AWS Security Maturity Model v2

CAF Levels → Start Advance Excel
CAF Capability ↓ Phase 1: Quick Wins Phase 2: Foundational Phase 3: Efficient Phase 4: Optimized
Security governance Assign Security contacts Select the region(s) to use and block the rest Identify security and regulatory requirements Cloud Security Training Plan Design your secure architecture Use infrastructure as code Tagging strategy Sharing security work and responsibility
Security assurance Evaluate Cloud Security Posture (CSPM) Inventory & Configuration monitoring Create your compliance reports Automate Evidence Gathering
Identity and access management Multi-Factor Authentication Root Account Protection Identity Federation Cleanup unintended accesses GuardRails: Organizational Policies with SCPs/RCPs Use Temporary Credentials Instance Metadata Service (IMDS) v2 Least Privilege Review Customer IAM: security of your customers IAM Data Perimeters IAM Policy Generation Pipeline Temporary Elevated Access
Threat detection Detect Common Threats Audit API calls Billing alarms Advanced Threat Detection Custom Threat Detection capabilities (SecLake / SIEM) Threat Intelligence Network Flows analysis (VPC Flow Logs)
Vulnerability management Manage infrastructure vulnerabilities Manage application vulnerabilities Security Champions Program DevSecOps: Security in the Pipeline Vulnerability Management Team
Infrastructure protection Cleanup risky open ports Limit Network Access Secure EC2 Instances Management Network segmentation (VPCs) Multi-account management Image Generation Pipeline Anti-Malware / EDR / Runtime Protection Outbound Traffic Control Zero Trust Access Use abstract services
Data protection Block Public Access Analyze data security posture Data Encryption at rest Backups Discover sensitive data Encryption in transit GenAI Data protection
Application security WAF with managed rules Involve security teams in development No secrets in code Perform threat modeling WAF with custom rules Advanced DDoS Mitigation (L7) Forming a Red Team (Attacker's Point of View)
Incident response Act on Critical Security Findings Define incident response playbooks Run TableTop Exercises - Simulations Automate Critical Playbooks Security Investigations - Root cause analysis Forming a Blue Team (Incident Response) Advanced security automations Security Orchestration & Ticketing Automate deviation correction in configurations
Resiliency Evaluate Resilience Redundancy using multiple Availability Zones Disaster Recovery Plan Multi-region Disaster Recovery Automation Chaos Engineering