Home > AWS Security Maturity Model v2

AWS Security Maturity Model v2

CAF Levels →	Start		Advance	Excel
CAF Capability ↓	Phase 1: Quick Wins	Phase 2: Foundational	Phase 3: Efficient	Phase 4: Optimized
Security governance	Assign Security contacts Select the region(s) to use and block the rest	Identify security and regulatory requirements Cloud Security Training Plan	Design your secure architecture Use infrastructure as code Tagging strategy	Sharing security work and responsibility
Security assurance	Evaluate Cloud Security Posture (CSPM)	Inventory & Configuration monitoring	Create your compliance reports	Automate Evidence Gathering
Identity and access management	Multi-Factor Authentication Root Account Protection Identity Federation Cleanup unintended accesses	GuardRails: Organizational Policies with SCPs/RCPs Use Temporary Credentials Instance Metadata Service (IMDS) v2	Least Privilege Review Customer IAM: security of your customers	IAM Data Perimeters IAM Policy Generation Pipeline Temporary Elevated Access
Threat detection	Detect Common Threats Audit API calls Billing alarms	Advanced Threat Detection	Custom Threat Detection capabilities (SecLake / SIEM)	Threat Intelligence Network Flows analysis (VPC Flow Logs)
Vulnerability management		Manage infrastructure vulnerabilities Manage application vulnerabilities	Security Champions Program DevSecOps: Security in the Pipeline	Vulnerability Management Team
Infrastructure protection	Cleanup risky open ports	Limit Network Access Secure EC2 Instances Management Network segmentation (VPCs) Multi-account management	Image Generation Pipeline Anti-Malware / EDR / Runtime Protection Outbound Traffic Control	Zero Trust Access Use abstract services
Data protection	Block Public Access Analyze data security posture	Data Encryption at rest Backups Discover sensitive data	Encryption in transit	AI Data protection
Application security	WAF with managed rules	Involve security teams in development No secrets in code	Perform threat modeling WAF with custom rules Advanced DDoS Mitigation (L7)	Forming a Red Team (Attacker's Point of View)
Incident response	Act on Critical Security Findings	Define incident response playbooks	Run TableTop Exercises - Simulations Automate Critical Playbooks Security Investigations - Root cause analysis	Forming a Blue Team (Incident Response) Advanced security automations Security Orchestration & Ticketing Automate deviation correction in configurations
Resiliency	Evaluate Resilience	Redundancy using multiple Availability Zones	Disaster Recovery Plan	Multi-region Disaster Recovery Automation Chaos Engineering