The best cloud platform for bank security and compliance

Google's SOC 2 page puts the core Google Cloud SOC 2 Type II reports on a quarterly release cycle, and its Compliance Reports Manager offers them for download with no separate access fee. Those two facts and a Google-written mapping to the FFIEC booklet on outsourcing technology services are why we name Google Cloud the best cloud platform for a bank assessing its cloud provider's audit evidence. Microsoft's SOC 2 page for Azure and AWS's SOC page each describe SOC 2 reports issued twice a year.

Microsoft's FFIEC page names a cloud security diagnostic tool and a companion workbook for FFIEC work, and Microsoft publishes a guide to 23 NYCRR Part 500, New York's cybersecurity regulation. Azure is the better pick for a bank that is choosing Azure services and wants that material alongside them. AWS is the better pick for a bank that keeps its workloads on AWS: its Part 500 guide addresses the Second Amendment to the rule, with a sample rule mapping in AWS Config and report access through AWS Artifact.

What should a bank weigh in cloud audit evidence?

The interagency guidance on third-party risk discusses the types and frequency of reports a provider supplies, independent audits and a bank's access to supporting records among the contract terms a bank considers, scaled to the risk of the relationship. For entities under New York's rule, section 500.11 of the amended Part 500 requires periodic assessment of providers based on the risk they present. Google's SOC 2 page, Microsoft's Azure SOC 2 page and AWS's SOC page each describe reports that span twelve months, so the schedules differ in how often a newly audited period reaches the bank. Ask each provider which document covers the months since its last report and who signs it.

FedRAMP's scope rules address cloud services that federal agencies use to handle federal information, and its agency guidance has each agency review a package and authorize its own use. A FedRAMP label therefore tells a bank about a named offering assessed for federal use. Read each label as the provider or the FedRAMP Marketplace publishes it, then check that your workload's services and regions fall inside that offering's boundary. The program's class guide says certification class and impact level have no direct correlation, and its notice on certification classes says a baseline defines the scope of the assessment.

The ISO/IEC 27001 pages from Google Cloud, Azure and AWS each name the 2022 edition of the standard, and each leaves a customer's own certification to the customer. Card data follows the same division of duties: Microsoft's PCI DSS page says Azure's status does not automatically become PCI DSS validation for a service built on Azure. Obtain each provider's current attestation of compliance (AOC) and check its level and scope against your cardholder systems before you rely on it.

The New York Department of Financial Services wrote in its guidance on third-party risk that a covered entity cannot delegate responsibility for complying with the cybersecurity regulation to a third-party provider. Use the provider's mapping or guide to prepare contract review and due diligence, and confirm which edition of the rule it addresses.

The FFIEC's statement on cloud computing notes that a provider can limit a bank's direct assessment and points banks to the independent reports a provider makes available and to cloud-native security and configuration tools. Before you sign, establish who at the bank downloads each report and whether its confidentiality terms let the bank pass it to an examiner or an outside auditor. Ask for the charge on each compliance tool in the proposal as its own line.

Google Cloud, Azure and AWS on audit evidence for banks

Google Cloud: the core report cycle and the reports manager

Google's SOC 2 page sets out the core cycle report by report, with a coverage window and an estimated release period for each. That cycle belongs to the core Google Cloud and Workspace reports. Some products have further SOC 2 Type II reports, which follow semiannual or annual schedules.

Google produces a bridge letter each month for the time since the latest report. The reports manager carries the core letters for periods that end with a calendar quarter, and other period ends and product scopes go through sales or support. Google describes the letters as management attestations, a separate document from the independent SOC report.

Compliance Reports Manager gives on-demand access to SOC reports, ISO certificates and self-assessments, and some resources require a Google Cloud or Workspace sign-in. Material marked Google Confidential Information falls under the confidentiality terms in the customer's or partner's agreement, and sharing it outside the organization can require permission from the sales representative. Settle that permission before an examiner asks for a report. FedRAMP documents take another route: Google's FedRAMP page offers the System Security Plan and Customer Responsibility Matrix under NDA through sales or a Google Cloud representative.

Google's FFIEC mapping takes the Outsourcing Technology Services booklet and sets Google's commentary on its due diligence and contract sections against the Google Cloud Financial Services Contract. A bank's contract review can start from it, with the bank's own due diligence to follow. The mapping is Google's reading of the booklet, written against Google's own contract.

The FedRAMP Marketplace record for Google Services lists a public-cloud offering certified under Rev5 with a Class D (High) profile. Google's scope documentation keeps services and regions in separate tables and limits High suitability to listed regions in the United States. A component or feature of an authorized service can be explicitly excluded, so check the workload's services against the service table one at a time.

Google's PCI DSS page says an independent Qualified Security Assessor reviews its services and describes them as meeting PCI DSS 4.0.1. Customers remain responsible for the PCI DSS compliance of the applications they build, the page adds. Request the current AOC through the reports manager and read its level and service scope before you map it to your cardholder systems. The ISO page lists covered services and directs customers to the same manager for the certificate.

Assured Workloads has a monitoring feature that shows the state of a FedRAMP workload and supplies control attestations to auditors. Google's pricing page for it lists the Moderate boundary among the options with no added charge.

Microsoft Azure: FFIEC resources and Part 500 guidance from Microsoft

Microsoft's FFIEC page names an Excel-based cloud security diagnostic tool, which Microsoft describes as prepopulated with how Azure meets requirements such as the FFIEC IT handbooks, and a companion workbook on using Azure services against FFIEC requirements. Both download from the compliance guides in the Service Trust Portal. The same page cites the FFIEC position that a bank should use other verification and monitoring procedures beside audit reports, and it tells the customer to determine whether Microsoft's services meet the rules that apply to its institution. A Purview Compliance Manager template for FFIEC is a premium feature of a separate Microsoft product.

Microsoft's Part 500 page describes a guide to supporting New York's cybersecurity requirements with Azure, Microsoft 365 and Power BI. The page walks through the rule's topics, from the cybersecurity program and audit trail to third-party provider security and incident response, and names Microsoft Defender for Cloud among the tools. Confirm with Microsoft that the guide addresses the amended rule before you build a review on it.

Microsoft's SOC 2 page puts Azure, Dynamics 365, Power Platform and select Microsoft 365 services in the Azure SOC 2 Type 2 report. Bridge letters go out in the first week of each quarter and cover the prior three months. Azure DevOps has a SOC 2 Type 2 report of its own.

Reports sit in the Service Trust Portal behind a Microsoft Entra organization account and Microsoft's non-disclosure agreement for compliance materials. A customer with a Microsoft 365, Dynamics 365 or Azure subscription, trial or paid, signs in with that account, and a new customer can open a trial account to get access. For FedRAMP material, Microsoft's FedRAMP page puts the Azure Commercial System Security Plan in the portal for signed-in users with an Azure subscription or free trial. The Marketplace package request needs a .gov or .mil email address, and select documents such as continuous monitoring reports come under NDA through the Microsoft account representative once access is authorized.

Microsoft's compliance scope page states a FedRAMP High provisional authorization for all Azure public regions in the United States and a separate High authorization for Azure Government. Azure regions outside the United States are outside that authorization, by Microsoft's FedRAMP page. Per-service footnotes narrow some entries: Azure Databricks holds High in limited regions.

Microsoft's PCI DSS page states Service Provider Level 1 status validated by an approved Qualified Security Assessor, and the AOC package holds separate attestations for Azure and Azure Government. Pick the one that matches your environment and read its version and date.

The ISO page puts Azure, Dynamics 365, Power Platform and select Microsoft 365 services on one certificate and Azure DevOps on its own. Azure Policy has built-in regulatory compliance initiatives mapped to FedRAMP High and Moderate, ISO/IEC 27001 and PCI DSS, and Microsoft says Policy compliance gives only a partial view of overall compliance.

Amazon Web Services: a Part 500 guide for the Second Amendment, with Config and Artifact

The AWS Compliance Guide to NYDFS Cybersecurity Regulation, dated July 2024, addresses the Second Amendment to Part 500 and walks the regulation section by section with compliance dates and a note on customer responsibility. Its notices page describes the guide as informational, with no commitments or assurances from AWS.

An AWS Config conformance pack maps Part 500 controls to AWS managed Config rules, and AWS describes conformance packs as sample templates that are not designed to ensure full compliance with a standard. A bank new to AWS should plan without Audit Manager: AWS closed it to new customers, and from April 30, 2026 it cannot be set up in new accounts. Existing customers continue to use it. AWS points buyers to Config conformance packs and notes that Config has no template for some frameworks Audit Manager supports, SOC 2 among them, and no directly equivalent audit-report export.

AWS Artifact provides on-demand downloads of AWS's ISO, PCI and SOC documents free of charge. Every AWS account has access, the Artifact FAQ says: root and IAM administrator users download reports after agreeing to terms, and other IAM users need permissions granted. Reports and agreements require accepting the Artifact nondisclosure agreement, or an existing NDA with Amazon that covers the same information. AWS says customers can give audit artifacts to their auditors or regulators as evidence and can create IAM credentials scoped to each auditor.

AWS's SOC page puts SOC 1 and SOC 2 downloads in Artifact and describes SOC 3 as a public summary of SOC 2. A bridge letter for SOC 1 and SOC 2 is updated monthly, generally in the first week of the month. Regions are listed in the SOC 3 report and services on AWS's Services in Scope page, and new regions join at the next review cycle.

The FedRAMP Marketplace lists AWS US East/West at Class C (Moderate) and AWS GovCloud (US) at Class D (High), and AWS's FedRAMP page sends high-impact workloads to GovCloud. GovCloud is a separate environment with its own account ID and credentials. AWS's GovCloud FAQ restricts access to U.S. persons not subject to export restrictions and describes a GovCloud-specific agreement beside the customer agreement, so a bank with a High requirement should confirm its eligibility with AWS first. FedRAMP compliance adds nothing to service cost in any region, AWS says, and commercial customers get a partner package of FedRAMP material through Artifact or their account manager.

AWS's PCI DSS page states certification as a PCI DSS Level 1 Service Provider and says the locations covered appear in the latest AOC in Artifact. A customer's assessor can rely on that AOC for the part of the cardholder environment deployed in AWS, by AWS's account, and the customer manages its own PCI DSS certification. The ISO page lists regions on the certificate and services on a separate page, and says customers do not inherit the certification.

Which cloud platform should a bank choose for security and compliance evidence?

Google Cloud is our pick for a bank assessing its cloud provider's audit evidence. Its core SOC 2 reports arrive on a more frequent release cycle than the schedules Microsoft and AWS describe, and the reports manager that holds them charges no separate access fee. The FFIEC mapping adds a Google-written document for the due diligence and contract topics in a bank's outsourcing review. We weigh the release cycle first because Part 500 has a covered bank reassess its provider periodically, and a more frequent core report puts a newly audited period in front of that review more often.

Google's FedRAMP page makes High workloads conditional on the Assured Workloads boundary configured for High together with Assured Support, and the Assured Workloads pricing page places that boundary in a Premium tier that adds 20% to Google Cloud usage inside its folder. Microsoft states its High authorization across Azure public regions in the United States. A bank planning a FedRAMP High workload on Google Cloud should have the boundary, the support plan and the affected folders quoted together. We still weigh the report cycle more for this buyer, because the core SOC 2 report is evidence a bank reads with or without a FedRAMP requirement.

Microsoft's FFIEC diagnostic tool and workbook, its Part 500 guide and its Policy initiatives all describe Azure services, which makes Azure the better pick for a bank that is choosing those services and wants the vendor's bank-facing material beside them. Read the workbooks as Microsoft's account of its own controls, and confirm the Part 500 guide's edition if New York regulates you. The reports behind that material come through the Service Trust Portal under the compliance NDA.

AWS's Part 500 guide addresses the Second Amendment by name, and a sample Config conformance pack lines the rule's controls up against Config rules. For a bank that keeps its workloads on AWS and answers to New York's rule, that makes AWS the better pick, with Artifact as the documented way to pass AWS reports to an auditor or regulator. A bank opening its first AWS account builds that process without Audit Manager.

Other cloud platforms