National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) v1.1

nist_csf_1.1_aws

NIST-CSFv1.1

OfficialVerified

The NIST Cybersecurity Framework (CSF) is supported by governments and industries worldwide as a recommended baseline for use by any organization, regardless of sector or size. The NIST Cybersecurity Framework consists of three primary components: the framework core, the profiles, and the implementation tiers. The framework core contains desired cybersecurity activities and outcomes organized into 23 categories that cover the breadth of cybersecurity objectives for an organization. The profiles contain an organization's unique alignment of their organizational requirements and objectives, risk appetite, and resources using the desired outcomes of the framework core. The implementation tiers describe the degree to which an organization’s cybersecurity risk management practices exhibit the characteristics defined in the framework core.

56requirements89checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance nist_csf_1.1_aws

Requirements (56)

Detect (DE)14111

ae_1A baseline of network operations and expected data flows for users and systems is established and managed.11

Attributes

Item Id: ae_1
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_2Detected events are analyzed to understand attack targets and methods.2

Attributes

Item Id: ae_2
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_3Event data are collected and correlated from multiple sources and sensors.10

Attributes

Item Id: ae_3
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_4Impact of events is determined.9

Attributes

Item Id: ae_4
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_5Incident alert thresholds are established.4

Attributes

Item Id: ae_5
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

cm_1The network is monitored to detect potential cybersecurity events.10

Attributes

Item Id: cm_1
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_2The physical environment is monitored to detect potential cybersecurity events.20

Attributes

Item Id: cm_2
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_3Personnel activity is monitored to detect potential cybersecurity events.6

Attributes

Item Id: cm_3
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_4Malicious code is detected.2

Attributes

Item Id: cm_4
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_5Unauthorized mobile code is detected.10

Attributes

Item Id: cm_5
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_6External service provider activity is monitored to detect potential cybersecurity events.6

Attributes

Item Id: cm_6
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_7Monitoring for unauthorized personnel, connections, devices, and software is performed.10

Attributes

Item Id: cm_7
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cp_4Event detection information is communicated.10

Attributes

Item Id: cp_4
Section: Detect (DE)
Service: aws
Sub Section: Detection Processes (DE.DP)

cp_5Detection processes are continuously improved.1

Attributes

Item Id: cp_5
Section: Detect (DE)
Service: ec2
Sub Section: Detection Processes (DE.DP)

Identify (ID)1158

am_1Physical devices and systems within the organization are inventoried.2

Attributes

Item Id: am_1
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_2Software platforms and applications within the organization are inventoried.2

Attributes

Item Id: am_2
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_3Organizational communication and data flows are mapped.7

Attributes

Item Id: am_3
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_5Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value.0

Attributes

Item Id: am_5
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_6Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established.0

Attributes

Item Id: am_6
Section: Identify (ID)
Service: iam
Sub Section: Asset Management (ID.AM)

be_5Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)4

Attributes

Item Id: be_5
Section: Identify (ID)
Service: aws
Sub Section: Business Environment (ID.BE)

ra_1Asset vulnerabilities are identified and documented.3

Attributes

Item Id: ra_1
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

ra_2Cyber threat intelligence is received from information sharing forums and sources.2

Attributes

Item Id: ra_2
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

ra_3Threats, both internal and external, are identified and documented.2

Attributes

Item Id: ra_3
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

ra_5Threats, vulnerabilities, likelihoods, and impacts are used to determine risk.20

Attributes

Item Id: ra_5
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

sc_4Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.16

Attributes

Item Id: sc_4
Section: Identify (ID)
Service: aws
Sub Section: Supply Chain Risk Management (ID.SC)

Protect (PR)27169

ac_1Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.12

Attributes

Item Id: ac_1
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_3Remote access is managed.18

Attributes

Item Id: ac_3
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.11

Attributes

Item Id: ac_4
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_5Network integrity is protected (e.g., network segregation, network segmentation).16

Attributes

Item Id: ac_5
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_6Identities are proofed and bound to credentials and asserted in interactions.3

Attributes

Item Id: ac_6
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_7Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).3

Attributes

Item Id: ac_7
Section: Protect (PR)
Service: iam
Sub Section: Identity Management and Access Control (PR.AC)

ds_1Data-at-rest is protected.9

Attributes

Item Id: ds_1
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_2Data-in-transit is protected.4

Attributes

Item Id: ds_2
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_3Assets are formally managed throughout removal, transfers, and disposition.3

Attributes

Item Id: ds_3
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_4Adequate capacity to ensure availability is maintained.5

Attributes

Item Id: ds_4
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_5Protections against data leaks are implemented.18

Attributes

Item Id: ds_5
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_6Integrity checking mechanisms are used to verify software, firmware, and information integrity.1

Attributes

Item Id: ds_6
Section: Protect (PR)
Service: cloudtrail
Sub Section: Data Security (PR.DS)

ds_7The development and testing environment(s) are separate from the production environment.6

Attributes

Item Id: ds_7
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_8Integrity checking mechanisms are used to verify hardware integrity.2

Attributes

Item Id: ds_8
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ip_1A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).3

Attributes

Item Id: ip_1
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_2A System Development Life Cycle to manage systems is implemented.1

Attributes

Item Id: ip_2
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_3Configuration change control processes are in place.1

Attributes

Item Id: ip_3
Section: Protect (PR)
Service: elb
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_4Backups of information are conducted, maintained, and tested periodically.3

Attributes

Item Id: ip_4
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_7Protection processes are improved.0

Attributes

Item Id: ip_7
Section: Protect (PR)
Service: ec2
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_8Effectiveness of protection technologies is shared.12

Attributes

Item Id: ip_8
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_9Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed.7

Attributes

Item Id: ip_9
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_12A vulnerability management plan is developed and implemented.3

Attributes

Item Id: ip_12
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ma_2Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.1

Attributes

Item Id: ma_2
Section: Protect (PR)
Service: cloudtrail
Sub Section: Maintenance (PR.MA)

pt_1Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.7

Attributes

Item Id: pt_1
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

pt_3The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.11

Attributes

Item Id: pt_3
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

pt_4Communications and control networks are protected.5

Attributes

Item Id: pt_4
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

pt_5Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.4

Attributes

Item Id: pt_5
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

Recover (RC)17

rc_rp_1Recovery plan is executed during or after a cybersecurity incident.7

Attributes

Item Id: rc_rp_1
Section: Recover (RC)
Service: aws
Sub Section: Recovery Planning (RC.RP)

Respond (RS)39

an_2The impact of the incident is understood.1

Attributes

Item Id: an_2
Section: Respond (RS)
Service: guardduty
Sub Section: Analysis (RS.AN)

mi_3Newly identified vulnerabilities are mitigated or documented as accepted risks.1

Attributes

Item Id: mi_3
Section: Respond (RS)
Service: guardduty
Sub Section: Mitigation (RS.MI)

rp_1Response plan is executed during or after an incident.7

Attributes

Item Id: rp_1
Section: Respond (RS)
Service: aws
Sub Section: Response Planning (RS.RP)