[AWS Artifact] Document AWS Reg S-P compensating controls

[JFWooten4]

AWS’s public DPA states that AWS will notify customers of a Security Incident “without undue delay.” Reg S-P § 248.30(a)(5)(i)(B), however, requires covered institutions’ service-provider oversight procedures to be reasonably designed to ensure service-provider notice as soon as possible, but no later than 72 hours after the service provider becomes aware of a covered breach.

Because AWS’s standard public language may not include a hard 72-hour cap, document compensating controls in the AWS vendor-risk file.

Warning

Still must conform; I'll see what I can do. 1st of many cloudlog setups downto CRONs in JFWooten4/agenda#18

Idea:

Tasks

• Save current AWS Customer Agreement, Service Terms, DPA, and AWS Artifact reports.
• Request AWS written confirmation or addendum for Reg S-P 72-hour incident notice.
• Save AWS’s response.
• Confirm AWS account root/admin/security contacts are current.
• Configure AWS security notices to reach a monitored inbox.
• Confirm MFA and least-privilege access for all AWS users.
• Confirm CloudTrail, GuardDuty, Security Hub, AWS Config, and CloudWatch alerts are enabled where applicable.
• Document customer-information minimization, encryption, and segmentation controls.
• Add AWS to annual critical-vendor review.
• Add AWS incident-notice intake to the incident-response procedure.

Acceptance criteria

• Vendor file explains the contract gap.
• Vendor file includes AWS terms and AWS response.
• Compensating controls are documented and assigned.
• Incident-response plan explains what BlockTransfer does immediately upon AWS notice or internal AWS-related detection.