CGPulse

Sign In

NIST 800-53: Cloud Security Controls

AWS 58 automated checks

Security and privacy controls mapped to NIST SP 800-53 Rev. 5 for AWS resources

Access Control (AC)

IAM root user must not have access keys AC-6 · Critical
IAM group should be used for permission management AC-3 · Low
IAM policy must be attached and in use AC-3 · Low
S3 bucket must block public ACLs AC-3 · Critical
Organization should establish access control policies (AC-1) AC-1 · High
Organization should manage information system accounts (AC-2) AC-2 · High
Organization should enforce separation of duties (AC-5) AC-5 · High

Audit & Accountability (AU)

CloudTrail trail must be multi-region AU-2 · Critical
CloudTrail trail must have log file validation enabled AU-9 · High
CloudTrail trail should be encrypted with a KMS key AU-9 · High
AWS Config must record all supported resource types AU-12 · High
VPC must have flow logs enabled AU-12 · High
CloudWatch log group must have a retention period configured AU-11 · Medium

Audit and Accountability (AU)

Organization should review and analyze audit records (AU-6) AU-6 · High

Awareness & Training (AT)

IAM password policy must require minimum length of 14 AT-2 · Medium

Awareness and Training (AT)

Organization should provide security awareness training (AT-2) AT-2 · High
Organization should provide role-based security training (AT-3) AT-3 · Medium

Configuration Management (CM)

EC2 instance must not use a deprecated instance metadata version CM-6 · High
EC2 instance must have an IAM instance profile attached CM-7 · High
Organization should establish configuration management policy (CM-1) CM-1 · High

Contingency Planning (CP)

RDS cluster backup retention should be at least 14 days CP-9 · Medium
RDS instance must have Multi-AZ enabled CP-10 · High
DynamoDB table must have point-in-time recovery enabled CP-9 · High
Organization should develop a contingency plan (CP-2) CP-2 · High
Organization should test the contingency plan (CP-4) CP-4 · High

Identification & Authentication (IA)

IAM user must have MFA enabled IA-2 · Critical
Cognito user pool must enforce MFA IA-2 · Critical
RDS instance must have IAM database authentication enabled IA-2 · Medium

Incident Response (IR)

IAM password policy must require minimum length of 14 IR-1 · Medium
Organization should develop an incident response plan (IR-1) IR-1 · Critical
Organization should train incident response personnel (IR-2) IR-2 · High
Organization should test incident response capability (IR-3) IR-3 · High

Planning (PL)

IAM password policy must require minimum length of 14 PL-2 · Medium
Organization should develop a system security plan (PL-2) PL-2 · High

Program Management (PM)

IAM password policy must require minimum length of 14 PM-9 · Medium

Risk Assessment (RA)

IAM password policy must require minimum length of 14 RA-3 · Medium
Organization should conduct risk assessments (RA-3) RA-3 · Critical
Organization should perform vulnerability scanning (RA-5) RA-5 · High

Security Assessment (CA)

Organization should conduct security assessments (CA-2) CA-2 · High
Organization should maintain a Plan of Action and Milestones (CA-5) CA-5 · High

System & Communications Protection (SC)

Load balancer listener must use a secure SSL policy SC-8 · High
CloudFront distribution must use TLS 1.2 minimum SC-8 · High
Elasticsearch domain must enforce HTTPS SC-8 · High
ElastiCache replication group must have in-transit encryption enabled SC-8 · High
Security group must not allow unrestricted ingress (0.0.0.0/0) SC-7 · Critical
RDS instance must not be publicly accessible SC-7 · Critical
Redshift cluster must not be publicly accessible SC-7 · Critical
S3 bucket must block all public access SC-7 · Critical
EKS cluster must disable public API endpoint access SC-7 · High
Lambda function should be deployed in a VPC SC-7 · Medium
S3 bucket encryption should use SSE-KMS with a customer-managed key SC-28 · Medium
RDS instance must have storage encryption enabled SC-28 · High
EBS volume must be encrypted SC-28 · High
DynamoDB table must have server-side encryption enabled SC-28 · High

System & Information Integrity (SI)

Lambda function must not use a deprecated runtime SI-2 · High
GuardDuty detector must be enabled SI-4 · Critical
Inspector coverage must be active SI-2 · Medium

System and Services Acquisition (SA)

Organization should manage supply chain risks (SA-12) SA-12 · Medium

Measure your NIST 800-53: Cloud Security Controls posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation