AWS has refreshed its Outsourced Service Provider’s Audit Report (OSPAR) for the Asia Pacific (Singapore) Region, adding five services and increasing the total in‑scope count to 167. The update is significant for engineers and security teams because OSPAR is cited in the Association of Banks in Singapore (ABS) guidelines that many financial institutions rely on for cloud‑provider compliance evidence.
Scope change details
The July 29 2026 assessment, performed under the OSPAR version 2.0 framework, now includes the following services:
- Amazon Application Recovery Controller
- AWS Artifact
- AWS Deadline Cloud
- AWS Parallel Computing Service (AWS PCS)
- AWS Security Incident Response
These additions bring the overall number of AWS services covered in the Singapore region to 167.
Implications for architecture and operations
When designing workloads for Singapore‑based financial customers, the expanded list offers a broader set of services that already meet the ABS control objectives. Architects can now consider these services without needing separate compliance assessments, which can simplify multi‑service designs such as disaster‑recovery orchestration with Application Recovery Controller or high‑performance compute using AWS PCS.
Operational teams gain a single source of truth for compliance evidence: the OSPAR report is available through AWS Artifact, a self‑service portal. Accessing the report via Artifact can replace ad‑hoc evidence collection and reduce the time spent on audit preparation.
Security and compliance considerations
The ABS Guidelines cover areas like cyber hygiene, data security, cryptography, and software development practices. Inclusion of a service in OSPAR indicates that AWS has demonstrated alignment with those baseline controls for the Singapore market. Practitioners should still verify that their specific configuration and usage patterns satisfy internal security policies, but the report provides a documented baseline.
For security engineers, the presence of AWS Security Incident Response in the scope means that the service’s internal processes have been reviewed against the ABS criteria, which can be referenced when defining incident‑response playbooks that involve AWS‑managed capabilities.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
- Review the OSPAR report in AWS Artifact to confirm which services are covered and capture the compliance artefacts needed for customer audits.
- Consider adopting the newly‑included services for new projects targeting Singapore financial customers, knowing they already meet ABS‑referenced controls.
- Update internal compliance checklists to reference the expanded service list, reducing duplicate evidence‑gathering efforts.
- Monitor future OSPAR announcements, as AWS plans to broaden the program’s scope based on customer and regulatory demand.