Skip to content

Infrastructure as Code (IaC)

What is Infrastructure as Code (IaC)?

The practice of managing and provisioning infrastructure through machine-readable configuration files rather than manual processes. IaC enables consistent, repeatable, and auditable infrastructure deployments.

Cloud

Terms that appear alongside infrastructure as code (iac)

Each of these is named in at least one of the same controls as infrastructure as code (iac). The number is how many controls name both.

Frameworks that govern infrastructure as code (iac)

CSA CCM v4View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on infrastructure as code (iac)

Requirements naming infrastructure as code (iac) across 6 standards, quoted from the control text.

ISMAP (Japan)1 control

ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...

ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →
ITU-T X.805 - Security Architecture for End-to-End Communications1 control

Security Layer 1 Infrastructure per X.805 Clause 7.1: The Infrastructure Security Layer consists of network facilities (transmission facilities and network elements) protected by the security measures.

X805-Layer1-Infrastructure-Security-Transmission-Facilities-Network-Elements-Lines-Routers-Switches · ITU-T X.805 Security Layer 1 - Infrastructure Security + Transmission Facilities + Network Elements + Routers + Switches + Lines + Physical + Datacenter + Optical + Radio Access + Wireless + Wireline + Edge →
Kuwait National Cybersecurity Framework1 control

Kuwait NCF Protect function (Infrastructure). Network Security and Segmentation: defense in depth + perimeter (firewall + WAF + DDoS mitigation) + internal segmentation (microsegmentation + VLAN + zero-trust network access ZTNA) + east-west traffic inspection...

KNCF-Protect-Network-Configuration-Vulnerability-Physical-Secure-SDLC-Hardening-Patching-Drift · Kuwait NCF Protect + Network + Configuration + Vulnerability + Physical + Secure SDLC →
Lloyd's Minimum Standards - Cyber Security1 control

Lloyds MS11.6 Secure Configuration and Change Management - configuration baselines aligned with industry benchmarks (CIS Critical Security Controls v8 + CIS Benchmarks for Windows + Linux + cloud + container + DISA STIGs where applicable) + Infrastructure-as-C...

LLOYDS-MS11-Secure-Configuration-Change-Management-Network-Segmentation-Perimeter-Defence-MS11-6-15 · Lloyds MS11 Secure Configuration + Change + Network Segmentation + Perimeter + MS11.6-15 →
MTCS (Singapore)1 control

Implement Acquisition Development Maintenance + Supplier Relationships + Vulnerability Management per MTCS SS 584. Acquisition Development and Maintenance (ISO 27001 Annex A.14) - secure coding standards (OWASP Top 10 + OWASP ASVS + CWE Top 25 + CERT Secure Co...

MTCS-Acquisition-Development-Maintenance-Supplier-Vulnerability-DevSecOps-SBOM-SDLC-SCA-API-Container · MTCS Acquisition + Development + Maintenance + Supplier + Vulnerability + DevSecOps + SBOM + SDLC + SCA →
Monetary Authority of Singapore Technology Risk Management Guidelines1 control

Implement IT Project Management + Software Development Lifecycle + IT Service Management per MAS TRM Chapters 4 + 5 + 6. Chapter 4 IT Project Management - project initiation approval + business case + risk assessment + technology security review + steering com...

MAS-TRM-Project-SDLC-Service-Management-Chapters-4-5-6-IT-Project-Software-Lifecycle-Change-ITIL · MAS TRM Project + SDLC + Service Management + Chapters 4-6 + IT Project + Software Lifecycle + ITIL →

Questions people ask about infrastructure as code (iac)

What is Infrastructure as Code (IaC)?
The practice of managing and provisioning infrastructure through machine-readable configuration files rather than manual processes. IaC enables consistent, repeatable, and auditable infrastructure deployments.
Why is Infrastructure as Code (IaC) important for compliance?
Infrastructure as Code (IaC) is a key concept in Cloud. Understanding infrastructure as code (iac) helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Infrastructure as Code (IaC)?
Infrastructure as Code (IaC) appears in the requirement text of ISMAP (Japan), ITU-T X.805 - Security Architecture for End-to-End Communications, Kuwait National Cybersecurity Framework, Lloyd's Minimum Standards - Cyber Security, MTCS (Singapore). Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Infrastructure as Code (IaC)?
Explore our compliance framework pages to see how infrastructure as code (iac) applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Infrastructure as Code (IaC) applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.