National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) v2.0

nist_csf_2.0_aws

NIST-CSFv2.0

OfficialVerified

The NIST Cybersecurity Framework (CSF) 2.0 offers a taxonomy of high-level cybersecurity outcomes that can be used by any organization regardless of its size, sector, or maturity to better understand, assess, prioritize, and communicate its cybersecurity efforts. The framework's core functions are organized into six key areas: Govern (new), Identify, Protect, Detect, Respond, and Recover. Together, these functions provide a comprehensive lifecycle approach to managing cybersecurity risk.

78requirements247checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance nist_csf_2.0_aws

Requirements (78)

Govern (GV)22133

oc_1The organization's role in the supply chain is identified and communicated.0

Attributes

Item Id: oc_1
Section: Govern (GV)
Service: aws
Sub Section: Organizational Context (GV.OC)

oc_2Legal, regulatory, and contractual requirements regarding cybersecurity including privacy and civil liberties obligations are understood and managed.0

Attributes

Item Id: oc_2
Section: Govern (GV)
Service: aws
Sub Section: Organizational Context (GV.OC)

oc_3The organization's place in critical infrastructure and its industry sector is identified and communicated.0

Attributes

Item Id: oc_3
Section: Govern (GV)
Service: aws
Sub Section: Organizational Context (GV.OC)

rm_1Organizational cybersecurity risk management strategy is established, communicated, and maintained.12

Attributes

Item Id: rm_1
Section: Govern (GV)
Service: aws
Sub Section: Risk Management Strategy (GV.RM)

rm_2Organizational risk tolerance is determined and clearly expressed.0

Attributes

Item Id: rm_2
Section: Govern (GV)
Service: aws
Sub Section: Risk Management Strategy (GV.RM)

rm_3The organization's determination of risk tolerance is informed by its role in critical infrastructure, sector-specific risk analysis, or organizational risk analysis.0

Attributes

Item Id: rm_3
Section: Govern (GV)
Service: aws
Sub Section: Risk Management Strategy (GV.RM)

sc_1Cybersecurity supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.5

Attributes

Item Id: sc_1
Section: Govern (GV)
Service: aws
Sub Section: Cybersecurity Supply Chain Risk Management (GV.SC)

sc_2Supply chain risk management processes are established, managed, and agreed to by organizational stakeholders.2

Attributes

Item Id: sc_2
Section: Govern (GV)
Service: aws
Sub Section: Cybersecurity Supply Chain Risk Management (GV.SC)

sc_3Suppliers and third-party partners are evaluated, assessed, and monitored using cybersecurity supply chain risk management processes.4

Attributes

Item Id: sc_3
Section: Govern (GV)
Service: aws
Sub Section: Cybersecurity Supply Chain Risk Management (GV.SC)

sc_4Supply chain risk management processes are continuously improved.0

Attributes

Item Id: sc_4
Section: Govern (GV)
Service: aws
Sub Section: Cybersecurity Supply Chain Risk Management (GV.SC)

rr_1Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.21

Attributes

Item Id: rr_1
Section: Govern (GV)
Service: iam
Sub Section: Roles, Responsibilities, and Authorities (GV.RR)

rr_2Cybersecurity responsibilities are established and communicated.15

Attributes

Item Id: rr_2
Section: Govern (GV)
Service: iam
Sub Section: Roles, Responsibilities, and Authorities (GV.RR)

rr_3Senior executives are accountable for cybersecurity risk.0

Attributes

Item Id: rr_3
Section: Govern (GV)
Service: aws
Sub Section: Roles, Responsibilities, and Authorities (GV.RR)

po_1Cybersecurity policy is established, communicated, and enforced.15

Attributes

Item Id: po_1
Section: Govern (GV)
Service: aws
Sub Section: Policies, Processes, and Procedures (GV.PO)

po_2Cybersecurity policy is updated as needed to reflect changes in organizational priorities, threat landscape, or technology.0

Attributes

Item Id: po_2
Section: Govern (GV)
Service: aws
Sub Section: Policies, Processes, and Procedures (GV.PO)

po_3Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed.13

Attributes

Item Id: po_3
Section: Govern (GV)
Service: aws
Sub Section: Policies, Processes, and Procedures (GV.PO)

po_4Governance and risk management processes address cybersecurity risks.15

Attributes

Item Id: po_4
Section: Govern (GV)
Service: aws
Sub Section: Policies, Processes, and Procedures (GV.PO)

po_5Processes for managing cybersecurity requirements for suppliers and third-party partners are established.5

Attributes

Item Id: po_5
Section: Govern (GV)
Service: aws
Sub Section: Policies, Processes, and Procedures (GV.PO)

ov_1Cybersecurity risk management strategy outcomes are reviewed to inform and adjust organizational priorities.0

Attributes

Item Id: ov_1
Section: Govern (GV)
Service: aws
Sub Section: Oversight (GV.OV)

ov_2Cybersecurity risk management performance is measured and reported.7

Attributes

Item Id: ov_2
Section: Govern (GV)
Service: aws
Sub Section: Oversight (GV.OV)

ov_3Cybersecurity risk management strategy and practices are reviewed and adjusted to adapt to changes in the threat landscape, technologies, or mission, business, or system environments.19

Attributes

Item Id: ov_3
Section: Govern (GV)
Service: aws
Sub Section: Oversight (GV.OV)

ov_4Cybersecurity risk management processes are reviewed to ensure they meet legal and regulatory requirements.0

Attributes

Item Id: ov_4
Section: Govern (GV)
Service: aws
Sub Section: Oversight (GV.OV)

Identify (ID)1172

am_1Physical devices and systems within the organization are inventoried.0

Attributes

Item Id: am_1
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_2Software platforms and applications within the organization are inventoried.0

Attributes

Item Id: am_2
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_3Organizational communication and data flows are mapped.0

Attributes

Item Id: am_3
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_5Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value.0

Attributes

Item Id: am_5
Section: Identify (ID)
Service: aws
Sub Section: Asset Management (ID.AM)

am_6Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established.6

Attributes

Item Id: am_6
Section: Identify (ID)
Service: iam
Sub Section: Asset Management (ID.AM)

be_5Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)26

Attributes

Item Id: be_5
Section: Identify (ID)
Service: aws
Sub Section: Business Environment (ID.BE)

ra_1Asset vulnerabilities are identified and documented.21

Attributes

Item Id: ra_1
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

ra_2Cyber threat intelligence is received from information sharing forums and sources.0

Attributes

Item Id: ra_2
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

ra_3Threats, both internal and external, are identified and documented.3

Attributes

Item Id: ra_3
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

ra_5Threats, vulnerabilities, likelihoods, and impacts are used to determine risk.16

Attributes

Item Id: ra_5
Section: Identify (ID)
Service: aws
Sub Section: Risk Assessment (ID.RA)

id_sc_4Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.0

Attributes

Item Id: id_sc_4
Section: Identify (ID)
Service: aws
Sub Section: Supply Chain Risk Management (ID.SC)

Protect (PR)27310

ac_1Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.24

Attributes

Item Id: ac_1
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_3Remote access is managed.22

Attributes

Item Id: ac_3
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.17

Attributes

Item Id: ac_4
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_5Network integrity is protected (e.g., network segregation, network segmentation).16

Attributes

Item Id: ac_5
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_6Identities are proofed and bound to credentials and asserted in interactions.14

Attributes

Item Id: ac_6
Section: Protect (PR)
Service: aws
Sub Section: Identity Management and Access Control (PR.AC)

ac_7Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks).19

Attributes

Item Id: ac_7
Section: Protect (PR)
Service: iam
Sub Section: Identity Management and Access Control (PR.AC)

ds_1Data-at-rest is protected.24

Attributes

Item Id: ds_1
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_2Data-in-transit is protected.12

Attributes

Item Id: ds_2
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_3Assets are formally managed throughout removal, transfers, and disposition.17

Attributes

Item Id: ds_3
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_4Adequate capacity to ensure availability is maintained.22

Attributes

Item Id: ds_4
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_5Protections against data leaks are implemented.20

Attributes

Item Id: ds_5
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_6Integrity checking mechanisms are used to verify software, firmware, and information integrity.1

Attributes

Item Id: ds_6
Section: Protect (PR)
Service: cloudtrail
Sub Section: Data Security (PR.DS)

ds_7The development and testing environment(s) are separate from the production environment.0

Attributes

Item Id: ds_7
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ds_8Integrity checking mechanisms are used to verify hardware integrity.0

Attributes

Item Id: ds_8
Section: Protect (PR)
Service: aws
Sub Section: Data Security (PR.DS)

ip_1A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).12

Attributes

Item Id: ip_1
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_2A System Development Life Cycle to manage systems is implemented.9

Attributes

Item Id: ip_2
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_3Configuration change control processes are in place.0

Attributes

Item Id: ip_3
Section: Protect (PR)
Service: elb
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_4Backups of information are conducted, maintained, and tested periodically.15

Attributes

Item Id: ip_4
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_7Protection processes are improved.13

Attributes

Item Id: ip_7
Section: Protect (PR)
Service: ec2
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_8Effectiveness of protection technologies is shared.9

Attributes

Item Id: ip_8
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_9Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed.2

Attributes

Item Id: ip_9
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ip_12A vulnerability management plan is developed and implemented.3

Attributes

Item Id: ip_12
Section: Protect (PR)
Service: aws
Sub Section: Information Protection Processes and Procedures (PR.IP)

ma_2Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.0

Attributes

Item Id: ma_2
Section: Protect (PR)
Service: cloudtrail
Sub Section: Maintenance (PR.MA)

pt_1Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.17

Attributes

Item Id: pt_1
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

pt_3The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.0

Attributes

Item Id: pt_3
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

pt_4Communications and control networks are protected.9

Attributes

Item Id: pt_4
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

pt_5Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.13

Attributes

Item Id: pt_5
Section: Protect (PR)
Service: aws
Sub Section: Protective Technology (PR.PT)

Detect (DE)14114

ae_1A baseline of network operations and expected data flows for users and systems is established and managed.13

Attributes

Item Id: ae_1
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_2Detected events are analyzed to understand attack targets and methods.15

Attributes

Item Id: ae_2
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_3Event data are collected and correlated from multiple sources and sensors.11

Attributes

Item Id: ae_3
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_4Impact of events is determined.0

Attributes

Item Id: ae_4
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

ae_5Incident alert thresholds are established.0

Attributes

Item Id: ae_5
Section: Detect (DE)
Service: aws
Sub Section: Anomalies and Events (DE.AE)

cm_1The network is monitored to detect potential cybersecurity events.20

Attributes

Item Id: cm_1
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_2The physical environment is monitored to detect potential cybersecurity events.0

Attributes

Item Id: cm_2
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_3Personnel activity is monitored to detect potential cybersecurity events.9

Attributes

Item Id: cm_3
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_4Malicious code is detected.2

Attributes

Item Id: cm_4
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_5Unauthorized mobile code is detected.0

Attributes

Item Id: cm_5
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_6External service provider activity is monitored to detect potential cybersecurity events.3

Attributes

Item Id: cm_6
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

cm_7Monitoring for unauthorized personnel, connections, devices, and software is performed.20

Attributes

Item Id: cm_7
Section: Detect (DE)
Service: aws
Sub Section: Security Continuous Monitoring (DE.CM)

dp_4Event detection information is communicated.21

Attributes

Item Id: dp_4
Section: Detect (DE)
Service: aws
Sub Section: Detection Processes (DE.DP)

dp_5Detection processes are continuously improved.0

Attributes

Item Id: dp_5
Section: Detect (DE)
Service: ec2
Sub Section: Detection Processes (DE.DP)

Respond (RS)31

an_2The impact of the incident is understood.0

Attributes

Item Id: an_2
Section: Respond (RS)
Service: guardduty
Sub Section: Analysis (RS.AN)

mi_3Newly identified vulnerabilities are mitigated or documented as accepted risks.0

Attributes

Item Id: mi_3
Section: Respond (RS)
Service: guardduty
Sub Section: Mitigation (RS.MI)

rp_1Response plan is executed during or after an incident.1

Attributes

Item Id: rp_1
Section: Respond (RS)
Service: aws
Sub Section: Response Planning (RS.RP)

Recover (RC)115

rc_rp_1Recovery plan is executed during or after a cybersecurity incident.15

Attributes

Item Id: rc_rp_1
Section: Recover (RC)
Service: aws
Sub Section: Recovery Planning (RC.RP)