Effective 18 September 2026, Amazon Web Services announced that 172 of its services and features have passed the Cloud High (PBHH) security assessment conducted by the Canadian Centre for Cyber Security. This makes AWS the first cloud provider in Canada to achieve the high‑integrity and availability requirements defined for Protected B workloads. Practitioners building or operating sensitive workloads now have a documented assurance artifact that can be referenced during design reviews, compliance audits, and risk assessments.
Scope and regional coverage
The assessment covers services that are available in both the Canada (Central) and Canada West (Calgary) regions. It builds on the existing Cloud Medium (PBMM) profile, adding controls that address the higher integrity and availability expectations of the Cloud High profile. The underlying framework references the Government of Canada’s ITSP.10.033 catalogue, which defines the baseline security and privacy controls for federal systems.
Impact on architecture and operations
For AI engineers, cloud/platform engineers, DevOps/SRE teams, and security engineers, the Cloud High assessment introduces several practical considerations:
- Service selection: Any service listed in the 172‑service set can now be used for workloads classified at the Protected B level without needing additional justification or supplemental controls.
- Regional deployment: To retain the assessment coverage, workloads must remain in the Canada Central or Canada West regions. Cross‑region replication or fail‑over to regions outside this scope would fall outside the certified boundary.
- Compliance evidence: The assessment report, available through AWS Artifact, can be attached to internal audit packages, reducing the effort required to demonstrate compliance with federal security requirements.
- Operational monitoring: Teams should align their monitoring and incident‑response processes with the controls highlighted in the Cloud High profile, ensuring that any deviations are captured and reported according to the CCCS expectations.
Accessing the assessment evidence
The summary report is published on AWS Artifact, the portal used for compliance documentation. Practitioners should request the latest version of the Cloud High assessment from Artifact and store it in a controlled location that is accessible to audit and security review teams. Regularly checking Artifact for updates will ensure that any newly added services or revised controls are incorporated into the organization’s compliance posture.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Engineers should treat the Cloud High assessment as a baseline guarantee for the listed services when designing Protected B workloads in Canada. Immediate actions include:
- Verify that all required services are part of the 172‑service list before committing to a design.
- Confirm that deployment regions are limited to Canada Central or Canada West to stay within the assessment scope.
- Download the latest assessment report from AWS Artifact and integrate its control mappings into your internal compliance matrix.
- Monitor AWS communications for future expansions of the assessment scope, as additional services may become eligible for Cloud High certification.
By aligning architecture decisions with the Cloud High assessment, teams can reduce compliance overhead, accelerate delivery of high‑sensitivity applications, and maintain a clear audit trail for federal security requirements.
