Home/Resources/Maturity assessments/AWS cloud security assessment

● INDEPENDENT AWS SECURITY ASSESSMENT

Assess Your Organization's AWS Cloud Security

Use one organization, project, or AWS environment as the scope for each assessment. Select criteria you can currently verify through policies, configurations, logs, and operating records to see the completed phase and prerequisites across ten capabilities.

The result is not an official AWS assessment, certification, or security audit opinion. Exclude planned work and select only repeatably verifiable operating evidence to decide what to improve next.

Published: Jul 19, 2026
Version: 1.0.0
Publisher: 801 PLANET
Technical review: Jeen Lee
Public sources: 2

Security criteria verified0 of 40 criteria verified

We use the operational evidence you select to calculate the completed phase across ten AWS security capabilities and the first priorities for the next 90 days. The response is saved when results are shown; the email report is optional.

Select only practices you can repeatedly verify through current AWS policies, configurations, logs, and operating records. A capability advances only after every criterion in all earlier phases is verified.

01Security capabilitySecurity governanceThe ability to manage security accountability, standards, exceptions, and their connection to business risk.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Every production account has a security owner and shared escalation channel whose validity was checked within the last 90 days.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Business, contractual, and regulatory obligations are maintained as security requirements linked to owners and in-scope systems.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Approved cloud security standards are delivered through code or templates, and every exception records an owner and expiry date.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Security accountability and risk metrics are reviewed with business and product metrics to adjust control investment priorities.

02Security capabilitySecurity assuranceThe ability to verify with evidence that controls are deployed and operating effectively.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

All production accounts are covered by a common posture review, and critical findings receive an owner and due date.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Security-relevant assets and configuration changes are continuously recorded with who, when, and what changed.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Evidence for key controls is regenerated on a defined cadence, with failures, exceptions, and remediation tracked together.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Key control evidence is collected automatically, and deviations trigger tracked work and automatic revalidation.

03Security capabilityIdentity and access managementThe ability to limit human and workload access to the necessary scope and duration.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

All privileged users and emergency accounts use strong multi-factor authentication, and top-level accounts are not used for daily work.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Production workloads use temporary credentials by default, while every long-lived key has an owner, purpose, and expiry or rotation deadline.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Human, workload, and customer access is reviewed against usage and job roles, with unnecessary permissions removed.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

High-risk privileges are issued only for an approved time window, and requests deploy only after data-boundary and policy validation.

04Security capabilityThreat detectionThe ability to identify suspicious activity across accounts, workloads, and networks and turn it into investigable signals.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Administrative activity from production accounts is centrally retained, and material threat or spend anomalies reach an active response channel.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Each material detection has an owner, severity, response objective, and exception path, with false positives and unattended alerts reviewed regularly.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Multiple security signals are correlated centrally, while organization-specific attack scenarios are managed as tested detection rules.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

External threat intelligence, internal network flows, and incident lessons continuously influence detection priorities and rule improvements.

05Security capabilityVulnerability managementThe ability to discover infrastructure and software vulnerabilities and reduce them in time according to business risk.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Internet-exposed assets and critical vulnerabilities are inventoried with an owner, severity, and remediation deadline.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Supported infrastructure and applications are covered by recurring vulnerability review and tracked against risk-based remediation objectives.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

High-risk vulnerability checks are embedded in build and release workflows, with team security owners reviewing exceptions and recurrence prevention.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Dedicated ownership continuously reprioritizes remediation using exploitability, asset value, and exposure paths, with outcomes measured.

06Security capabilityInfrastructure protectionThe ability to reduce network, compute, and account exposure while providing safe operational paths.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Internet-exposed administration ports and remote-management endpoints are inventoried, with no unapproved exposure.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Accounts and networks are separated by environment and business criticality, and operational access uses only audited management paths.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Compute images are built and verified through an approved pipeline, with runtime threats and anomalous outbound traffic monitored.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

User, device, and workload context is verified for each access request, while operational risk is reduced through managed abstractions where appropriate.

07Security capabilityData protectionThe ability to understand data sensitivity, location, and flow and prevent exposure or loss.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Important data stores are private by default, and any public exception has approval, an owner, and an expiry date.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Important data has known sensitivity and ownership, encryption at rest, recoverable backups, and recorded restore tests.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Important data flows are protected in transit, with retention, deletion, and access policies applied automatically by classification.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Data-use paths, including generative AI, validate input, output, and training-data boundaries and repeat sensitive-data leakage tests.

08Security capabilityApplication securityThe ability to reduce application risk throughout design, development, delivery, and operation.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Internet-facing applications use a managed web-attack baseline, with detection and blocking results reviewed by an owner.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Security participates in design and change review for important applications, and long-lived secrets are not stored in code or configuration.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Threat models for important features evolve with changes and directly inform custom defenses, DDoS response, and security tests.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Independent adversarial validation runs regularly, and findings feed design standards, detections, and engineering backlogs.

09Security capabilityIncident responseThe ability to classify, contain, and recover from security events and turn lessons into control improvements.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Critical security findings are acknowledged within a defined time, with containment, mitigation, and closure evidence recorded.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Response procedures for major incident types define technical, legal, executive, and customer-communication roles and contact paths.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Recurring exercises validate playbooks, repeatable actions are automated, and post-incident causes and recurrence prevention are tracked.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Detection, investigation, approval, containment, and configuration recovery operate as an integrated workflow improved through outcome metrics.

10Security capabilityResiliencyThe ability to sustain critical services through failures and attacks and recover within objectives.Current completed phasePhase 0 · Not established

Phase 0 → 1Criteria for reaching Phase 1 · Quick Wins

Critical services have business-approved recovery-time and data-loss objectives, with major single points of failure and current mitigations known.

Phase 1 → 2Criteria for reaching Phase 2 · Foundational

Critical production services are designed to tolerate a single availability-zone failure, with failover and data restoration tested.

Phase 2 → 3Criteria for reaching Phase 3 · Efficient

Service disaster-recovery plans include dependencies, priorities, and decision authority, and are validated through recurring exercises.

Phase 3 → 4Criteria for reaching Phase 4 · Optimized

Multi-region recovery procedures are automated, and controlled failure experiments continuously validate assumptions, alerts, and automatic recovery.

0 of 40 criteria verified

References and use notice

The assessment criteria reference the official public materials for AWS Security Maturity Model v2. This is an independent, unofficial 801 PLANET self-assessment informed by the public structure and guidance of AWS Security Maturity Model v2. It is not an AWS translation, document, certification, or endorsement and does not replace a security audit or compliance determination.

AWS Security Maturity Model v2 ↗AWS official assessment-tools page ↗