Compliance, Mapped to Your Cloud
Assess your AWS, Azure, and Google Cloud environments against the industry frameworks and regulations your auditors expect.
NIST CSF v1.0
The NIST Cybersecurity Framework (CSF) organizes security activities around its core functions — Identify, Protect, Detect, Respond, and Recover.
Controls assessed
Physical devices and systems within the organization are inventoried.
Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.
Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Data-at-rest is protected.
Data-in-transit is protected.
Assets are formally managed throughout removal, transfers, and disposition.
A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
A System Development Life Cycle to manage systems is implemented.
Backups of information are conducted, maintained, and tested.
Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.
Detected events are analyzed to understand attack targets and methods.
Event data are collected and correlated from multiple sources and sensors.
The network is monitored to detect potential cybersecurity events.
Notifications from detection systems are investigated.
Personnel know their roles and order of operations when a response is needed.
See where you stand against any framework
Connect an account and get a full compliance breakdown with mapped findings and remediation guidance — free to start.