ISO/IEC 27001:2022
Best for: Organizations that need to prove a functioning ISMS to enterprise buyers, government procurement, or regulated-sector partners. Certification is contractually required in financial services, healthcare, SaaS, and telecoms. There is no revenue or size threshold; a 15-person startup selling to banks faces the same commercial requirement as a Fortune 500. GDPR Article 32, EU NIS2, and APAC sector regulators treat ISO 27001 as evidence of appropriate technical and organizational measures.
| Mandatory? | Voluntary — demanded by B2B contracts |
| Who validates? | Accredited certification body (IAF member) · No self-assessment |
| Renewal | 3-year cert; annual surveillance |
| Observation period | Surveillance: years 1 and 2 |
🏛 International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), with national accreditation bodies (e.g., UKAS, ANAB) overseeing certification bodies. · ISO/IEC 27001:2022 Official source →
Get Started
module "..." {
source = "iso27001.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Encryption at Rest: Checks encryption configuration across API Gateway caches, Athena workgroups, Backup recovery points, and Bedrock invocation logs. Validates KMS key usage where applicable. Maps to Annex A control A.8.24.
- Logging and Monitoring: Validates that logging is enabled on API Gateway stages, AppSync GraphQL APIs, Athena workgroups, and Bedrock model invocations. Detects services where logging was disabled or never configured.
- Network Exposure: Detects publicly accessible API Gateway REST endpoints and AppStream fleets with default internet access enabled. Flags resources that violate network segmentation expectations.
- Backup and Recovery: Verifies that AWS Backup plans and vaults exist in active regions, that recovery points are encrypted, and that backup report plans are configured. Checks multi-AZ deployment for Auto Scaling groups and CloudFront origin failover.
- Account Governance: Validates that AWS accounts have a security contact registered, that contact details are current, and that accounts belong to AWS Organizations for centralized management.
- Certificate Lifecycle: Flags ACM certificates expiring within 30 days, giving teams lead time to renew or rotate before expiration causes a service disruption.
What you handle
- Encryption at Rest: Documenting a cryptographic policy covering algorithms, key lengths, and approved use cases. Configuring and auditing KMS key rotation schedules. Maintaining key access policies and reviewing them during internal audits per Clause 9.2.
- Logging and Monitoring: Defining log retention periods per A.8.15. Implementing centralized log review processes and alerting thresholds. Conducting periodic reviews of log data to satisfy A.8.16 monitoring requirements.
- Network Exposure: Maintaining network architecture diagrams (A.8.20). Documenting and reviewing firewall rules, security groups, and NACLs. Performing risk-based security testing (for example, penetration testing) where required by your ISMS and risk treatment plan, rather than as a blanket Clause 8.1 mandate.
- Backup and Recovery: Defining and documenting RTO/RPO targets. Testing recovery procedures at planned intervals based on risk and business requirements, consistent with A.5.30. Maintaining business continuity plans and reporting results to management review (Clause 9.3).
- Account Governance: Establishing the ISMS governance structure (Clauses 5.1 through 5.3). Defining roles and responsibilities per A.5.2. Conducting management reviews and maintaining records of decisions.
- Certificate Lifecycle: Maintaining a certificate inventory. Defining renewal procedures and ownership. Integrating certificate monitoring into incident management processes per A.5.24.
Controls by Category
Cryptographic Controls (A.8.24) (2 controls)
A.8.24 (Use of cryptography) requires a documented cryptographic policy specifying algorithms, key lengths, and key management procedures. Auditors verify encryption at rest across data stores, caches, and backups, and check certificate lifecycle management. Expired or nearly expired ACM certificates are a consistent finding and signal weak operational controls. Be prepared to show KMS key policies and rotation schedules.
Logging, Monitoring, and Accountability (A.8.15, A.8.16) (3 controls)
The core evidence request here is proof that logging is enabled across all in-scope services, directly supporting A.8.15 (Logging) and A.8.16 (Monitoring activities). Assessors want to see centralized log aggregation, documented retention periods, and evidence of regular review. Field-level logging for APIs like AppSync and invocation logging for Bedrock are where gaps appear most often, particularly for services added after initial certification.
Network Security and Access Restriction (A.8.20, A.8.21, A.8.22) (1 control)
Publicly exposed API endpoints and AppStream fleets with default internet access enabled are the most common non-conformities in this category, mapped to A.8.20 (Networks security), A.8.21 (Security of network services), and A.8.22 (Segregation of networks). Expect to produce network diagrams showing segmentation, evidence of private endpoint usage, and written justification for any public-facing resource.
Additional Controls (140)
AWS CloudTrail (4)
AWS CodeBuild (3)
AWS Database Migration Service (1)
AWS IAM (9)
AWS Lambda (3)
AWS Step Functions (1)
Amazon CloudFront (3)
Amazon CloudWatch (1)
Amazon CloudWatch Logs (1)
Amazon DocumentDB (2)
Amazon DynamoDB (2)
Amazon DynamoDB Accelerator (2)
Amazon EBS (3)
Amazon EC2 (10)
compliance.tf moduleEC2 instances should not have a public IP addresscompliance.tf moduleEC2 instances should not use multiple ENIscompliance.tf moduleEC2 instances should use IMDSv2compliance.tf moduleEC2 instances should use IAM instance roles for AWS resource accesscompliance.tf moduleEC2 instances should not use paravirtual instance typescompliance.tf moduleEC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)compliance.tf moduleEC2 launch templates should not assign public IPs to network interfacescompliance.tf moduleEC2 transit gateways should have auto accept shared attachments disabledAmazon EFS (2)
Amazon EKS (4)
compliance.tf moduleEKS clusters endpoint public access should be restrictedcompliance.tf moduleEKS clusters endpoint should restrict public accesscompliance.tf moduleEKS clusters should be configured to have kubernetes secrets encrypted using KMScompliance.tf moduleAmazon ElastiCache (4)
compliance.tf moduleElastiCache for Redis replication groups should be encrypted at restcompliance.tf moduleElastiCache for Redis replication groups should be encrypted with CMKcompliance.tf moduleElastiCache for Redis replication groups should be encrypted in transitcompliance.tf moduleAmazon Kinesis (3)
Amazon Neptune (3)
Amazon OpenSearch Service (7)
compliance.tf moduleOpenSearch domains should have at least three data nodescompliance.tf moduleOpenSearch domains should have encryption at rest enabledcompliance.tf moduleOpenSearch domains should be in a VPCcompliance.tf moduleOpenSearch domains internal user database should be disabledcompliance.tf moduleOpenSearch domains should have logging to CloudWatch Logs enabledcompliance.tf moduleOpenSearch domains node-to-node encryption should be enabledcompliance.tf moduleAmazon RDS (15)
compliance.tf moduleRDS DB clusters should be configured to copy tags to snapshotscompliance.tf moduleRDS DB clusters should be encrypted with CMKcompliance.tf moduleRDS DB clusters should be encrypted at restcompliance.tf moduleRDS DB clusters should be configured for multiple Availability Zonescompliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS instances should be deployed in a VPCcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (7)
compliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have enhanced VPC routing enabledcompliance.tf moduleRedshift clusters should have KMS encryption enabledcompliance.tf moduleRedshift clusters should have Multi-AZ deployments enabledcompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (13)
compliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets with versioning enabled should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleAmazon SQS (2)
Amazon SageMaker (6)
Amazon VPC (2)
Elastic Load Balancing (3)
Other (19)
compliance.tf moduleFSx for Lustre file systems should be configured to copy tags to backupscompliance.tf moduleFSx for Windows File Server file systems should be configured for Multi-AZ deploymentcompliance.tf moduleAPI Gateway V2 stages should have access logging configuredcompliance.tf moduleGlue data catalog metadata encryption should be enabledGlue data catalog connection password encryption should be enabledGlue jobs bookmarks encryption should be enabledGlue jobs CloudWatch logs encryption should be enabledGlue jobs S3 encryption should be enabledMSK Connect connectors should be encrypted in transitRedshift Serverless workgroups should have enhanced VPC routing enabledRelated Frameworks
NIST 800-53 Rev 5 — 🟢 High overlap (72%)
NIST SP 800-53 Rev 5 maps extensively to ISO 27001:2022 Annex A controls. ISO 27001 Annex A.8 (Technological controls) aligns closely with NIST families like SC (System and Communications Protection) and AU (Audit and Accountability). The key difference is that NIST 800-53 is prescriptive with specific parameter requirements, while ISO 27001 is risk-based and leaves implementation details to the organization.
SOC 2 — 🟢 High overlap (65%)
SOC 2 Trust Services Criteria (especially CC6 and CC7) share requirements with ISO 27001 Annex A controls for access management, encryption, and monitoring. SOC 2 produces an attestation report rather than a certification, and its scope is service-organization focused. Organizations pursuing both can unify evidence collection for about two-thirds of the control set.
NIST CSF v2.0 — 🟢 High overlap (60%)
NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) map to ISO 27001 Clauses 4 through 10 and Annex A. CSF is a voluntary framework without certification, often used as a maturity model. Organizations already certified to ISO 27001 can demonstrate CSF alignment with minimal additional effort.