Build security in, phase by phase

The model maps the 10 security domains of the AWS Cloud Adoption Framework — Security governance, Security assurance, Identity and access management, Threat detection, Vulnerability management, Infrastructure protection, Data protection, Application security, Incident response, and Resiliency — against four maturity phases (Quick Wins, Foundational, Efficient, Optimized). Each cell proposes tactical AWS security controls for that domain at that phase.

Controls are cumulative: each phase builds on the previous one. You never start over — you extend what you already have.

With so many services and controls, the hardest question is where to start. This model prioritizes by weighing two things:

• Effort — how fast and simple a control is to implement, its operational load, and its cost.
• Impact — how much it strengthens your security posture.

The controls that are high-impact and low-effort are the Quick Wins, and they come first. Every Quick Win can be implemented in about a week and meaningfully improves your posture right away. From there the journey continues through Foundational, Efficient, and Optimized.

This is the differentiator. Most cloud security guidance stops at principles; here every control is specific and verifiable: the threat it mitigates, which AWS service to use, how to implement it, and how to validate that it is working. Each control also shows which security domain it belongs to and which framework requirements it maps to, so the guidance is always traceable back to an authoritative source.

Security in AWS is a shared responsibility: AWS is responsible for the security of the cloud, and you are responsible for security in the cloud. Every control is tagged with who owns it — customer, AWS, or shared — so the boundary is always explicit.

Use the self-assessment to track your adoption per control, security domain, and phase. Everything stays in your browser and can be exported to a file to back it up or move it between devices — record evidence as references (ARNs, Config rule names), never secrets.

Available in English, Spanish, Portuguese, and Japanese. The model summarizes the most common best practices across the leading AWS and industry frameworks:

• AWS Well-Architected Framework — Security Pillar
• AWS Cloud Adoption Framework (Security Perspective)
• NIST Cybersecurity Framework
• CIS AWS Foundations Benchmark