A written description on how the AWS Partner meets the needs of their customers for this requirement.

  • WAAP-003 - Log Consumption

    The AWS Partner has the ability to consume log data from customer's application protection solutions, potentially including but not limited to Web Application Firewall (WAF) solutions, bot management solutions, API Security solutions, AI Firewalls, on AWS and provide threat analytics and insights on additional rules that should be authored to address observed threats.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

Modern Compute Security (specialization)

The following requirements cover the ability of the Partner to provide managed container workload security event monitoring and response running in AWS. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • MODC-001 - Container Image Vulnerability Scanning

    The AWS Partner offers a vulnerability scanning solution that facilitates the scanning of container images for vulnerabilities in both operating systems and programming languages. The scanning solution should support continuous scanning and on-push scanning, covering a minimum of three Operating Systems (Alpine Linux, Amazon Linux, CentOS Linux, Debian Server) and three Programming Languages (C#, Go, Java, JavaScript, PHP, Python, Ruby, Rust).

    Evidence: Details on the technical solution that is used to meet this requirement.

  • MODC-002 - Container Threat Detection

    The Partner has established policies and procedures for the continuous monitoring of cluster activities to detect potentially threatening or suspicious behavior within container workloads. Identified threats should encompass the following:

    • Access to clusters by known malicious actors or through Tor nodes
    • API operations performed by anonymous users
    • Instances of privilege escalation, such as launching a container with root-level access to the underlying Amazon Elastic Compute Cloud (EC2) host.

    The solution protects containers on at least one of the following AWS container services:

    • Amazon Elastic Container Service (ECS)
    • Amazon Elastic Kubernetes Service (EKS)
    • AWS Fargate

    Evidence: A written description of the technical solution that is used to support this requirement.

  • MODC-003 - Patch Management

    The AWS Partner provides a mechanism for upgrading instances with the latest operating system and application versions.

    Evidence: An example of a policy utilized to ensure the maintenance of adequate security patch levels in container instances.

Managed Application Security Testing (specialization)

The following requirements cover the ability of the Partner to provide an initial solution and ongoing managed services for detecting and responding to security events in code pipelines and applications. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • AST-001 - Code Reviews and Application Development

    AWS Partner provides code-level security expertise and guidance. The Partner either directly develops application code that implements security best practices or provides code review services for customers to proactively identify security issues and address them in custom code bases. These services leverage a combination of automated static analysis, dynamic analysis, and expert reviews.

    Evidence: Any of the following: a customer testimonial, a history within Git/bug tracker systems, or published materials.

  • AST-002 - Runtime Application and Self-Protection (RASP)

    The AWS Partner is required to offer a Runtime Application Self-Protection (RASP) solution and continuously monitor events within their managed services.

    Evidence: Detailed information demonstrating the RASP security solution's capability to detect and block security attacks and anomalies originating from inside a running application.

  • AST-003 - Penetration Testing

    The AWS Partner demonstrates comprehension of AWS penetration testing policies and collaborates with customers to conduct tests, establish protocols for routine penetration testing and vulnerability scanning of their applications and infrastructure while adhering to AWS policies. The Partner assists customers in addressing identified vulnerabilities to align their applications with a target security standard and ensure their AWS environment aligns with the AWS Well-Architected Framework.

    Evidence: A sample report of customer penetration test results that was provided to a customer. Sensitive data such as IP addresses may be redacted for confidentiality.

  • AST-004 - Managed Pipeline Scanning Service

    The managed service automates vulnerability scanning within the CI/CD pipeline and generates reports for analysis and response. The service conducts scans encompassing code, least privilege access, patch management, and network ports and protocols.

    Evidence: A detailed written explanation of the technical solution implemented by the AWS Partner to address this requirement.

  • AST-005 - Dynamic Code Analysis

    The partner conducts Dynamic Code Analysis for deployed applications, collects and triages the events, and either offers remediation guidance or resolves the identified events.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • AST-006 - Static Code Analysis

    AWS Partner performs Static Code Analysis for pre-production apps, collects and triages the events, and either offers remediation guidance or resolves the identified events.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

Data Protection Event Monitoring (specialization)

The following requirements cover the ability of the Partner to provide solutions and ongoing managed services to monitor for security events related to the protection of data integrity, availability, and confidentiality. This includes the discovery of sensitive data in unintended locations, encryption key and certificate management, malware-infected files, unintended transmission of sensitive data, detection of data manipulation, and data erasure. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • DPEM-001 - Data Encryption and Key Management

    Partner must provide details on how they manage cryptographic keys, including rotation and recovery strategies.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • DPEM-002 - Certificate Management

    Partner must monitor SSL/TLS certs for expiration, ensure that keys are stored securely, and implement HSTS (HTTP Strict Transport Security) by default.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • DPEM-003 - Discover and Classify Sensitive Data

    The AWS Partner is required to offer managed sensitive data discovery services and continuously monitor security events for analysis. Moreover, the Partner must issue alerts when sensitive data is identified in an inappropriate location.

    Evidence: The Partner needs to provide a detailed description outlining the tools and methodologies employed for scanning sensitive data and appropriately categorizing it based on classification.

  • DPEM-004 - Amazon S3 Malware Scanning

    Partner must provide the ability to scan for malware in S3 in an API-based, Event-based, or scheduled fashion. Documentation must be accessible to customers and clearly describe the scanning approach.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • DPEM-005 - Data Loss Prevention (DLP)

    The AWS Partner is mandated to conduct scans for sensitive data at rest (storage) and in motion (network) to identify instances of improper usage or exchange of sensitive data.

    Evidence: Screenshots demonstrating the system's methods of labeling data with the relevant classification.

  • DPEM-006 - Data Integrity Monitoring

    The AWS Partner must provide a solution that monitors and alerts on data manipulation events, ensuring the integrity of data.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • DPEM-007 - Data Availability Monitoring

    The AWS Partner must provide a solution that monitors and alerts on data erasure events, ensuring the availability of data.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

Identity Behavior Monitoring (specialization)

The following requirements cover the ability of the Partner to provide solutions and ongoing managed services to monitor and respond to security events generated by identity services running in AWS. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • IDBM-001 - Access Management

    The Partner's solution should offer visibility into identity access rights concerning assets, detailing how identities are mapped to these assets.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • IDBM-002 - Anomalous Access Behavior Detection

    The Partner service should possess the capability to detect and generate alerts when a user accesses resources in an anomalous manner, such as accessing resources outside of work hours or from an unusual location.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • IDBM-003 - Multi-Factor Authentication Management

    The AWS Partner has the capability to manage Multi-Factor Authentication (MFA) tokens for customers, guaranteeing that, at a minimum, root, administrator, auditor, and back-up accounts are safeguarded with MFA.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • IDBM-004 - Secrets Management

    The Partner must offer a solution for managing passwords, keys, and other secrets that securely stores them without using plain text storage.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • IDBM-005 - Adaptive Authentication

    The Partner solution leverages historical logs to generate recommended policy updates aligned with the principle of least privilege.

    Evidence: An example illustrating a recommended policy update automatically generated based on historical logs.

  • IDBM-006 - Single Sign-On (SSO)

    The Partner demonstrates the capability to integrate with major authentication vendors, enabling customers to consolidate and have a unified view of all their AWS and non-AWS accounts.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • IDBM-007 - AWS-Supported Identity Provider

    The Partner is proficient in managing identity provider events from AWS Supported Identity Provider through integration with AWS IAM Identity Center via the System for Cross-domain Identity Management (SCIM) standard.

    Evidence: Show that the external identity provider has been tested with AWS IAM Identity Center SCIM implementation.

  • IDBM-008 - Privilege Access Management (PAM)

    The Partner must be capable of granting access to critical resources through Privileged Access Management (PAM) integration on supported operating systems while also monitoring relevant events.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • IDBM-009 - Identity Federation

    The Partner's solutions should enable the federation of customer employees, contractors, and partners (workforce) to AWS accounts and business applications. Additionally, the Partner should incorporate federation support into public-facing web/mobile applications.

    Evidence: Demonstrated support for a minimum of three widely used open identity standards, including Security Assertion Markup Language 2.0 (SAML 2.0), OpenID Connect (OIDC), and OAuth 2.0.

  • IDBM-010 - Identity Governance & Administration (IGA)

    The Partner solution should offer and monitor events concerning the principle of least privilege and separation of duties throughout the lifecycle of employees who join, move within, or leave the organization.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

Business Continuity and Ransomware Readiness (specialization)

The following requirements outline the Partner's capability to furnish and/or oversee an established Business Continuity solution, encompassing documented procedures and workflows tailored for AWS environments to rebound from an interruption, such as a mass encryption event (ransomware). This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • BCRR-001 - Business Continuity Plan

    The AWS Partner provides customers with a written business continuity plan including the following components:

    • Backup and restore strategy
    • Risk management strategy (accounting for customers' priorities, constraints, risk tolerances, assumptions)
    • Business environment (customers' mission, objectives, stakeholders, cybersecurity roles, responsibilities, and risk management decisions are documented)
    • Assets (documentation of data, personnel, devices, systems, and facilities that enable the customer to achieve business purposes)
    • Supply chain risk management

    Evidence: A sample of a customer Business Continuity Plan that includes Recovery Point Objectives (RPO) and Recovery Time Objective (RTO).

  • BCRR-002 - Isolated Backup Storage

    The Partner's solution implements an isolated backup strategy, keeping backups separate from the production network. This isolation involves distinct access roles and separate Multi-Factor Authentication (MFA) access, akin to audit accounts. Additionally, the solution recommends and enforces immutability for the backups.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • BCRR-003 - Disaster Recovery

    Partner solution keeps critical customer operations up and running in the event of a major system failure.

    Evidence:

    • A detailed written process outlining the steps for recovering from backups in the event of a major system failure. This document should include the methodology for accessing, restoring, and verifying the integrity of backups.
    • Written documentation that specifies the frequency and methodology used for testing the Continuity of Operations (COOP) plan. This may include details on how often the plan is tested, the scope of the tests, and how the tests are performed.
    • A written plan detailing how the Partner facilitates recovery operations in AWS from on-premises systems or other cloud environments in the event of a major system failure. This plan should outline the migration strategy, tools, and steps involved in the recovery process.

  • BCRR-004 - Conduct Recovery Drills

    The AWS Partner undertakes disaster recovery tests biannually to validate the recovery of customer environments to an operational state from backups. Customer involvement is a key aspect to ensure they are prepared for a real disaster event.

    Evidence:

    • A documented plan that outlines the specifics of the disaster recovery testing process. It should detail the scope, objectives, methodology, and schedule of the tests.
    • Documentation describing how customers are involved in the disaster recovery testing process. This should encompass communication plans, customer roles and responsibilities during the testing, and measures taken to ensure customer readiness for a real disaster scenario.
    • Records of the actual tests conducted, including outcomes, findings, successes, and areas for improvement. Additionally, any plans or actions initiated based on these findings to enhance the recovery process should be documented.
    • Feedback or attestation from customers participating in the disaster recovery tests, confirming their involvement, experience, and readiness as a result of these exercises.

  • BCRR-005 - Ransomware Protection and Response

    The AWS Partner solution includes a comprehensive approach to ransomware protection and response. This should address each of the requirements in the NIST National Cybersecurity Center of Excellence (NCCoE) Practice Guides (NIST 1800-11, 1800-25, and 1800-26), and include host and network attack vector mitigation, alongside policy enforcement measures like patch management, digital asset inventory, logging, reporting, vulnerability management, event detection, secure backup, immutable storage, investigation, and analytics capabilities.

    Evidence: Architecture diagram illustrating the components and functionality of the comprehensive anti-ransomware solution.

  • BCRR-006 - Anti-Phishing Solution and Awareness Training

    The AWS Partner can provide a solution that scans email for malicious messages and common phishing tactics. The solution must include detection, remediation actions, and training.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

Digital Forensics Incident Response (specialization)

The following requirements focus on the Partner's capability to offer prompt assistance to incident responders by utilizing the telemetry and data collected as part of their managed security services provided to AWS customers. This is an optional specialization category. Only Partners who want to be listed in this category of the competency should meet requirements in this section.

AWS native services, AWS Solutions Implementations, and third-party products from AWS Security Competency Partners can help satisfy the requirements in this section. For a list of advised tools, please see Supporting Tools for AWS MSSPs.

  • DFIR-001 - Forensics and Evidence Collection

    The Partner should possess the capability and a documented procedure for conducting incident investigations and gathering evidence in a legally compliant format suitable for government investigations, should law enforcement or other legal proceedings arise from the investigation's findings.

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • DFIR-002 - Separate Forensics Account

    Partner solution must include a separate AWS account for forensics investigations with access policies following least privilege access. Amazon VPC subnets in the Forensics account should have no internet gateways and Security Groups should be highly restrictive, and deny all ports that aren't related to the requirements of the forensics tools. The account activity must be auditable at minimum logging all connection activity (SSH, RDP).

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

  • DFIR-003 - Forensics Tools

    The Partner's solution should be capable of gathering data from a selection of at least 5 of the following data sources:

    • All EC2 instance metadata
    • Amazon EBS disk snapshots
    • EBS disks streamed to S3
    • Memory dumps
    • Memory captured through hibernation on the root EBS volume
    • CloudTrail logs
    • AWS Config rule findings
    • Amazon Route 53 DNS resolver query logs
    • VPC Flow Logs
    • AWS Security Hub findings
    • Elastic Load Balancing access logs
    • AWS WAF logs
    • Custom application logs
    • System logs
    • Security logs
    • Any third-party logs

    Evidence: A written description of the technical solution that the AWS Partner utilizes to solve this requirement.

Resources

AWS Specialization Program Guide
Provides step-by-step instructions when applying for an AWS Specialization.
AWS Specialization Program Benefits Guide
Provides a deeper description of the program benefits.
AWS Competency Application Process
Provides high-level visibility into the AWS Competency application process and timelines for associated process steps.
AWS Competency & SDP Common Customer Example Requirement Calibration Guide
Provides control-by-control best practices, resources to implement, good example responses.
How to build a microsite
Provides guidance on how to build a microsite to highlight your AWS Specialization.
How to build a public case study
Provides guidance on how to build a public customer case study that will showcase your success with AWS Customers.
How to build an architecture diagram
Provides guidance on how to build an architecture diagrams that will meet the prerequisites of the Program.
Well Architected Website
Learn about the Well Architected Framework and its approach.
SaaS Best Practices
Provides best practices on SaaS
Changes between previous and current versions
Change Log
Deployment Pipeline Reference Architecture
Learn about the stages and actions for different types of pipelines that exist in modern systems.