AWS Releases Spring 2026 SOC Reports with 188 Services, Now in OSCAL Format

Overview of AWS's Latest SOC Reports

AWS has released its Spring 2026 System and Organization Controls (SOC) 1, 2, and 3 reports, now encompassing 188 services. These reports cover the period from April 2025 to March 2026, offering a full year of assurance to customers about AWS's compliance with cloud service standards.

Introduction of OSCAL Format

For the first time, AWS has made its SOC 1 and 2 reports available in the Open Security Controls Assessment Language (OSCAL) format, alongside the traditional PDF format. This change is significant for the cloud industry as it offers a machine-readable version of compliance reports.

The OSCAL format, standardized by the National Institute of Standards and Technology (NIST), enables workflow automation. This development is expected to enhance the efficiency of compliance processes for AWS customers by reducing the time spent on manual processing.

Impact and Industry Significance

AWS is the first major cloud provider to offer key compliance reports in OSCAL format, marking a step towards enhanced standards in security and compliance automation. This innovation may set a precedent for other cloud service providers to follow, improving the overall efficiency and integration of compliance workflows across the industry.

Accessing the SOC Reports

Customers can access the Spring 2026 SOC 1 and 2 reports via AWS Artifact, a self-service portal for compliance reports. The SOC 3 report is available on the AWS SOC Compliance Page and AWS Artifact. AWS continues to expand the scope of its compliance programs, allowing customers to better meet regulatory and architectural requirements.