Cloud Security Maturity Model·AWS v3.0.0

Drag to explore · pinch to zoom
Home / Changelog

Changelog

Version history of the AWS Cloud Security Maturity Model. The model version tracks changes to content and structure; the framework version indicates which AWS and industry security guidance the controls are aligned to.

  1. v3.0.0 2026-09-15 AWS CAF (Security) + Well-Architected + NIST + CIS
    Version 3: rebuilt on the Security Maturity Model platform
    • Rebuilt on the shared Security Maturity Model platform, alongside the PCI DSS and AI editions, reachable from the central smm.security.aws.dev landing.
    • The model is organized as a matrix of the 10 AWS CAF security domains across four maturity phases (Quick Wins, Foundational, Efficient, Optimized).
    • Broadened framework alignment: controls are now traced to the AWS Cloud Adoption Framework (Security Perspective), the Well-Architected Framework, NIST, and CIS, shown on the coverage and traceability page.
    • Reference architecture now defers to the AWS Security Reference Architecture (SRA), and the self-assessment links to the dedicated assessment tool.
    • Available in English, Spanish, Portuguese, and Japanese.
  2. v2.0.0 2023-01-01 AWS CAF (Security)
    Version 2: refreshed guidance and broader reach
    • Refreshed and expanded the recommendations across the four maturity phases, keeping the prioritization by effort and impact.
    • Kept the guidance aligned to the AWS Cloud Adoption Framework (Security Perspective), the reference the model was built on.
    • Grew into a widely adopted resource — used by AWS Solutions Architects with customers worldwide and tens of thousands of unique readers.
    • Multilingual content and a refreshed experience for navigating the model.
  3. v1.0.0 2020-01-01 AWS CAF (Security)
    Version 1: the original maturity model
    • First public release of the AWS Security Maturity Model, framing cloud security as an evolutionary journey rather than a one-time project.
    • Introduced the phased approach — starting with Quick Wins and progressing toward continuously optimized security operations.
    • Prioritized recommended actions by effort and impact to answer the question: where do I start?