CloudCostCompare
FR

Cette page n’est pas encore disponible en Français, le texte ci-dessous est donc en anglais. Ouvrir la page en anglais

Cloud compliance programs

Which compliance programs each cloud names on its own pages, with a link to the vendor page for each.Programs listed: Microsoft Azure 16 of 16, Amazon Web Services 16 of 16, Google Cloud 16 of 16, Oracle Cloud 16 of 16.

Which compliance programs each vendor names on its own compliance pages. A program named here is the vendor's claim, linked to its page. It does not say which services or regions are covered; that is on the vendor's page for each program, and it is the part to check before relying on it. A program that a vendor does not name on the page checked is shown as "not named", which is not a finding that the vendor lacks it. Some entries are laws or guidelines rather than certificates (GDPR, HIPAA, MeitY): a cloud can support them, but the customer is still responsible for how a workload is built and run.

All 16 programs below are named by all four clouds, so this table does not separate them. What does differ is which services, regions and report dates each program covers, and that is on each vendor's page.

ProgramMicrosoft AzureAmazon Web ServicesGoogle CloudOracle Cloud
ISO/IEC 27001An international standard for managing information security.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
ISO/IEC 27017Security controls specific to cloud services.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
ISO/IEC 27018Protection of personal data in public clouds.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
SOC 1An auditor's report on controls relevant to customers' financial reporting.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
SOC 2An auditor's report on security, availability and related controls.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
SOC 3A public summary of a SOC 2 style report.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
PCI DSSThe payment card industry's data security standard, for systems that handle card data.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
HIPAAUS rules for health information. A cloud can support HIPAA workloads; the customer still has to configure and operate them correctly.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
GDPRThe EU's data protection law. It is a law to follow, not a certificate a cloud holds; vendors publish how they support customers' compliance.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor pageOracle names GDPR on its list and publishes guidance as an advisory document.
FedRAMPThe US federal government's cloud security authorization program.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
CSA STARThe Cloud Security Alliance's registry of cloud security assessments.Named on vendor pageAzure lists CSA STAR attestation, certification and self-assessment as separate offerings.Named on vendor pageNamed on vendor pageNamed on vendor page
MeitY (India)India's IT ministry security guidelines for government use of cloud services.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor pageOracle names the MeitY IT Security Guidelines.
IRAP (Australia)Australian government security assessments of cloud services.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
C5 (Germany)Germany's BSI cloud security criteria catalogue.Named on vendor pageNamed on vendor pageNamed on vendor pageGoogle's page is titled BSI C5:2020.Named on vendor page
HITRUST CSFA security framework used mainly in US healthcare.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page
ENS (Spain)Spain's national security scheme for public-sector systems.Named on vendor pageNamed on vendor pageNamed on vendor pageNamed on vendor page

Where the entries come from

  • Microsoft Azure: the vendor's compliance page, read 3 Nov 2026. Read from Microsoft's Azure compliance documentation page, which links each offering.
  • Amazon Web Services: the vendor's compliance page, read 3 Nov 2026. Read from AWS's compliance programs page. Cells link to that page, since a program page per entry was not checked.
  • Google Cloud: the vendor's compliance page, read 3 Nov 2026. Google's offerings page loads its list with scripts, so each program was confirmed from its own page on cloud.google.com, which each cell links to.
  • Oracle Cloud: the vendor's compliance page, read 3 Nov 2026. Read from Oracle's cloud compliance page. Cells link to that page.

The list is kept by hand and was last read 3 Nov 2026. Vendors add programs and let reports lapse, so open the vendor's page, and its current report, before relying on any entry. The same data is in the price API. For India, the cloud's MeitY entry is about government use of cloud services; it is separate from RBI and sector rules, which are not covered here. This page is English only for now.