AWS Well-Architected Security Pillar
Infrastructure Protection

AWS Well-Architected Security Pillar SEC06-BP02: Provision compute from hardened images

Build compute from hardened baseline images, and pull what workloads need at runtime (libraries, container images and similar dependencies) only from trusted registries whose signatures have been verified.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 79 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-161 Rev 1 · 8 controls

FedRAMP High · 7 controls

  • CM-11 User-Installed Software
  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
  • CM-7(1) Periodic Review
  • CM-7(5) Authorized Software Allow-by-Exception
  • SR-11 Component Authenticity (SR-11)

FedRAMP Moderate · 7 controls

  • CM-11 User-Installed Software
  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
  • CM-7(1) Periodic Review
  • CM-7(5) Authorized Software Allow-by-Exception
  • SR-11 Component Authenticity (SR-11)

NIST SP 800-53 Rev 5 · 6 controls

CMMC 2.0 · 5 controls

ASD Strategies to Mitigate Cyber Security Incidents · 4 controls

  • ASD37-09 OS generic exploit mitigation (Excellent)
  • ASD37-10 Server application hardening (Very Good)
  • ASD37-11 Operating system hardening (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

CIS Controls v8 · 4 controls

  • CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components
  • CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure
  • CIS-4.1 Establish and Maintain a Secure Configuration Process
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
  • NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
  • NIST-CSF-PR.PS-01 Configuration management practices are established and applied
  • NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented

NIST SP 800-171 Rev 3 · 4 controls

PCI DSS 4.0 · 4 controls

  • 2.2.1 2.2.1 System configuration standards maintained
  • 2.2.2 2.2.2 Vendor default accounts managed
  • 2.2.4 2.2.4 Only necessary functionality enabled
  • 2.2.6 2.2.6 System security parameters configured against misuse

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ISO 27001:2022 · 3 controls

  • 5.21 Managing information security in the information and communication technology (ICT) supply chain
  • 8.19 Installation of software on operational systems
  • 8.9 Configuration management

ISO 27002:2022 · 3 controls

  • 8.19 Installation of software on operational systems
  • 8.7 Protection against malware
  • 8.9 Configuration management

Australia Consumer Data Right - Banking (CDR) · 2 controls

  • AUCDR-IS-2 Secure the network and systems within the data environment
  • AUCDR-IS-5 Limit, prevent, detect and remove malware

Azure Security Benchmark · 2 controls

  • ASBv3-AM-5 Use only approved applications in virtual machine
  • ASBv3-PV-3 Define and establish secure configurations for compute resources

C5 (Germany) · 2 controls

  • C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening
  • C5-PSS-11 Images for Virtual Machines and Containers

NIST SP 800-218 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software
  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities

UK Cyber Essentials · 2 controls

  • CE-SC.1 Remove or Disable Unused Software
  • CE-SC.2 Change Default Passwords on Devices and Software

ACSC Essential Eight · 1 control

  • E8-UAH-ML2 User Application Hardening - Maturity Level 2

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate

HIPAA Security Rule · 1 control

ISO 27701:2019 · 1 control

  • 6.9.5 Control of operational software

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Infrastructure Protection

You are reading one control. How much of AWS Well-Architected Security Pillar have you already done?

AWS Well-Architected Security Pillar SEC06-BP02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of AWS Well-Architected Security Pillar your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 52 of 63 AWS Well-Architected Security Pillar controls already carry evidence.

If you hold NIST SP 800-53 Rev 582.5% covered · 11 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.6% covered · 16 gapsIf you hold ISO 27002:202273% covered · 17 gapsIf you hold FedRAMP Moderate69.8% covered · 19 gapsIf you hold Azure Security Benchmark65.1% covered · 22 gapsIf you hold PCI DSS 4.063.5% covered · 23 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 79 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll AWS Well-Architected Security Pillar controls