CGPulse

Sign In

ISO 27001: Information Security

AWS 55 automated checks

Information security management controls aligned with ISO/IEC 27001:2022 Annex A for AWS resources

Access Control (A.9)

IAM root user must not have access keys A.9.2.3 · Critical
IAM user must have MFA enabled A.9.4.2 · Critical
IAM group should be used for permission management A.9.2.3 · Low
IAM policy must be attached and in use A.9.1.2 · Low
Cognito user pool must enforce MFA A.9.4.2 · Critical
RDS instance must have IAM database authentication enabled A.9.2.1 · Medium

Asset Management (A.8)

EC2 instance must have an IAM instance profile attached A.8.1.1 · High

Communications Security (A.13)

RDS instance must not be publicly accessible A.13.1.1 · Critical
Redshift cluster must not be publicly accessible A.13.1.1 · Critical
S3 bucket must block all public access A.13.1.1 · Critical
Security group must not allow unrestricted ingress (0.0.0.0/0) A.13.1.1 · Critical
EKS cluster must disable public API endpoint access A.13.1.1 · High
Lambda function should be deployed in a VPC A.13.1.1 · Medium

Cryptography (A.10)

S3 bucket encryption should use SSE-KMS with a customer-managed key A.10.1.1 · Medium
S3 bucket must have server-side encryption enabled A.10.1.1 · High
RDS instance must have storage encryption enabled A.10.1.1 · High
RDS cluster must have storage encryption enabled A.10.1.1 · High
EBS volume must be encrypted A.10.1.1 · High
EBS volume should use a customer-managed KMS key A.10.1.2 · Medium
DynamoDB table must have server-side encryption enabled A.10.1.1 · High
EFS file system must be encrypted at rest A.10.1.1 · High
KMS key must have automatic key rotation enabled A.10.1.2 · High
CloudFront distribution must use TLS 1.2 minimum A.10.1.1 · High
Load balancer listener must use a secure SSL policy A.10.1.1 · High
Elasticsearch domain must enforce HTTPS A.10.1.1 · High
ElastiCache replication group must have in-transit encryption enabled A.10.1.1 · High

ISMS Audit

Organization should conduct internal information security audits 9.2 · High

Operations Security (A.12)

CloudTrail trail must be multi-region A.12.4.1 · Critical
CloudTrail trail must have log file validation enabled A.12.4.1 · High
AWS Config must record all supported resource types A.12.4.1 · High
VPC must have flow logs enabled A.12.4.1 · High

Organizational Controls (A.5)

IAM password policy must require minimum length of 14 A.5.1 · Medium
IAM password policy must require minimum length of 14 A.5.24 · Medium
IAM password policy must require minimum length of 14 A.5.29 · Medium
IAM password policy must require minimum length of 14 A.5.31 · Medium
Organization should maintain an information security policy approved by management A.5.1 · High
Organization should define information security roles and responsibilities A.5.2 · High
Organization should maintain contact with relevant authorities A.5.5 · Medium
Organization should collect and analyze threat intelligence A.5.7 · Medium
Organization should integrate security into project management A.5.8 · Medium
Organization should maintain an inventory of information assets A.5.9 · High
Organization should classify information according to confidentiality requirements A.5.12 · High
Organization should manage information security in supplier relationships A.5.19 · High
Organization should establish incident management procedures A.5.24 · Critical
Organization should have procedures for evidence collection and preservation A.5.28 · Medium
Organization should integrate security into business continuity management A.5.29 · High
Organization should identify applicable legal and regulatory requirements A.5.31 · High

People Controls (A.6)

IAM password policy must require minimum length of 14 A.6.3 · Medium
Organization should perform personnel screening A.6.1 · Medium
Organization should provide information security awareness and training A.6.3 · High
Organization should have a disciplinary process for security violations A.6.4 · Medium
Organization should define security responsibilities upon termination A.6.5 · High

Physical Controls (A.7)

Organization should define and protect physical security perimeters A.7.1 · Medium
Organization should implement clear desk and clear screen policies A.7.7 · Low
Organization should manage removable media securely A.7.10 · Medium

Measure your ISO 27001: Information Security posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation