AWS Well-Architected Security Pillar

International

v2024

7 domains

63 controls

Amazon Web Services security best practices framework

Verified

AWS Well-Architected Security Pillar is a compliance framework from International with 7 domains and 63 controls that map to 28 other frameworks. The largest domains are Identity & Access Management (15 controls), Data Protection (11 controls), Infrastructure Protection (9 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026Published standard

Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.

Visit docs.aws.amazon.com

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Application Security

8 controls

Controls in the Application Security domain of AWS Well-Architected Security Pillar — 8 controls
Code	Title	Description
SEC11-BP01	Train for application security	Provide developers with secure coding training covering OWASP Top 10, AWS specific risks, IAM least privilege and use of...
SEC11-BP02	Automate testing throughout the development and release lifecycle	Embed SAST, SCA, IaC scanning, container image scanning and DAST into CI CD pipelines so vulnerabilities are caught and...
SEC11-BP03	Perform regular penetration testing	Conduct authorised penetration tests against applications and infrastructure on at least an annual cadence and after sig...
SEC11-BP04	Conduct code reviews	Require peer review on every code change with explicit security review criteria, and use CodeGuru Reviewer or similar to...
SEC11-BP05	Centralize services for packages and dependencies	Use private package repositories such as CodeArtifact or ECR with curation, scanning and provenance so applications cons...
SEC11-BP06	Deploy software programmatically	Deploy through automated pipelines with separation of duties, approvals and audit so no human pushes code or infrastruct...
SEC11-BP07	Regularly assess security properties of the pipelines	Treat the CI CD pipeline itself as a sensitive workload and review its IAM roles, secrets handling, runner isolation and...
SEC11-BP08	Build a program that embeds security ownership in workload teams	Establish security champions inside each workload team, give them training and tooling and measure security KPIs alongsi...

Data Protection

11 controls

Controls in the Data Protection domain of AWS Well-Architected Security Pillar — 11 controls
Code	Title	Description
SEC07-BP01	Understand your data classification scheme	Understand and document the classification scheme that applies to the data the workload processes, including handling re...
SEC07-BP02	Apply data protection controls based on data sensitivity	Apply protection controls proportionate to each defined sensitivity level, with published guidance on approved storage s...
SEC07-BP03	Automate identification and classification	Use Macie, Glue, Comprehend and lifecycle automation to continuously discover and classify data without relying on manua...
SEC07-BP04	Define scalable data lifecycle management	Define data lifecycle management that scales, covering how data is handled at ingestion, how sensitivity is reduced thro...
SEC08-BP01	Implement secure key management	Centralise key management in AWS KMS or CloudHSM, define key hierarchies, use customer managed keys for sensitive data a...
SEC08-BP02	Enforce encryption at rest	Ensure all data stores encrypt data at rest using KMS keys, enforce by default through account settings, SCPs and Config...
SEC08-BP03	Automate data at rest protection	Use automated controls such as Config remediation, EventBridge actions and SCPs to detect and correct unencrypted or imp...
SEC08-BP04	Enforce access control	Layer IAM, resource policies, KMS grants, S3 Access Points and VPC endpoint policies to enforce least privilege access t...
SEC09-BP01	Implement secure key and certificate management	Use AWS Certificate Manager and Private CA to issue, deploy and rotate TLS certificates, avoiding manual installation an...
SEC09-BP02	Enforce encryption in transit	Require TLS 1.2 or higher for all client to service and service to service traffic, including within VPCs, and disable l...
SEC09-BP03	Authenticate network communications	Verify the identity of network communications by using protocols that support authentication, such as TLS or IPsec, betw...

Detection

4 controls

Controls in the Detection domain of AWS Well-Architected Security Pillar — 4 controls
Code	Title	Description
SEC04-BP01	Configure service and application logging	Enable CloudTrail across all accounts and regions, VPC Flow Logs, application logs and service-specific logs, centralise...
SEC04-BP02	Capture logs, findings, and metrics in standardized locations	Aggregate security telemetry into standardised destinations such as S3 log archive buckets, Security Hub and a centralis...
SEC04-BP03	Correlate and enrich security alerts	Enrich findings with asset, identity, business owner and threat intel context so responders can triage quickly, and corr...
SEC04-BP04	Initiate remediation for non-compliant resources	Use automated remediation through EventBridge, Systems Manager Automation or Security Hub custom actions to fix common m...

Identity & Access Management

15 controls

Controls in the Identity & Access Management domain of AWS Well-Architected Security Pillar — 15 controls
Code	Title	Description
SEC02-BP01	Use strong sign-in mechanisms	Enforce MFA, strong password policies and phishing-resistant authentication factors for all human users accessing AWS, i...
SEC02-BP02	Use temporary credentials	Replace long-lived IAM access keys with short-lived credentials issued via IAM roles, IAM Identity Center, STS or worklo...
SEC02-BP03	Store and use secrets securely	Store application secrets, database credentials and API keys in AWS Secrets Manager or Parameter Store with encryption,...
SEC02-BP04	Rely on a centralized identity provider	Federate workforce access to AWS through a single corporate identity provider via IAM Identity Center or SAML so that us...
SEC02-BP05	Audit and rotate credentials periodically	Use IAM credential reports, Access Advisor and Access Analyzer to find unused credentials, rotate keys on schedule and r...
SEC02-BP06	Employ user groups and attributes	Assign permissions via groups, permission sets or attribute-based access control rather than to individual users to simp...
SEC03-BP01	Define access requirements	Document who or what requires access to each resource, what actions are permitted and under what conditions, so least pr...
SEC03-BP02	Grant least privilege access	Author IAM policies that grant only the specific actions, resources and conditions required, refining policies from broa...
SEC03-BP03	Establish emergency access process	Define a documented break-glass procedure for emergency access that bypasses normal SSO when the IdP is unavailable, wit...
SEC03-BP04	Reduce permissions continuously	Use IAM Access Analyzer unused access findings and Access Advisor service last accessed data to remove permissions that...
SEC03-BP05	Define permission guardrails for your organization	Apply Service Control Policies, resource control policies and declarative guardrails at the organisation or OU level to...
SEC03-BP06	Manage access based on lifecycle	Tie AWS access grant and revocation to HR joiner mover leaver events so permissions update automatically when roles chan...
SEC03-BP07	Analyze public and cross-account access	Use IAM Access Analyzer to detect resources that grant public or external account access and validate each finding again...
SEC03-BP08	Share resources securely within your organization	Use AWS RAM, resource policies and Organizations conditions to share resources only within trusted account boundaries, a...
SEC03-BP09	Share resources securely with a third party	When granting third-party access use IAM roles with external ID, condition keys, time bound credentials and contractual...

Incident Response

8 controls

Controls in the Incident Response domain of AWS Well-Architected Security Pillar — 8 controls
Code	Title	Description
SEC10-BP01	Identify key personnel and external resources	Maintain an up to date roster of incident responders, executives, legal, comms, AWS support contacts and external IR ret...
SEC10-BP02	Develop incident management plans	Document IR plans covering detection, triage, containment, eradication, recovery and lessons learned, mapped to specific...
SEC10-BP03	Prepare forensic capabilities	Pre-provision a forensic account, isolated VPC, tooling AMIs, IAM roles and EBS snapshot procedures so responders can ac...
SEC10-BP04	Develop and test security incident response playbooks	Develop incident response playbooks giving prescriptive steps for anticipated incident scenarios, and test them so respo...
SEC10-BP05	Pre-provision access	Pre-provision the access incident responders need, using temporary credentials and prepared elevation paths so investiga...
SEC10-BP06	Pre-deploy tools	Pre-stage IR tooling, IAM roles and accounts before incidents so responders are not racing to deploy capabilities while...
SEC10-BP07	Run simulations	Conduct regular game days and tabletop exercises for credential compromise, ransomware and data breach scenarios to test...
SEC10-BP08	Establish a framework for learning from incidents	Run blameless post-incident reviews, capture root causes and contributing factors, and feed improvements back into contr...

Infrastructure Protection

9 controls

Controls in the Infrastructure Protection domain of AWS Well-Architected Security Pillar — 9 controls
Code	Title	Description
SEC05-BP01	Create network layers	Design VPCs with separate public, private and restricted subnets per workload tier, isolating data tiers from internet-f...
SEC05-BP02	Control traffic flow within your network layers	Restrict traffic within each network layer to only the flows each workload component needs, controlling both traffic ent...
SEC05-BP03	Implement inspection-based protection	Use deep packet inspection through AWS Network Firewall, Gateway Load Balancer with third-party appliances or service me...
SEC05-BP04	Automate network protection	Manage network controls as code through CloudFormation, Terraform and Firewall Manager so policies deploy consistently a...
SEC06-BP01	Perform vulnerability management	Continuously scan EC2 instances, container images and Lambda functions with Amazon Inspector and remediate findings on a...
SEC06-BP02	Provision compute from hardened images	Provision compute from hardened baseline images and obtain runtime dependencies such as container images and libraries o...
SEC06-BP03	Reduce manual management and interactive access	Perform deployment, configuration, maintenance and investigation on compute through automation, restricting interactive...
SEC06-BP04	Validate software integrity	Cryptographically verify the integrity of software artefacts the workload consumes and sign software the organisation pr...
SEC06-BP05	Automate compute protection	Automate scanning, patching and remediation of compute resources so protection operations run without human intervention...

Security Foundations

8 controls

Controls in the Security Foundations domain of AWS Well-Architected Security Pillar — 8 controls
Code	Title	Description
SEC01-BP01	Separate workloads using accounts	Use AWS Organizations and multiple AWS accounts to separate workloads, environments and data classifications, enforcing...
SEC01-BP02	Secure account root user and properties	Protect the root user of every AWS account with strong MFA, no programmatic access keys, monitored email and contact det...
SEC01-BP03	Identify and validate control objectives	Derive control objectives from compliance, regulatory and business requirements, document them, and trace each to implem...
SEC01-BP04	Stay up to date with security threats and recommendations	Subscribe to threat intelligence sources, AWS security bulletins and CVE feeds, and incorporate emerging threats into ri...
SEC01-BP05	Reduce security management scope	Reduce the surface the team must secure itself by preferring AWS managed services that shift provisioning, patching and...
SEC01-BP06	Automate deployment of standard security controls	Define standard security controls and configurations as infrastructure as code, version control them, test them in a pip...
SEC01-BP07	Identify threats and prioritize mitigations using a threat model	Conduct threat modeling for each workload using STRIDE or similar, prioritise mitigations against business impact and re...
SEC01-BP08	Evaluate and implement new security services and features regularly	Review new security services and features from the provider and partners on a regular cadence and adopt those that impro...

Your Compliance Coverage

If you comply with AWS Well-Architected Security Pillar, you already cover:

NIST SP 800-53 Rev 5

100%

63 controls mapped

Compare →

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

100%

63 controls mapped

Compare →

ISO 27002:2022

100%

63 controls mapped

Compare →

+ 25 more: ISO 27001:2022 (100%), NIST SP 800-171 Rev 3 (98%)

See all 28 mapped frameworks ↓

Maps to 28 other frameworks

63 total controls

NIST SP 800-53 Rev 5

63 source controls mapped|95 target controls covered

100%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

63 source controls mapped|102 target controls covered

100%

ISO 27002:2022

63 source controls mapped|57 target controls covered

100%

ISO 27001:2022

63 source controls mapped|61 target controls covered

100%

NIST SP 800-171 Rev 3

62 source controls mapped|70 target controls covered

98%

FedRAMP High

62 source controls mapped|154 target controls covered

98%

FedRAMP Moderate

62 source controls mapped|155 target controls covered

98%

NIST Cybersecurity Framework 2.0

62 source controls mapped|67 target controls covered

98%

Azure Security Benchmark

61 source controls mapped|71 target controls covered

97%

NIST SP 800-161 Rev 1

60 source controls mapped|98 target controls covered

95%

CMMC 2.0

59 source controls mapped|77 target controls covered

94%

PCI DSS 4.0

59 source controls mapped|116 target controls covered

94%

NIST SP 800-53 Revision 5.1 HIGH

58 source controls mapped|111 target controls covered

92%

SOC 2

58 source controls mapped|31 target controls covered

92%

NIST SP 800-53 Rev 5 MODERATE

57 source controls mapped|107 target controls covered

90%

CIS Controls v8

56 source controls mapped|94 target controls covered

89%

C5 (Germany)

52 source controls mapped|69 target controls covered

83%

HIPAA Security Rule

52 source controls mapped|37 target controls covered

83%

NIST SP 800-66 Rev 2

51 source controls mapped|35 target controls covered

81%

NIST SP 800-53 Rev 5 LOW

47 source controls mapped|58 target controls covered

75%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

41 source controls mapped|32 target controls covered

65%

ISO 27701:2019

31 source controls mapped|34 target controls covered

49%

Australia Consumer Data Right - Banking (CDR)

24 source controls mapped|12 target controls covered

38%

NIST SP 800-218

21 source controls mapped|31 target controls covered

33%

ACSC Essential Eight

21 source controls mapped|14 target controls covered

33%

UK Cyber Essentials

19 source controls mapped|25 target controls covered

30%

ASD Strategies to Mitigate Cyber Security Incidents

18 source controls mapped|23 target controls covered

29%

ISO/IEC 42001:2023

5 source controls mapped|5 target controls covered

Compare AWS Well-Architected Security Pillar with NIST SP 800-53 Rev 5

What is AWS Well-Architected Security Pillar and who does it apply to?

AWS Well-Architected Security Pillar is a compliance framework from International with 7 domains and 63 controls. Amazon Web Services security best practices framework It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does AWS Well-Architected Security Pillar actually require?

AWS Well-Architected Security Pillar has 63 controls organised across 7 domains. The largest domains are Identity & Access Management (15 controls), Data Protection (11 controls), Infrastructure Protection (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of AWS Well-Architected Security Pillar do I already cover?

AWS Well-Architected Security Pillar maps to 28 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (100% coverage), Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 (100% coverage), ISO 27002:2022 (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement AWS Well-Architected Security Pillar?

Start your AWS Well-Architected Security Pillar compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about AWS Well-Architected Security Pillar requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 63 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required