Framework mapper
Explore published AWS and Azure control mappings to security frameworks.
38 selected controls · AWS / Azure · Dataset updated 2026-09-12
| Cloud control | Framework version | Related requirement | Evidence |
|---|---|---|---|
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2 | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2(1) | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3 | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3(15) | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3(7) | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-5 | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-6 | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-6(10) | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-6(2) | AWS source ↗ |
| AWS · IAM.1Restrict broad administrator policiesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-6(3) | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2 | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2(1) | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3 | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3(15) | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3(7) | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-6 | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-6(3) | AWS source ↗ |
| AWS · IAM.2Assign permissions through groups or rolesAWS Security Hub CSPM | CIS AWS Foundations Benchmark v5.0.0 | 1.14 | AWS source ↗ |
| AWS · IAM.3Rotate long-lived access keysAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2(1) | AWS source ↗ |
| AWS · IAM.3Rotate long-lived access keysAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2(3) | AWS source ↗ |
| AWS · IAM.3Rotate long-lived access keysAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-3(15) | AWS source ↗ |
| AWS · IAM.3Rotate long-lived access keysAWS Security Hub CSPM | CIS AWS Foundations Benchmark v5.0.0 | 1.13 | AWS source ↗ |
| AWS · IAM.3Rotate long-lived access keysAWS Security Hub CSPM | PCI DSS v4.0.1 | 8.3.9 | AWS source ↗ |
| AWS · IAM.3Rotate long-lived access keysAWS Security Hub CSPM | PCI DSS v4.0.1 | 8.6.3 | AWS source ↗ |
| AWS · IAM.4Remove root account access keysAWS Security Hub CSPM | NIST SP 800-53 Rev. 5 | AC-2(1) | AWS source ↗ |
Sources & scope
AWS: selected Security Hub CSPM relationships to NIST SP 800-53 Rev. 5, PCI DSS 4.0.1, and CIS AWS Foundations Benchmark 5.0.0.
Azure: selected Microsoft cloud security benchmark v2 (preview) mappings to NIST SP 800-53 Rev. 5, CIS Controls 8.1, and ISO/IEC 27001:2022. Coverage includes identity, privileged access, network security, data protection, and AI security. These are benchmark recommendations, not results of automated Azure Policy checks. Microsoft benchmark overview.
A relationship means the publisher associates a requirement with a control. It does not establish equivalence between frameworks, complete coverage, or compliance. AWS technical checks and Azure benchmark recommendations have different scopes. CIS AWS Foundations is distinct from CIS Controls.
This is a reviewed selection, not a complete crosswalk. Azure PCI DSS, NIST CSF, and SOC 2 relationships are not included. A missing relationship does not establish that no relationship exists. Preview mappings may change.
Summaries are written by Bastet. Identifiers and relationships come from the linked publisher documentation. Each exported row includes its cloud, source benchmark, publisher, framework version, and review date. Download the versioned data. Read the source for implementation details, exceptions, and the publisher’s mapping limitations.