Skip to content

CISA Cyber Essentials

The Cybersecurity and Infrastructure Security Agency (CISA) Cyber Essentials is a guide for leaders of small businesses and state, local, tribal, and territorial governments to develop actionable understanding of implementing organizational cybersecurity practices. Developed by the U.S. Department of Homeland Security's CISA, this framework provides baseline cybersecurity practices for critical infrastructure organizations. It is designed for resource-constrained organizations seeking to establish fundamental security controls.

Terraform Registry Subdomain: cisacyberessentials

module "..." {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://cisacyberessentials.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with CISA Cyber Essentials compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://cisacyberessentials.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_stage_cache_encryption_at_rest_enabled"
}