Skip to content

NIST Cybersecurity Framework v2.0

The National Institute of Standards and Technology (NIST) Cybersecurity Framework version 2.0 provides an updated policy framework of standards, guidelines, and best practices to manage cybersecurity-related risk. Published in February 2024 by the U.S. Department of Commerce, this version adds a sixth core function (Govern) and expands guidance on supply chain risk management and cybersecurity measurement. It is applicable to organizations of all sizes across all sectors globally.

Terraform Registry Subdomain: nistcsf

module "..." {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://nistcsf.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with NIST Cybersecurity Framework v2.0 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://nistcsf.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=acm_certificate_rsa_key_length_2048_bits_or_greater,acm_certificate_transparency_logging_enabled"
}