Build security in, phase by phase

AWS cloud security controls organized by security domain across four maturity phases.

ⓘ Controls are cumulative: each phase builds on the previous one. You never start over.

AWS CAF	Quick Wins High-impact, low-effort security controls to enable first.	Foundational Core security foundations every workload should establish.	Efficient Scale and automate security across the environment.	Optimized Advanced, continuously optimized security operations.
AWS CAF 1 Security governance 2 Quick Wins, 3 Foundational, 3 Efficient, 1 Optimized	c1.1 Assign account security contacts c1.2 Select Regions and block the rest	c2.1 Identify security and regulatory requirements c2.2 Build a cloud security training plan c2.3 Establish AI security governance and a model inventory	c3.1 Design a secure architecture c3.2 Use infrastructure as code c3.3 Define a tagging strategy	c4.1 Share security work and responsibility
AWS CAF 2 Security assurance 1 Quick Wins, 1 Foundational, 1 Efficient, 1 Optimized	c1.3 Evaluate cloud security posture	c2.4 Inventory assets and monitor configuration changes	c3.4 Produce compliance reports	c4.2 Automate evidence gathering for audits
AWS CAF 3 Identity and access management 4 Quick Wins, 3 Foundational, 2 Efficient, 3 Optimized	c1.4 Enforce multi-factor authentication c1.5 Protect the root account c1.6 Centralize identity and federate access c1.7 Clean up unintended and unused access	c2.5 Set guardrails with SCPs and RCPs c2.6 Use temporary credentials instead of access keys c2.7 Enforce IMDSv2 on EC2 instances	c3.5 Review IAM for least privilege c3.6 Secure customer identity	c4.3 Enforce IAM data perimeters c4.4 Build an IAM policy generation pipeline c4.5 Grant temporary elevated access
AWS CAF 4 Threat detection 3 Quick Wins, 1 Foundational, 2 Efficient, 2 Optimized	c1.8 Detect active threats c1.9 Audit account activity c1.10 Set billing and cost-anomaly alarms	c2.8 Triage GuardDuty findings and enable protection plans	c3.7 Add custom threat detection c3.8 Detect threats against your AI runtime	c4.6 Build threat intelligence c4.7 Analyze network flows
AWS CAF 5 Vulnerability management 0 Quick Wins, 2 Foundational, 3 Efficient, 1 Optimized		c2.9 Manage infrastructure vulnerabilities c2.10 Manage application vulnerabilities	c3.9 Run a Security Champions program c3.10 Build a DevSecOps pipeline c3.11 Adopt agentic penetration testing	c4.8 Build a vulnerability management team
AWS CAF 6 Infrastructure protection 1 Quick Wins, 5 Foundational, 2 Efficient, 2 Optimized	c1.11 Close risky open administration ports	c2.11 Limit network access with least-privilege security groups c2.12 Deploy anti-malware / EDR where you own the OS c2.13 Manage EC2 without open SSH/RDP ports c2.15 Segment networks with VPCs c2.16 Adopt a multi-account structure	c3.12 Build a golden-image pipeline c3.13 Control outbound traffic	c4.9 Enforce zero trust access c4.10 Prefer abstract (serverless) services
AWS CAF 7 Data protection 2 Quick Wins, 4 Foundational, 1 Efficient, 0 Optimized	c1.12 Block public access to storage c1.13 Analyze data security posture	c2.14 Protect data in generative-AI workloads c2.17 Encrypt data at rest c2.18 Back up data and make it immutable c2.19 Discover sensitive data	c3.14 Encrypt data in transit
AWS CAF 8 Application security 1 Quick Wins, 2 Foundational, 4 Efficient, 1 Optimized	c1.15 Protect web applications	c2.20 Involve security teams early in development c2.21 Keep secrets out of code	c3.15 Perform threat modeling c3.16 Add custom AWS WAF rules c3.17 Add agentic security review to delivery c3.18 Mitigate DDoS attacks	c4.11 Establish a red team
AWS CAF 9 Incident response 1 Quick Wins, 1 Foundational, 4 Efficient, 4 Optimized	c1.14 Act on critical security findings	c2.22 Define incident response playbooks	c3.19 Run tabletop exercises c3.20 Automate critical playbooks c3.21 Investigate security incidents c3.22 Arrange managed incident response	c4.12 Establish a blue team c4.13 Build advanced security automations c4.14 Add security orchestration and ticketing c4.15 Automate correction of configuration drift
AWS CAF 10 Resiliency 1 Quick Wins, 1 Foundational, 1 Efficient, 2 Optimized	c1.16 Evaluate workload resilience	c2.23 Design for Multi-AZ redundancy	c3.23 Plan for disaster recovery	c4.16 Automate multi-Region disaster recovery c4.17 Practice chaos engineering
Well-Architected 1 Security foundations 2 Quick Wins, 3 Foundational, 2 Efficient, 2 Optimized	c1.1 Assign account security contacts c1.5 Protect the root account	c2.1 Identify security and regulatory requirements c2.5 Set guardrails with SCPs and RCPs c2.16 Adopt a multi-account structure	c3.2 Use infrastructure as code c3.15 Perform threat modeling	c4.6 Build threat intelligence c4.15 Automate correction of configuration drift
Well-Architected 2 Identity and access management 5 Quick Wins, 3 Foundational, 2 Efficient, 2 Optimized	c1.4 Enforce multi-factor authentication c1.5 Protect the root account c1.6 Centralize identity and federate access c1.7 Clean up unintended and unused access c1.12 Block public access to storage	c2.5 Set guardrails with SCPs and RCPs c2.6 Use temporary credentials instead of access keys c2.21 Keep secrets out of code	c3.5 Review IAM for least privilege c3.6 Secure customer identity	c4.3 Enforce IAM data perimeters c4.5 Grant temporary elevated access
Well-Architected 3 Detection 4 Quick Wins, 0 Foundational, 3 Efficient, 2 Optimized	c1.3 Evaluate cloud security posture c1.8 Detect active threats c1.9 Audit account activity c1.14 Act on critical security findings		c3.7 Add custom threat detection c3.20 Automate critical playbooks c3.21 Investigate security incidents	c4.7 Analyze network flows c4.15 Automate correction of configuration drift
Well-Architected 4 Infrastructure protection 2 Quick Wins, 6 Foundational, 4 Efficient, 1 Optimized	c1.11 Close risky open administration ports c1.15 Protect web applications	c2.7 Enforce IMDSv2 on EC2 instances c2.9 Manage infrastructure vulnerabilities c2.11 Limit network access with least-privilege security groups c2.12 Deploy anti-malware / EDR where you own the OS c2.13 Manage EC2 without open SSH/RDP ports c2.15 Segment networks with VPCs	c3.12 Build a golden-image pipeline c3.13 Control outbound traffic c3.16 Add custom AWS WAF rules c3.18 Mitigate DDoS attacks	c4.15 Automate correction of configuration drift
Well-Architected 5 Data protection 2 Quick Wins, 3 Foundational, 1 Efficient, 2 Optimized	c1.12 Block public access to storage c1.13 Analyze data security posture	c2.17 Encrypt data at rest c2.18 Back up data and make it immutable c2.19 Discover sensitive data	c3.14 Encrypt data in transit	c4.3 Enforce IAM data perimeters c4.9 Enforce zero trust access
Well-Architected 6 Incident response 1 Quick Wins, 1 Foundational, 4 Efficient, 4 Optimized	c1.1 Assign account security contacts	c2.22 Define incident response playbooks	c3.19 Run tabletop exercises c3.20 Automate critical playbooks c3.21 Investigate security incidents c3.22 Arrange managed incident response	c4.5 Grant temporary elevated access c4.11 Establish a red team c4.12 Establish a blue team c4.14 Add security orchestration and ticketing
Well-Architected 7 Application security 0 Quick Wins, 4 Foundational, 5 Efficient, 2 Optimized		c2.2 Build a cloud security training plan c2.9 Manage infrastructure vulnerabilities c2.10 Manage application vulnerabilities c2.20 Involve security teams early in development	c3.2 Use infrastructure as code c3.9 Run a Security Champions program c3.10 Build a DevSecOps pipeline c3.11 Adopt agentic penetration testing c3.17 Add agentic security review to delivery	c4.1 Share security work and responsibility c4.4 Build an IAM policy generation pipeline
NIST CSF 1 GV — Govern 2 Quick Wins, 2 Foundational, 2 Efficient, 1 Optimized	c1.1 Assign account security contacts c1.13 Analyze data security posture	c2.1 Identify security and regulatory requirements c2.3 Establish AI security governance and a model inventory	c3.4 Produce compliance reports c3.9 Run a Security Champions program	c4.1 Share security work and responsibility
NIST CSF 2 ID — Identify 1 Quick Wins, 2 Foundational, 4 Efficient, 4 Optimized	c1.8 Detect active threats	c2.9 Manage infrastructure vulnerabilities c2.19 Discover sensitive data	c3.1 Design a secure architecture c3.3 Define a tagging strategy c3.15 Perform threat modeling c3.19 Run tabletop exercises	c4.6 Build threat intelligence c4.11 Establish a red team c4.12 Establish a blue team c4.17 Practice chaos engineering
NIST CSF 3 PR — Protect 9 Quick Wins, 14 Foundational, 7 Efficient, 3 Optimized	c1.4 Enforce multi-factor authentication c1.5 Protect the root account c1.6 Centralize identity and federate access c1.7 Clean up unintended and unused access c1.11 Close risky open administration ports c1.12 Block public access to storage c1.13 Analyze data security posture c1.15 Protect web applications c1.16 Evaluate workload resilience	c2.2 Build a cloud security training plan c2.4 Inventory assets and monitor configuration changes c2.5 Set guardrails with SCPs and RCPs c2.6 Use temporary credentials instead of access keys c2.7 Enforce IMDSv2 on EC2 instances c2.10 Manage application vulnerabilities c2.11 Limit network access with least-privilege security groups c2.13 Manage EC2 without open SSH/RDP ports c2.15 Segment networks with VPCs c2.17 Encrypt data at rest c2.18 Back up data and make it immutable c2.20 Involve security teams early in development c2.21 Keep secrets out of code c2.23 Design for Multi-AZ redundancy	c3.5 Review IAM for least privilege c3.6 Secure customer identity c3.10 Build a DevSecOps pipeline c3.12 Build a golden-image pipeline c3.13 Control outbound traffic c3.14 Encrypt data in transit c3.18 Mitigate DDoS attacks	c4.3 Enforce IAM data perimeters c4.5 Grant temporary elevated access c4.9 Enforce zero trust access
NIST CSF 4 DE — Detect 4 Quick Wins, 1 Foundational, 3 Efficient, 1 Optimized	c1.3 Evaluate cloud security posture c1.8 Detect active threats c1.9 Audit account activity c1.14 Act on critical security findings	c2.8 Triage GuardDuty findings and enable protection plans	c3.7 Add custom threat detection c3.8 Detect threats against your AI runtime c3.21 Investigate security incidents	c4.7 Analyze network flows
NIST CSF 5 RS — Respond 1 Quick Wins, 1 Foundational, 3 Efficient, 3 Optimized	c1.1 Assign account security contacts	c2.22 Define incident response playbooks	c3.20 Automate critical playbooks c3.21 Investigate security incidents c3.22 Arrange managed incident response	c4.13 Build advanced security automations c4.14 Add security orchestration and ticketing c4.15 Automate correction of configuration drift
NIST CSF 6 RC — Recover 0 Quick Wins, 1 Foundational, 1 Efficient, 1 Optimized		c2.18 Back up data and make it immutable	c3.23 Plan for disaster recovery	c4.16 Automate multi-Region disaster recovery