What AWS Control Tower is
Control Tower can be used to try and enforce compliant resource creation across your organization, but is less effective as this is becoming accomplished through policy as code instead. The vendor site is aws.amazon.com. This profile is an entry in the oneNorma directory, not a vendor landing page.
What AWS Control Tower covers
AWS Control Tower is in the catalog for these capabilities. Categories: GRC Automation. Catalog tags: Included and Nerdy.
How to evaluate AWS Control Tower in a security program
Use AWS Control Tower as a stack candidate, not as diligence evidence. The oneNorma score for AWS Control Tower is 3.5/10 (percentile 6). If the real gap is in GRC Automation, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what aws.amazon.com publishes. Contrast it with pentesting and Security Cloud & Compliance.