- Hi, my name's Tim Sandage, I'm a Senior Security Manager
for our Security and Compliance Acceleration Program on AWS.
(upbeat music)
It's primarily built around
our AWS partners that are focused
on security and compliance of AWS workloads.
and those partners and ourselves
help other partners and customers
get through highly regulated workloads.
So, like PCI, Payment Card Industry standard
for protecting credit cards
or in the US federal government, a program called FedRAMP.
It's always interesting to be able
to meet challenges around
how do you help secure various workloads?
It's really fun to be able to dissect
and help our partners and our customers
get through these challenges.
We have it broken down by three major categories.
First, is kind of healthcare and life science,
working with hospitals, insurance companies,
anybody in the healthcare industry.
The second is financial services
in the financial services arena,
and then really public sector,
building security and compliant workloads in the cloud
makes it much easier to achieve and maintain
in that overall high-end posture of security
as well as that compliance capability.
So, what a lot of our customers find out
when they switch to moving regulated workloads to the cloud
is it becomes much easier for them to operate,
because they have this single pane of glass
that they can see at any given moment
throughout the life cycle of their workload.
We have this thing called
Shared Responsibility Model on the cloud.
AWS does portions of managing the cloud infrastructure
and managing the capabilities for our customers
to be able to consume and use the cloud
in their customer accounts.
But then when they build their own security
and compliance capability inside the AWS customer account,
we aren't necessarily able to be hands on with them.
And so, what we do is we leverage our partner community.
That's what our program is really built around
is those partners making sure
that we have the right partners for the right regulations
and the right workloads to really
help our customers excel in this space.
One of the biggest challenges for us within AWS,
especially as we started seeing the demand
for regulated workloads coming to AWS
was traditionally these types of regulated workloads
take anywhere from 18 to 24 months
for somebody to achieve the outcome,
the security certification or the accreditation on premise.
And so, that was the first step was
how do we reduce that timeframe.
Technology costs are technology costs,
but consulting costs are usually based on billable hours.
If it takes me 18 to 24 months to do this
and the cost is x.
Now, the fact that we're able
to reduce that down to 9 or 10 months,
it's obviously reducing that time and effort,
but it's really reducing the cost.
Everybody on my team now today
is all former practitioners of some sort.
We all have vast experience in this space.
And so, in a lot of cases,
we're doing a lot of what I call free consulting.
We bring in a lot of breadth and depth of experience
when we come in and start working
with our partners and our customers.
So that again, it goes back to accelerating
how do the customers then consume our services quicker,
and with more ease from a security
and compliance standpoint?
We at AWS can't do it all.
And our partners in a lot of cases
can't do it all by themselves,
but together, we're all better to be able
to deliver a stronger security and compliance message.
And so, that's where we bring all these partners together
to really create that end-to-end security picture.
Maybe it's one partner that's opened the door
to sell that solutions stack,
but the other partners benefit.
So, it's somewhat triples,
if not quadruples their sales force.
Our top priority is security,
but then the second piece is
how do we help elevate our partners
and make sure that they're
strengthening themselves in the market.
With our team, you can reach out through our website
it's called ATO on AWS.
There's an intake form as well as we have a email alias
ATOonAWS@amazon.com.
Both will come in everybody on my team,
you can submit a questionnaire
around the type of regulatory industry
that you're looking for,
whether it's FedRAMP, HIPAA, High Trust,
wherever the case may be.
And then we'll push that to the various personnel on my team
that supports that industry or supports that vertical.
And then you can also reach out to your account team
or even your partner account managers.
They also know how to get a hold of us
so that we can give direct support to the customers.
And there's a link to partners
and it has a full listing of all the partners
that are on our program.
And it has detailed descriptions
of what their capabilities are.
It links back to their Amazon partner network listing.
Gives more details of their skills and capabilities.
Even in some cases, if they're sold on AWS Marketplace,
you can go directly to Marketplace
where you can actually see what
their pricing models and so forth are.
Then it's just been an amazing journey of seeing
all of the different innovations and capabilities
that AWS has brought not only to AWS
and our customers and our partners,
but then programs such as those
that are focused on regulated workloads.
And we're really doubling down on making sure
that we're able to support any geography around the world.
(upbeat music)