Skip to content

NIST Cybersecurity Framework v1.1

Deprecated Framework

This framework has been superseded by NIST Cybersecurity Framework v2.0. Organizations should migrate to version 2.0, which was released in February 2024 with an additional Govern function and enhanced guidance on supply chain risk management.

The National Institute of Standards and Technology (NIST) Cybersecurity Framework version 1.1 provides a policy framework of standards, guidelines, and best practices to manage cybersecurity-related risk. Published in April 2018 by the U.S. Department of Commerce, it organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover. Originally developed for critical infrastructure, it is widely adopted across all sectors and organization sizes globally.

Terraform Registry Subdomain: nistcsfv11

module "..." {
  source  = "nistcsfv11.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://nistcsfv11.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with NIST Cybersecurity Framework v1.1 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://nistcsfv11.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_rest_api_stage_xray_tracing_enabled"
}