Coverage & traceability

Every framework item, mapped to the AWS security control(s) that address it: the AWS Cloud Adoption Framework (Security Perspective) and the Well-Architected Framework (Security Pillar). Use this to see coverage at a glance and trace each control back to the framework.

ⓘ This maps each framework item to one or more AWS security controls in this model. It shows control coverage and traceability; it is not a statement of compliance or certification. This is an early baseline — coverage will grow as the mapping is completed.

AWS Cloud Adoption Framework (Security Perspective)

Source ↗

10/10 items covered

Framework item	AWS security controls
caf-security-governance Security governance	c1.1 c1.2 c2.1 c2.2 c2.3 c3.1 c3.2 c3.3 c4.1
caf-security-assurance Security assurance	c1.3 c2.4 c3.4 c4.2
caf-iam Identity and access management	c1.4 c1.5 c1.6 c1.7 c2.5 c2.6 c2.7 c3.5 c3.6 c4.3 c4.4 c4.5
caf-threat-detection Threat detection	c1.8 c1.9 c1.10 c2.8 c3.7 c3.8 c4.6 c4.7
caf-vulnerability-management Vulnerability management	c2.9 c2.10 c3.9 c3.10 c3.11 c4.8
caf-infrastructure-protection Infrastructure protection	c1.11 c2.11 c2.12 c2.13 c2.15 c2.16 c3.12 c3.13 c4.9 c4.10
caf-data-protection Data protection	c1.12 c1.13 c2.14 c2.17 c2.18 c2.19 c3.14
caf-application-security Application security	c1.15 c2.20 c2.21 c3.15 c3.16 c3.17 c3.18 c4.11
caf-incident-response Incident response	c1.14 c2.22 c3.19 c3.20 c3.21 c3.22 c4.12 c4.13 c4.14 c4.15
caf-resiliency Resiliency	c1.16 c2.23 c3.23 c4.16 c4.17

AWS Well-Architected — Security Pillar

Source ↗

7/7 items covered

Framework item	AWS security controls
waf-security-foundations Security foundations	c1.1 c1.5 c2.1 c2.5 c2.16 c3.2 c3.15 c4.6 c4.15
waf-identity-and-access-management Identity and access management	c1.4 c1.5 c1.6 c1.7 c1.12 c2.5 c2.6 c2.21 c3.5 c3.6 c4.3 c4.5
waf-detection Detection	c1.3 c1.8 c1.9 c1.14 c3.7 c3.20 c3.21 c4.7 c4.15
waf-infrastructure-protection Infrastructure protection	c1.11 c1.15 c2.7 c2.9 c2.11 c2.12 c2.13 c2.15 c3.12 c3.13 c3.16 c3.18 c4.15
waf-data-protection Data protection	c1.12 c1.13 c2.17 c2.18 c2.19 c3.14 c4.3 c4.9
waf-incident-response Incident response	c1.1 c2.22 c3.19 c3.20 c3.21 c3.22 c4.5 c4.11 c4.12 c4.14
waf-application-security Application security	c2.2 c2.9 c2.10 c2.20 c3.2 c3.9 c3.10 c3.11 c3.17 c4.1 c4.4

NIST Cybersecurity Framework

Source ↗

6/6 items covered

Framework item	AWS security controls
csf-gv GV — Govern	c1.1 c1.13 c2.1 c2.3 c3.4 c3.9 c4.1
csf-id ID — Identify	c1.8 c2.9 c2.19 c3.1 c3.3 c3.15 c3.19 c4.6 c4.11 c4.12 c4.17
csf-pr PR — Protect	c1.4 c1.5 c1.6 c1.7 c1.11 c1.12 c1.13 c1.15 c1.16 c2.2 c2.4 c2.5 c2.6 c2.7 c2.10 c2.11 c2.13 c2.15 c2.17 c2.18 c2.20 c2.21 c2.23 c3.5 c3.6 c3.10 c3.12 c3.13 c3.14 c3.18 c4.3 c4.5 c4.9
csf-de DE — Detect	c1.3 c1.8 c1.9 c1.14 c2.8 c3.7 c3.8 c3.21 c4.7
csf-rs RS — Respond	c1.1 c2.22 c3.20 c3.21 c3.22 c4.13 c4.14 c4.15
csf-rc RC — Recover	c2.18 c3.23 c4.16