Introduction to CIS Benchmarks
The Center for Internet Security (CIS) publishes security benchmarks that outline foundational best practices for securing systems and cloud environments. These benchmarks are widely adopted as a starting point for organisations securing workloads in Amazon Web Services. They focus on basic configurations and technical settings, helping establish a baseline — though they are often opinionated and not tailored for complex, real-world environments.
Auditors, security leaders, and compliance teams frequently reference CIS benchmarks to ensure critical controls are in place.
Why Map CIS to TrustOnCloud?
TrustOnCloud goes beyond prescriptive configuration checks. Our controls are built to address actual threats, not just configuration drift. Still, many customers are asked to demonstrate alignment with CIS benchmarks and that's where this mapping comes in.
By aligning TrustOnCloud controls with the CIS AWS Foundations Benchmark, we help customers:
- Satisfy baseline requirements for auditors
- Identify which TrustOnCloud controls correspond to each CIS recommendation
- Understand where we provide more flexible or risk-driven alternatives
This mapping covers the CIS AWS Foundations Benchmark v5.0.0. The full interactive version lives in our documentation at app.trustoncloud.com/compliance-map?framework=cis_aws.
CIS-to-TrustOnCloud Mapping
The table below shows the control-level alignment for each CIS ID in v5.0.0. Where no TrustOnCloud Control ID is listed, commentary explains which related controls or threats address the same underlying risk.
Section 1 — Identity and Access Management
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
| 1.3 | Iam.C105 states that root credentials should be managed centrally from the management account, which is recommended, and it would prevent usage of root user and/or its access keys. | |
| 1.4 | Iam.C81 assured by Iam.C82 under CO27 | Where Iam.C105 cannot be enforced, Iam.C81 recommends using MFA. |
| 1.5 | Iam.C84 assured by Iam.C85 under CO27 | |
| 1.6 | While not specific for the root user, threat Iam.T7 and its controls Iam.C1 and Iam.C2 recommend maintaining the list of IAM permissions able to launch attacks. Additionally, review control Iam.C105 assured by Iam.C110 under CO29 to remove root usage from member accounts in an organisation. | |
| 1.9 | Iam.C81 assured by Iam.C82 under CO27 | |
| 1.11 | Iam.C28 assured by Iam.C29 under CO6 | |
| 1.13 | Iam.C29 under CO6 | |
| 1.15 | Iam.C60 assured by Iam.C61 under Iam.CO1 | |
| 1.17 | Iam.C66 assured by Iam.C67 under CO21 | |
| 1.18 | Not recommended. The feature class exists in IAM ThreatModel, but points to ACM as the service to use for certificates. | |
| 1.19 | Iam.C17 under CO1 | |
| 1.20 | Iam.C24 under CO5, Iam.C31 assured by Iam.C32 under CO7 | |
| 1.21 | Iam.C1 and Iam.C2 recommend checking for permissions; they are not specific to CloudShell. |
Section 2 — Storage
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
| 2.1.1 | S3.C6 assured by S3.C7 under CO1 | Our control includes RCPs as a prevention mechanism. |
| 2.1.2 | MFA delete is supported for IAM users only, and we don't recommend IAM users. S3.C38 assured by S3.C39 can be used to implement a guardrail via RCP or SCP. | |
| 2.1.3 | S3.C118 under CO4 | |
| 2.1.4 | S3.C49 assured by S3.C50 for account level settings, S3.C51 assured by S3.C52 for bucket level settings, under CO13. S3.C53 assured by S3.C54 under CO13 for S3 access points. | |
| 2.2.1 | Rds.C35 assured by Rds.C36 under CO10 | |
| 2.2.2 | Rds.C93 assured by Rds.C94 under CO4 | |
| 2.2.3 | Rds.C1 assured by Rds.C3 under CO1 | |
| 2.2.4 | Rds.C160 assured by Rds.C161 under CO35 | |
| 2.3.1 | Efs.C13 assured by Efs.C15 for authorised KMS keys; Efs.C16 assured by Efs.C18 to prevent unencrypted file systems, both under CO5 |
Section 3 — Logging
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
| 3.1 | Cloudtrail.C28 assured by Cloudtrail.C29 under CO8 | |
| 3.2 | Cloudtrail.C11 assured by Cloudtrail.C12 under CO4 | |
| 3.3 | Cloudtrail.C28 assured by Cloudtrail.C29 under CO8 | |
| 3.4 | S3.C58 under CO15, S3.C166 under CO39 | |
| 3.5 | Cloudtrail.C25 assured by Cloudtrail.C27 under CO7 | |
| 3.6 | Kms.C9 assured by Kms.C10 under Kms.CO3 | |
| 3.7 | Vpc.C130 assured by Vpc.C131 under CO13, and CO6 to protect VPC flow logs | |
| 3.8 | S3.C8 under CO3 | |
| 3.9 | S3.C8 under CO3 |
Section 4 — Monitoring
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
| 4.1 | Iam.C4, Iam.C5 under CO1 for unauthorised actions | Additional controls protect the log pipeline: Cloudtrail.C4 assured by Cloudtrail.C5 under CO2 for authorised CloudWatch log groups; Cloudwatch.C17 under CO6 for authorised metric filters; Cloudwatch.C23 under CO9 for authorised alarms. |
| 4.2 | Iam.C24 assured by Iam.C26 under CO5 states that no IAM user should have a login profile. | |
| 4.3 | Iam.C78 under CO1 using GuardDuty, and Iam.C105 states that root credentials should be managed centrally. Iam.C107 monitors for short-term root credential usage with GuardDuty. | |
| 4.4 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | We focus on Indicators of Compromise (IoC) rather than per-API alerting, which produces a high number of false positives. Iam.C4 (denied calls), Iam.C5 (abnormal calls), Iam.C20 (unauthorised IP), Iam.C57 (unauthorised service roles), Iam.C64 (unauthorised user agents). GuardDuty finding "PrivilegeEscalation:IAMUser/AnomalousBehavior" also covers many of these behaviours (Iam.C77). |
| 4.5 | Cloudtrail.C22 monitors for disabling CloudTrail via GuardDuty. Cloudtrail.C10 for unauthorised bucket updates; Cloudtrail.C15 for unauthorised parameters; Cloudtrail.C26 for unauthorised key updates. | |
| 4.7 | Kms.C12 and Kms.C14 to monitor unauthorised key deletions or disabling; Kms.C63 to prevent it | |
| 4.8 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | Same IoC-focused approach as 4.4. S3 APIs tracked in our threats include PutBucketAcl (S3.T4), PutBucketPolicy (S3.T37), PutBucketCors (S3.T29), PutBucketLifecycle (S3.T25), PutBucketReplication (S3.T2). |
| 4.9 | Config.C5 monitors for unauthorised stop of the recorder; Config.C12 for unauthorised delivery channel updates; Config.C87 for recording mode overrides all associated to Config.T2. | |
| 4.10 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | APIs tracked in threats: AuthorizeSecurityGroupIngress (Vpc.T22), AuthorizeSecurityGroupEgress (Vpc.T22), RevokeSecurityGroupIngress (Vpc.T22), DeleteSecurityGroup (Vpc.T3), ModifySecurityGroupRules (Vpc.T22). |
| 4.11 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | APIs tracked: CreateNetworkAcl (Vpc.T2), CreateNetworkAclEntry (Vpc.T2, Vpc.T20), DeleteNetworkAcl (Vpc.T3), ReplaceNetworkAclEntry (Vpc.T2, Vpc.T20). |
| 4.12 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | APIs tracked: CreateCustomerGateway (Vpc.T39), AttachInternetGateway (Vpc.T16, Vpc.T18), CreateInternetGateway (Vpc.T16), DeleteInternetGateway (Vpc.T2), DetachInternetGateway (Vpc.T2). |
| 4.13 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | APIs tracked: CreateRoute (Vpc.T2, Vpc.T21), CreateRouteTable (Vpc.T21), ReplaceRoute (Vpc.T2, Vpc.T21), DeleteRouteTable (Vpc.T3), DisassociateRouteTable (Vpc.T2, Vpc.T21). |
| 4.14 | Iam.C4, Iam.C5, Iam.C64 under Iam.CO1; Iam.C20 under Iam.CO11; Iam.C57 under Iam.CO18 | APIs tracked: DeleteVpc (Vpc.T3), ModifyVpcAttribute (Vpc.T2), AcceptVpcPeeringConnection (Vpc.T6), CreateVpcPeeringConnection (Vpc.T6), EnableVpcClassicLink (Vpc.T8). |
| 4.15 | Controls and threats associated to key actions: RemoveAccountFromOrganization (Organizations.C11; Organizations.T5), AttachPolicy (Organizations.C5, Organizations.C49; Organizations.T1 and Organizations.T16), InviteAccountToOrganization (Organizations.C12; Organizations.T2), UpdatePolicy (Organizations.C62; Organizations.T8 and Organizations.T16). | |
| 4.16 | Securityhub.C53 under CO15 |
Section 5 — Networking
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
| 5.1.1 | Ec2.C205 assured by Ec2.C206 under CO27 | The CIS control only asks for default encryption to be enabled (CO27), but we go further: Ec2.C33 assured by Ec2.C34 and Ec2.C35 ensures encryption by authorised keys; Ec2.C36 and Ec2.C37 prevent unencrypted volumes. |
| 5.2 | Vpc.C61 under CO9 | |
| 5.5 | Vpc.C132 assured by Vpc.C133 under CO24 | |
| 5.6 | Vpc.C51 assured by Vpc.C52 under CO11 | |
| 5.7 | Ec2.C23 assured by Ec2.C24 and Ec2.C25 under CO6 | CO6 contains multiple controls to ensure IMDSv2 — including Ec2.C21 (disabled if no instance profile), Ec2.C27 (preventative enforcement of authorised values), and Ec2.C302 (AMIs also using v2). |
Conclusion
The CIS AWS Foundations Benchmark is a helpful baseline, but it doesn't reflect the complexity of real-world threat models. TrustOnCloud helps you go further by tailoring controls to your risk appetite, workloads, and business needs.
If you're already a customer, we hope this mapping is useful for your next audit or recertification cycle.
If not, book a 20-minute call and we'll walk you through how our controls align and how we help you go beyond checklist compliance. You may also want to explore our live ControlCatalog.
See how this maps to your controls
Walk through the CIS mapping with a TrustOnCloud researcher and understand where you already have coverage and where the gaps are.