NIST SP 800-53 Rev 4
Deprecated Framework
Best for: U.S. federal agencies and contractors that haven't migrated to NIST 800-53 Rev 5. If your ATO still references Rev 4 control baselines, you need to maintain compliance until renewal. FedRAMP packages authorized before the Rev 5 transition may also reference Rev 4 controls. Defense industrial base companies with legacy DFARS 252.204-7012 references sometimes still encounter Rev 4 language in older contract vehicles.
| Mandatory? | Mandatory for U.S. federal agencies (superseded by Rev 5) |
| Who validates? | Authorizing Official; 3PAO for FedRAMP overlays · No self-assessment |
| Renewal | ATO reauthorization every 3 years (federal) |
| Scope | Federal information systems |
🏛 National Institute of Standards and Technology (NIST), U.S. Department of Commerce · NIST SP 800-53 Rev 4 (superseded by Rev 5) Official source →
Get Started
module "..." {
source = "nist80053rev4.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Audit Trail Integrity and Coverage: Runs 11 controls validating CloudTrail configuration: multi-region enablement, S3 data event logging for reads and writes, CloudWatch integration, log file validation, and KMS encryption of trail logs. Covers AU-2, AU-3, AU-6, AU-9, and AU-11 control requirements.
- Encryption at Rest: Checks KMS CMK encryption on CloudTrail logs and API Gateway stage caches. Validates that ACM certificates are not within 30 days of expiration.
- Network Boundary Protection: Validates that DMS replication instances are not publicly accessible, checking security group and subnet configurations that would expose data processing resources.
- Secure Configuration Baselines: Detects plaintext sensitive values in CodeBuild environment variables and verifies OAuth is used for source repository connections. Maps to CM-6 and SC-28.
- Availability and Recovery: Confirms Auto Scaling groups attached to load balancers use ELB health checks and that DynamoDB tables have auto scaling enabled. Addresses CP-10 and SI-13.
What you handle
- Audit Trail Integrity and Coverage: Defining the audit event baseline per AU-2, establishing log review procedures (AU-6 manual review cadence), and documenting incident escalation workflows when anomalous events are detected.
- Encryption at Rest: Selecting FIPS 140-2 validated modules where required, defining key rotation schedules, documenting key custodian roles, and maintaining a cryptographic key inventory per SC-12.
- Network Boundary Protection: Documenting authorized information flow paths per AC-4, maintaining network architecture diagrams, configuring WAF rules, and performing periodic boundary device rule reviews.
- Secure Configuration Baselines: Maintaining an approved configuration baseline document, running a change control board process for CM-3, and conducting periodic configuration deviation scans beyond what Terraform state captures.
- Availability and Recovery: Developing and testing the full contingency plan (CP-2), conducting annual tabletop exercises (CP-4), and defining Recovery Time Objectives and Recovery Point Objectives for each system.
Controls by Category
Access Control (AC) (1 control)
Publicly accessible DMS instances represent an unauthorized information flow path and will generate AC-4 findings immediately. Auditors examine VPC configurations, public IP assignments, and security group rules to confirm that data processing components aren't exposed without explicit authorization per AC-17 (Remote Access).
Audit and Accountability (AU) (5 controls)
CloudTrail must be active across all regions with both read and write event logging to satisfy AU-2 and AU-3. Assessors check for log file validation (AU-9), CloudWatch integration (AU-6), and a retention period that matches organizational policy (AU-11). Missing S3 data event logging is the most common finding in this category: without it, object-level access goes completely unaudited.
compliance.tf moduleIncident Response and Continuous Monitoring (IR/CA) (1 control)
The first thing an assessor checks here is whether CloudWatch alarms have actual response actions configured, not just thresholds. Alarms with no SNS or Lambda action attached fail CA-7 (Continuous Monitoring) and IR-4 (Incident Handling) outright.
System and Communications Protection (SC) (2 controls)
SC-28 requires encryption of stored data using FIPS-validated cryptographic modules. Assessors want to see KMS CMK usage rather than default AWS-managed keys, since CMKs produce an auditable key management trail. Expired or expiring ACM certificates draw SC-12 (Cryptographic Key Establishment and Management) findings, and most teams don't catch them until the auditor does.
Additional Controls (64)
AWS IAM (2)
AWS Lambda (2)
Amazon CloudWatch Logs (1)
Amazon DynamoDB (3)
Amazon EBS (2)
Amazon EC2 (4)
Amazon EFS (2)
Amazon ElastiCache (1)
Amazon OpenSearch Service (2)
Amazon RDS (14)
compliance.tf moduleRDS DB instances and clusters should have enhanced monitoring enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instances should have deletion protection enabledcompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (4)
compliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (11)
compliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object lock enabledcompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleAmazon SageMaker (4)
Elastic Load Balancing (6)
compliance.tf moduleELB application load balancer deletion protection should be enabledcompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should have cross-zone load balancing enabledcompliance.tf moduleRelated Frameworks
NIST 800-53 Rev 5 — 🟢 High overlap (85%)
Rev 5 is the direct successor. Most Rev 4 controls carry forward, but Rev 5 consolidates some control families (for example, merging PM controls into the main catalog), adds supply chain risk management (SR family), and removes the concept of 'control enhancements' as separate items. NIST published the migration mapping in SP 800-53B.
FedRAMP Moderate Rev 4 — 🟢 High overlap (90%)
FedRAMP Moderate baselines are derived directly from the NIST 800-53 Rev 4 moderate baseline, with additional FedRAMP-specific parameters and requirements. Nearly all FedRAMP controls trace back to 800-53, but FedRAMP adds stricter parameter values and continuous monitoring requirements.
NIST CSF — 🟡 Medium overlap (40%)
The NIST Cybersecurity Framework references 800-53 controls as informative references. CSF operates at a higher abstraction level with five functions (Identify, Protect, Detect, Respond, Recover), while 800-53 provides the specific implementation controls. Organizations often use CSF for risk framing and 800-53 for technical implementation.