Skip to content

CISA Cyber Essentials

Best for: Leaders and IT staff at small businesses, local governments, tribal nations, and territorial agencies without dedicated cybersecurity teams. CISA Cyber Essentials gives resource-constrained organizations a starting point for basic cyber hygiene. No regulatory mandate exists, but federal grant programs such as the State and Local Cybersecurity Grant Program under the Infrastructure Investment and Jobs Act frequently treat CISA guidance as a baseline expectation.

Mandatory?Voluntary — recommended for small organizations and critical infrastructure
Who validates?Self-assessment; no formal certification
RenewalNo fixed cycle
ScopeSmall businesses and SLTT governments; six essential elements

🏛 Cybersecurity and Infrastructure Security Agency (CISA), U.S. Department of Homeland Security · CISA Cyber Essentials (2019) Official source →

Get Started

module "..." {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

What Compliance.tf Covers vs. What You Handle

  • What Compliance.tf automates

    • Audit Logging and Trail Integrity: Runs 9 controls validating CloudTrail multi-region enablement, S3 data event logging (read and write), CloudWatch integration, log file validation, and KMS encryption of trail logs. Also checks API Gateway stage logging.
    • Encryption at Rest: Covers API Gateway cache encryption, backup recovery point encryption, and CloudTrail log encryption with KMS CMK. Validates that encryption is configured at the resource level.
    • Encryption in Transit: Validates that API Gateway REST API stages use SSL certificates for backend authentication.
    • Backup and Disaster Recovery: Three controls check backup plan minimum retention (35 days), recovery point retention enforcement, and manual deletion protection on recovery points.
    • Network Exposure Reduction: Flags Auto Scaling launch configurations that assign public IPs and API Gateway stages not associated with a WAF web ACL.
    • Credential and Certificate Management: Flags ACM certificates within 30 days of expiration and CodeBuild projects with plaintext sensitive AWS values in environment variables.

  • What you handle

    • Audit Logging and Trail Integrity: Log review procedures, alerting thresholds in CloudWatch or a SIEM, and an incident escalation process tied to log findings.
    • Encryption at Rest: KMS key rotation schedules, key access policies, and documenting which teams are authorized to manage or use each CMK.
    • Encryption in Transit: Enforcing TLS 1.2+ across all endpoints, configuring custom domain names with appropriate security policies, and testing cipher suites.
    • Backup and Disaster Recovery: Periodic restore testing, RPO/RTO targets documented per workload, and maintaining an offline or immutable backup copy outside AWS for critical assets.
    • Network Exposure Reduction: WAF rule tuning, security group reviews for resources outside these specific controls, and keeping a network diagram current showing all internet-facing entry points.
    • Credential and Certificate Management: Setting up ACM auto-renewal where possible, rotating credentials stored in Secrets Manager, and establishing a process for tracking certificate ownership across teams.

Controls by Category

Your Data: Backup and Recovery (1 control)

Essential Element 5 ('Your Data') requires more than just having backups. Assessors confirm that backup plans enforce a minimum 35-day retention, that recovery points cannot be manually deleted (a real concern when a ransomware actor gains console access), and that recovery points persist through the full retention window. Pull AWS Backup plan JSON exports and vault access policies to show this.

Backup plan min frequency and min retention check

Your Data: Encryption and Data Protection (3 controls)

The first question is whether encryption is configured at the resource level, both at rest and in transit. That means KMS CMK for CloudTrail logs, encrypted backup recovery points, SSL certificates on API Gateway stages, and API Gateway cache encryption. That last item is a frequent miss because it is disabled by default, and teams often discover the gap only when reviewing API Gateway stage settings directly. Bring KMS key policies, API Gateway stage configurations, and AWS Backup vault encryption settings to the review.

CloudTrail trail logs should be encrypted with KMS CMK API Gateway stage should uses SSL certificate API Gateway stage cache encryption at rest should be enabled

Your Systems: Audit Logging and Monitoring (4 controls)

A common gap here is enabling CloudTrail at the account level but missing S3 object-level data events, which leaves a blind spot on actual data access patterns. Reviewers will want CloudTrail configuration exports and CloudWatch log group retention settings, and they will confirm that no trails are disabled. Log integrity through file validation and centralized forwarding to CloudWatch Logs is expected, not optional.

At least one enabled trail should be present in a region CloudTrail trails should be integrated with CloudWatch logs CloudTrail trail log file validation should be enabled API Gateway stage logging should be enabled
Additional Controls (78)

AWS Database Migration Service (1)

DMS replication instances should not be publicly accessible compliance.tf module

AWS IAM (7)

Ensure IAM password policy requires a minimum length of 14 or greater Ensure IAM password policy requires at least one lowercase letter Ensure IAM password policy requires at least one number Ensure IAM password policy requires at least one symbol Ensure IAM password policy requires at least one uppercase letter Password policies for IAM users should have strong configurations with minimum length of 8 or greater IAM password policies for users should have strong configurations

AWS KMS (1)

KMS CMK rotation should be enabled compliance.tf module

AWS Lambda (1)

Lambda functions should be in a VPC compliance.tf module

Amazon CloudWatch Logs (1)

Log group encryption at rest should be enabled compliance.tf module

Amazon DynamoDB (3)

DynamoDB table should be encrypted with AWS KMS compliance.tf module DynamoDB table should have encryption enabled compliance.tf module DynamoDB table point-in-time recovery should be enabled compliance.tf module

Amazon DynamoDB Accelerator (1)

DynamoDB Accelerator (DAX) clusters should be encrypted at rest

Amazon EBS (2)

Attached EBS volumes should have encryption enabled compliance.tf module EBS volume encryption at rest should be enabled compliance.tf module

Amazon EC2 (3)

EC2 instance should have EBS optimization enabled compliance.tf module EC2 instances should be in a VPC compliance.tf module EC2 instances should not have a public IP address compliance.tf module

Amazon EFS (2)

EFS file system encryption at rest should be enabled compliance.tf module EFS file systems should be encrypted with CMK compliance.tf module

Amazon ElastiCache (1)

ElastiCache Redis cluster automatic backup should be enabled with retention period of 15 days or greater compliance.tf module

Amazon OpenSearch Service (3)

OpenSearch domains should have encryption at rest enabled compliance.tf module OpenSearch domains logs to AWS CloudWatch Logs compliance.tf module OpenSearch domains node-to-node encryption should be enabled compliance.tf module

Amazon RDS (16)

RDS DB clusters should have automatic minor version upgrade enabled RDS clusters should have deletion protection enabled compliance.tf module RDS DB instance and cluster enhanced monitoring should be enabled compliance.tf module RDS DB instance automatic minor version upgrade should be enabled compliance.tf module RDS DB instance backup should be enabled compliance.tf module RDS DB instances backup retention period should be greater than or equal to 7 compliance.tf module RDS DB instances should be integrated with CloudWatch logs compliance.tf module RDS DB instances should have deletion protection enabled compliance.tf module RDS DB instance encryption at rest should be enabled compliance.tf module Database logging should be enabled compliance.tf module RDS for MariaDB DB instances should publish logs to CloudWatch Logs compliance.tf module RDS DB instance multiple az should be enabled compliance.tf module RDS DB instances should not use public subnet compliance.tf module RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs compliance.tf module RDS DB instances should prohibit public access compliance.tf module RDS for SQL Server DB instances should publish logs to CloudWatch Logs compliance.tf module

Amazon Redshift (8)

AWS Redshift audit logging should be enabled compliance.tf module AWS Redshift clusters should have automatic snapshots enabled compliance.tf module AWS Redshift should have automatic upgrades to major versions enabled compliance.tf module Redshift cluster encryption in transit should be enabled compliance.tf module Redshift cluster audit logging and encryption should be enabled compliance.tf module AWS Redshift clusters should be encrypted with KMS compliance.tf module AWS Redshift should have required maintenance settings compliance.tf module Redshift clusters should prohibit public access compliance.tf module

Amazon S3 (13)

S3 buckets access control lists (ACLs) should not be used to manage user access to buckets compliance.tf module S3 bucket cross-region replication should be enabled compliance.tf module S3 bucket default encryption should be enabled compliance.tf module S3 bucket default encryption should be enabled with KMS compliance.tf module S3 bucket logging should be enabled compliance.tf module S3 bucket ACLs should not be accessible to all authenticated user compliance.tf module S3 buckets object logging should be enabled S3 bucket policy should prohibit public access compliance.tf module S3 buckets should prohibit public read access compliance.tf module S3 buckets should prohibit public write access compliance.tf module S3 bucket versioning should be enabled compliance.tf module S3 public access should be blocked at account level compliance.tf module S3 public access should be blocked at bucket levels compliance.tf module

Amazon SNS (1)

SNS topics should be encrypted at rest compliance.tf module

Amazon SageMaker (4)

SageMaker endpoint configuration encryption should be enabled SageMaker notebook instances should not have direct internet access SageMaker notebook instances should be encrypted using CMK SageMaker notebook instance encryption should be enabled

Amazon VPC (1)

VPC subnet auto assign public IP should be disabled compliance.tf module

Elastic Load Balancing (5)

ELB application and classic load balancer logging should be enabled compliance.tf module ELB application load balancer deletion protection should be enabled compliance.tf module ELB application and network load balancers should only use SSL or HTTPS listeners compliance.tf module Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit compliance.tf module ELB classic load balancers should have cross-zone load balancing enabled compliance.tf module

Other (4)

ES domain encryption at rest should be enabled ES domains should be in a VPC Elasticsearch domain should send logs to CloudWatch Elasticsearch domain node-to-node encryption should be enabled

  • NIST CSF — 🟢 High overlap (65%)

    CISA Cyber Essentials was designed as a simplified on-ramp to the NIST Cybersecurity Framework. Most Cyber Essentials recommendations map to NIST CSF Identify, Protect, and Detect functions, but Cyber Essentials omits the depth of subcategories and implementation tiers that CSF provides.

  • NIST 800-53 Rev 5 — 🟡 Medium overlap (35%)

    NIST 800-53 Rev 5 is far more granular, with over 1,000 controls. The Cyber Essentials controls mapped here partially overlap with the AU (Audit and Accountability), CP (Contingency Planning), and SC (System and Communications Protection) families, but cover only a fraction of 800-53's scope.

  • CIS AWS Benchmark v3.0.0 — 🟡 Medium overlap (45%)

    CIS Benchmarks for AWS share many of the same technical checks (CloudTrail configuration, encryption, network exposure). CIS is more prescriptive at the resource configuration level, while Cyber Essentials provides broader organizational guidance that extends beyond cloud infrastructure.

Frequently Asked Questions

Does CISA Cyber Essentials apply to my organization, or is it voluntary?

It is voluntary. CISA does not mandate compliance or conduct audits. That said, if your organization receives federal cybersecurity grants (particularly under the State and Local Cybersecurity Grant Program), grant reviewers expect alignment with CISA guidance. Cyber insurance carriers may also treat it as a baseline expectation during underwriting.

Is there a formal certification or attestation process?

No. CISA Cyber Essentials has no certification body, no exam, and no badge. You self-assess. If you need a certifiable or attestable framework, look at SOC 2, ISO/IEC 27001, or CMMC depending on your sector. NIST CSF can be independently assessed, but it is not a formal certification scheme either.

How does this differ from the UK Cyber Essentials scheme?

They share a name but are distinct programs. The UK Cyber Essentials is a government-backed scheme with requirements set by the National Cyber Security Centre and certification delivered through IASME-accredited bodies. It has two levels (Cyber Essentials and Cyber Essentials Plus) and is mandatory for certain UK government contracts. CISA Cyber Essentials has no certification, no levels, and is purely guidance for U.S. organizations.

Can I use CISA Cyber Essentials as a stepping stone toward NIST CSF?

Yes, CISA explicitly designed it for that purpose. Each of the six Essential Elements maps to NIST CSF functions, so once you have the Cyber Essentials baseline in place, a gap analysis against the full NIST CSF will show you exactly where additional maturity is needed.

How long does it take to implement the 50 mapped AWS controls?

For a single AWS account with moderate workloads, an experienced engineer can remediate most findings in 2 to 4 weeks. CloudTrail and backup controls are straightforward configuration changes. The time-consuming work is WAF web ACL tuning (which requires traffic analysis) and cleaning up legacy launch configurations with public IPs still assigned. Multi-account environments using AWS Organizations will need to factor in account-level rollout through SCPs or Terraform modules.