The SaaS Compliance Stack for AWS: SOC 2, ISO 27001, NIS2 — and What to Actually Implement

You're losing deals because you can't answer the security questionnaire. That's the real problem. Not a lack of frameworks knowledge — a lack of implemented controls that you can point to and prove.

Here's the practical breakdown: four frameworks, what each one requires, and exactly how to implement the evidence in AWS.

The 2026 Compliance Stack for AWS SaaS

Four frameworks come up repeatedly in enterprise sales cycles. Here's what each one means in practice:

ISO 27001 — EU enterprise, banks, and regulated buyers. Proves you have an Information Security Management System (ISMS) with annual audits. This is the one that unlocks the most doors in Europe.

SOC 2 Type II — US enterprise and VC-backed companies. Proves your controls worked consistently over a 3–12 month period. Required if you're selling into the US market or raising from US investors.

NIS2 — EU critical SaaS and supply chain. The EU's updated cybersecurity law. If you sell to essential or important entities in the EU, your customers are now required to assess your security posture.

GDPR — Anyone processing EU personal data. Table stakes. Not a differentiator, but a gap here will kill deals fast.

The good news: ISO 27001 done properly gets you 70–80% of the way to SOC 2. Start there.

What Actually Matters — Evidence in AWS

This is where most compliance programmes fail. A consultant writes you a policy that says "we enforce least-privilege access". An auditor asks for evidence. You open the AWS console and realise your developers have AdministratorAccess.

The controls that matter — and how to implement them in AWS:

IAM + MFA → Annex A.9 + SOC 2 CC6.1 Terraform that enforces least-privilege roles, denies wildcard policies, and requires MFA for all human users. Your IAM state file is your access control evidence.

CloudTrail + AWS Config → Audit trail for all three frameworks Every API call logged, retained for 12 months, and queryable. Config rules that alert on drift. Auditors get a real evidence trail, not a spreadsheet of who you think had access.

S3 + KMS encryption → GDPR + ISO Annex A.10 Terraform that enforces bucket encryption, blocks public access by default, and automates key rotation. One PR. Permanent evidence.

Terraform + GitHub Actions → Change management (ISO A.12, SOC 2 CC8.1) Every infrastructure change reviewed, approved, and merged via pull request. Your Git history is your change management log. This is what auditors actually want to see — not a change request form.

AWS Security Hub → Continuous monitoring (ISO A.16) Aggregates findings from GuardDuty, Inspector, and Config. Gives you a live compliance score and a paper trail of issues raised and resolved.

Most consultants give you a policy. We give you a PR in Terraform.

The Order to Do It In

Sequence matters. Here's the approach that gets you to audit-ready without wasted effort:

ISO 27001 first. It's the broadest framework and the most common requirement in European sales cycles. Getting your AWS environment ISO-ready — IAM hardened, logging enabled, encryption enforced, policies documented — gives you 80% of what SOC 2 needs anyway.

SOC 2 Type II next, if you're selling to the US. Once your controls are implemented and running, you need 3–6 months of evidence before a SOC 2 audit. Start the clock as soon as the controls are live.

NIS2 and GDPR as requirements surface. These are less about a one-time audit and more about ongoing posture. If your ISO 27001 controls are implemented properly in AWS, you're already most of the way there.

The Shortcut Nobody Talks About

The fastest path to compliance isn't hiring a policy writer. It's having someone who can do both: assess the gaps and fix them in your infrastructure on the same engagement.

When your Terraform enforces the control, the policy writes itself. When CloudTrail is logging everything, the audit evidence is automatic. When your CI/CD pipeline runs security checks on every PR, change management is built into how you work.

That's the difference between compliance as a project and compliance as a property of your infrastructure.

Where to Start

Book a free 20-minute Risk Check. I'll look at your AWS setup and tell you which one framework you actually need first — and what it would take to get there.