NIST Cybersecurity Framework v1.1
Deprecated Framework
Best for: Federal contractors and subcontractors demonstrating a cybersecurity risk management program aligned with NIST guidance. Organizations in critical infrastructure sectors (energy, financial services, healthcare, transportation) that reference the CSF in regulatory filings or board-level risk reporting. Companies preparing for NIST 800-171 or CMMC assessments often use CSF v1.1 as a baseline. Note: CSF v2.0 supersedes this version, but many active assessment programs remain tied to v1.1.
| Mandatory? | Voluntary — widely adopted across sectors |
| Who validates? | Self-assessment; optional third-party |
| Renewal | No fixed cycle; continuous improvement |
| Scope | Critical infrastructure and all sectors; five core functions |
🏛 National Institute of Standards and Technology (NIST), U.S. Department of Commerce · NIST CSF v1.1 (Apr 2018, superseded by v2.0) Official source →
Get Started
module "..." {
source = "nistcsfv11.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Encryption at Rest: Checks encryption configuration on API Gateway cache stages and backup recovery points. apigateway_stage_cache_encryption_at_rest_enabled and backup_recovery_point_encryption_enabled confirm that data-at-rest encryption is active on covered services.
- Encryption in Transit: Flags ACM certificates expiring within 30 days and API Gateway stages missing SSL certificates. Controls: acm_certificate_expires_30_days and apigateway_rest_api_stage_use_ssl_certificate.
- Network and Instance Hardening: Verifies that WAF web ACLs are attached to API Gateway stages and that launch configurations enforce IMDSv2, disable public IPs by default, and restrict metadata hop limits. Covers autoscaling_launch_config_requires_imdsv2 and apigateway_stage_use_waf_web_acl.
- Backup and Recovery: Confirms backup plan retention meets the 35-day minimum, that recovery point manual deletion is disabled, and that recovery points have not expired prematurely. Covers backup_plan_min_retention_35_days and backup_recovery_point_manual_deletion_disabled.
- High Availability and Resilience: Checks that Auto Scaling groups span multiple availability zones with health check integration, deploy multiple instance types, and that CloudFront distributions have origin failover configured.
- Logging and Monitoring: Validates API Gateway stage logging, X-Ray tracing on REST API stages, and SNS notifications on CloudFormation stacks. Covers apigateway_stage_logging_enabled and apigateway_rest_api_stage_xray_tracing_enabled.
What you handle
- Encryption at Rest: Define and document your encryption policy, manage KMS key rotation schedules, audit key access grants, and extend encryption coverage to services outside the scope of these controls (including application-level encryption).
- Encryption in Transit: Enforce minimum TLS version requirements (TLS 1.2+), configure certificate auto-renewal, and validate TLS on internal service-to-service communication paths not fronted by API Gateway.
- Network and Instance Hardening: Write and tune WAF rule sets, define security group and NACL policies, run penetration testing, and manage your vulnerability scanning program.
- Backup and Recovery: Set RPO and RTO targets per workload, run periodic recovery tests (tabletop and live), document recovery runbooks, and verify that backup data actually restores successfully.
- High Availability and Resilience: Capacity planning, chaos engineering exercises, failover procedures for stateful workloads, and cross-region disaster recovery testing where applicable.
- Logging and Monitoring: Build detection rules and alerting thresholds in your SIEM, staff a security operations function to triage alerts, and retain logs for the period your risk profile or regulatory obligations require.
Controls by Category
Detect: Security Continuous Monitoring (DE.CM) (3 controls)
The most frequent gap is not missing logging but logging that exists without feeding into alerting. Assessors check whether API activity reaches CloudWatch, whether distributed tracing gives request-level visibility, and whether infrastructure change notifications actually reach the security operations team.
Protect: Data Security (PR.DS) (2 controls)
Configuration snapshots, certificate inventory exports, and KMS key policies are the primary evidence set here. Expired or soon-to-expire ACM certificates, API stages transmitting without TLS, and unencrypted backup recovery points are the most common findings. Assessors also check that approved algorithms are in use, not just that encryption is nominally enabled.
Recover: Recovery Planning (RC.RP) (1 control)
The first thing an assessor asks for is documented RPO and RTO targets per workload, then checks that backup configurations actually enforce them. Core evidence includes AWS Backup plan definitions showing 35-day minimum retention, vault lock policies blocking manual deletion, and records of successful backup job completion. Organizations routinely fail on the deletion protection requirement, leaving recovery points exposed to insider threat or ransomware.
Additional Controls (133)
AWS CloudTrail (4)
AWS CodeBuild (4)
AWS Database Migration Service (1)
AWS IAM (2)
AWS Lambda (5)
compliance.tf moduleLambda functions should be configured with a dead-letter queuecompliance.tf moduleLambda functions should be in a VPCcompliance.tf moduleLambda functions should restrict public URLcompliance.tf moduleLambda functions should use latest runtimescompliance.tf moduleAWS Secrets Manager (1)
Amazon CloudFront (6)
compliance.tf moduleCloudFront distributions should require encryption in transitcompliance.tf moduleCloudFront distributions access logs should be enabledcompliance.tf moduleCloudFront distributions should use SNI to serve HTTPS requestscompliance.tf moduleCloudFront distributions should use custom SSL/TLS certificatescompliance.tf moduleCloudFront distributions should have AWS WAF enabledcompliance.tf moduleAmazon CloudWatch (3)
Amazon CloudWatch Logs (1)
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (1)
Amazon EBS (2)
Amazon EC2 (10)
compliance.tf moduleEC2 instances should have EBS optimization enabledcompliance.tf moduleEC2 instances should have IAM profile attachedcompliance.tf moduleEC2 instances should be in a VPCcompliance.tf moduleEC2 instances should not use key pairs in running statecompliance.tf moduleEC2 instances should not have a public IP addresscompliance.tf moduleEC2 instances should not use multiple ENIscompliance.tf moduleEC2 instances should use IMDSv2compliance.tf moduleEC2 instances should not use paravirtual instance typescompliance.tf moduleEC2 transit gateways should have auto accept shared attachments disabledAmazon ECR (2)
Amazon ECS (3)
Amazon EFS (4)
Amazon EKS (3)
Amazon ElastiCache (1)
Amazon Kinesis (1)
Amazon OpenSearch Service (7)
compliance.tf moduleOpenSearch domains should have encryption at rest enabledcompliance.tf moduleOpenSearch domains should have fine-grained access control enabledcompliance.tf moduleOpenSearch domains should use HTTPScompliance.tf moduleOpenSearch domains should be in a VPCcompliance.tf moduleOpenSearch domains should have logging to CloudWatch Logs enabledcompliance.tf moduleOpenSearch domains node-to-node encryption should be enabledcompliance.tf moduleAmazon RDS (17)
compliance.tf moduleRDS clusters should have deletion protection enabledcompliance.tf moduleRDS DB clusters should have IAM authentication configuredcompliance.tf moduleRDS DB clusters should be configured for multiple Availability Zonescompliance.tf moduleRDS database clusters should use a custom administrator usernamecompliance.tf moduleRDS DB instances and clusters should have enhanced monitoring enabledcompliance.tf moduleRDS DB instance automatic minor version upgrade should be enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instances should have deletion protection enabledcompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have iam authentication enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS database instances should use a custom administrator usernamecompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleAmazon Redshift (10)
compliance.tf moduleRedshift clusters should have automatic snapshots enabledcompliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have enhanced VPC routing enabledcompliance.tf moduleRedshift clusters should have KMS encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should not use the default admin usernamecompliance.tf moduleRedshift clusters should not use the default database namecompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (19)
compliance.tf moduleS3 buckets should have cross-region replication enabledcompliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have event notifications enabledcompliance.tf moduleS3 buckets should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should have MFA delete enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object lock enabledcompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should restrict cross-account permissionscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets with versioning enabled should have lifecycle policies configuredcompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleAmazon SageMaker (4)
Elastic Load Balancing (9)
compliance.tf moduleELB application load balancer deletion protection should be enabledcompliance.tf moduleELB application load balancers should be configured with defensive or strictest desync mitigation modecompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancers should only use SSL or HTTPS listenerscompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should have cross-zone load balancing enabledcompliance.tf moduleELB classic load balancers should span multiple availability zonescompliance.tf moduleOther (6)
compliance.tf moduleNetwork Firewall policies should have default stateless action set to drop or forward for full packetscompliance.tf moduleRelated Frameworks
NIST CSF v2.0 — 🟢 High overlap (85%)
NIST CSF v2.0 is the direct successor. It adds a sixth function (Govern) and expands supply chain risk management. Most v1.1 subcategories carry forward with revised identifiers, so control mappings translate closely, but v2.0 introduces requirements around organizational context and cybersecurity governance that have no v1.1 equivalent.
NIST 800-53 Rev 5 — 🟢 High overlap (70%)
NIST CSF v1.1 was designed as an abstraction layer above 800-53 controls. NIST publishes an explicit mapping between CSF subcategories and 800-53 Rev 5 control families. The CSF is outcome-focused, while 800-53 prescribes specific control implementations. Organizations using the CSF for risk framing often adopt 800-53 controls as their implementation detail.
ISO/IEC 27001:2022 — 🟡 Medium overlap (55%)
NIST provides an official informative reference mapping between CSF subcategories and ISO 27001 Annex A controls. The overlap is strongest in the Protect and Detect functions. ISO 27001 requires a formal ISMS with certification audits, while the CSF is a voluntary risk framework with no certification body.