The PCI DSS 4.0 standard became mandatory on April 1, 2024. Because there are many new requirements added to updated PCI standard, enterprises compliance team need to spend a significant amount of time reviewing the documents and performing a gap analysis based on the AWS system configurations, resulting in low assessment efficiency and a risk of human errors. Moreover, AWS Security Hub currently doesn't support the PCI DSS 4.0 rule set, enterprise can't gain visibility into our compliance status.

To address the above challenges, we creates a compliance assessment knowledge base using the Claude 3 Sonnet on Amazon Bedrock, which supports PCI DSS 4.0 assessments. It is designed to help enterprises in the financial industry enhance the efficiency of their compliance assessments with secure, compliant, and responsible GenAI.

This project mainly has three key benefits:

1) Upgraded SecurityHub: Support multiple compliance frameworks and cover multi-cloud and on-premises environments.

2) Direct Q&A with Auditors and Efficient Assessment: Auditors can interact with the knowledge base (KB) to audit the cloud system. The KB also supports bulk filling of audit questionnaires.

3) Business Private Data Integration: Provide customized remediation advice based on enterprise internal data, and support integrating with Jira and Confluence for tracking gaps through tickets (In Progress).

It is estimated to improve the assessment efficiency by 50%.