CIS AWS 7.0, every recommendation checked.
Unlike most frameworks, almost all of the CIS AWS benchmark can be settled by checks. The gap is in the newest recommendations, which a CNAPP mapped to an older version may not have yet.
You will recognise this if
- Your CNAPP reports against CIS AWS 6.0, and your auditor asks for 7.0.
- Organizations guardrails and resource policies open to everyone are new in 7.0, and nothing checks them yet.
- A recommendation passes in one account and fails in thirty, and the report shows one line.
- The same failures come back after every fix.
What a CNAPP covers, and what it leaves.
The product team reviewed one widely used CNAPP’s AWS policies against every requirement in CIS AWS Foundations 7.0, and kept only the policies that really evidence it. Each requirement is counted once.
- A CNAPP policy counts towards it53
The CNAPP has a policy that tests what the requirement asks. NxSCORE checks it too, and counts each failing resource once.
- Only NxSCORE checks cover it17
A setting can be tested, but the CNAPP has no policy for it, or one that tests something else.
Version 7.0 added ten recommendations, including AWS Organizations guardrails and resource policies that allow anyone. A CNAPP mapping carried over from 6.0 has no policy for those yet; NxSCORE checks them.
Four requirements, and what each one takes.
For every requirement NxSCORE says how it can be met, and why checks are not enough where they are not.
| Requirement | Covered by | What it takes |
|---|---|---|
| 4.2 CloudTrail log file validation is on | CNAPP policy and NxSCORE checks | Settled by checks, in every account and region. |
| 2.16 Instances use IAM roles to reach other AWS resources | CNAPP policy and NxSCORE checks | Settled by checks. |
| 2.1.1 Root access is centralised in AWS Organizations | NxSCORE checks only | New in 7.0. Settled by NxSCORE checks. |
| 5.2 Console sign-in without MFA is monitored | NxSCORE checks only | The policy a CNAPP maps here watches failed sign-ins, which is a different thing. NxSCORE checks the right alarm. |
Every requirement in one record. Now, proved once.
How NxSCORE keeps CIS AWS Foundations current.
The daily assessment settles what checks can settle. Your team and your analyst handle the rest, and the record shows who did what.
- 01
A status for every requirement, with the reason.
Each requirement shows how it is met, the checks behind it and whether each ran, the CNAPP policies that count towards it, and its failing resources, with a resource failing in both tools counted once.
Requirement statusSix states- Met
The checks pass, and any evidence it needs is accepted
- Met by compensating control
Met another way, reviewed by your analyst
- Failing
A check fails on at least one resource
- Evidence needed
No accepted evidence, or it has lapsed
- In review
Evidence waiting for your analyst
- Not assessed
The checks behind it could not run
- 02
Evidence prepared by your team, accepted by someone else.
Your team writes up the evidence and attaches the files. Your NxSCORE analyst accepts it, returns it with a reason, or rejects it, and whoever returned it cannot accept the resubmission. Accepted evidence counts to the end of the quarter, plus 30 days, and the daily assessment says when it falls due.
Evidence, one requirementCounted- PreparedYour team writes it up and attaches the files.
- ReviewedYour analyst accepts it, returns it with a reason, or rejects it.
- CountedTo the end of the quarter, plus 30 days.
- Due againThe daily assessment says when, and asks for it fresh.
- 03
Upload once, counted everywhere it applies.
One artifact often answers several frameworks. An approved information security policy counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01. Before accepting, the analyst sees every requirement the upload will meet.
NxSCORE keeps 7.0, 6.0 and 5.0. Compensating controls carry across them, such as SIEM alerting on CloudTrail in place of the 5.x metric filters.
Information security policy, approvedOne uploadRequirement Status ISO 27001 A.5.1 Met PCI DSS 12.1.1 Met NIST CSF GV.PO-01 Met - 04
The fixes that clear the most, first.
Every failing check behind a requirement is ranked by how many requirements it is the only failure in, and how many more it contributes to. The fix kit is written for your engineers to run; NxSCORE’s access stays read-only.
Fix these first, CIS AWS Foundations 7.0ExampleFailing check Alone holds back Contributes to CloudTrail log file validation off in 3 accounts Clears 9 14 Root account used in the last 90 days Clears 6 11 Security groups open to the internet on admin ports Clears 4 17 - 05
An evidence pack your assessor can read.
CIS AWS Foundations 7.0 downloads as one Excel workbook, laid out requirement by requirement with the evidence beside it. Its first sheet says plainly that it is not a report on compliance: that comes from your independent assessor or auditor.
Evidence pack, CIS AWS Foundations 7.0Excel, three sheetsSummary Requirements by status, as of the latest assessment Requirements Status, how each is met, failing resources, checks and CNAPP policies Evidence and compensating Status, when last accepted, when due again, and the files
Questions about CIS AWS Foundations in the cloud.
What changed between CIS AWS Foundations 6.0 and 7.0?
Version 7.0 added ten recommendations, among them AWS Organizations guardrails (2.1.1 to 2.1.6), resource policies that allow anyone (2.21), web front-end access logging (4.10) and VPC endpoints (6.8). It dropped three and renumbered seventeen.
Can CIS AWS Foundations be fully automated?
Nearly. Every recommendation in 7.0 can be checked through read-only APIs. Where you meet one another way, such as SIEM alerting in place of metric filters, a compensating control records it, reviewed by your analyst.
Does NxSCORE cover the other CIS AWS benchmarks?
Yes. The catalogue also holds the CIS AWS three-tier web architecture benchmark, the compute, database, storage and end-user compute benchmarks, Amazon EKS, and the operating-system benchmarks, which are turned on only if you choose.
See every account against CIS AWS 7.0.
Connect one cloud account. After the first assessment, your analyst takes you through what fails where, which recommendations are new since 6.0, and which fixes stop the same failures coming back.