aws_compliance

AWS Compliance

AWS Security Hub helps to monitor unauthorized personnel, connections, devices, and software. AWS Security Hub aggregates, organizes, and prioritizes the security alerts, or findings, from multiple AWS services.

securityhub_enabled

cisa_cyber_essentials_your_crisis_response_2

Your Crisis Response-2

cisa_cyber_essentials_your_systems_3

Your Systems-3

fedramp_low_rev_4_ac_17

Remote Access (AC-17)

fedramp_low_rev_4_ac_2

Account Management (AC-2)

fedramp_low_rev_4_ca_7

Continuous Monitoring (CA-7)

fedramp_low_rev_4_ir_4

Incident Handling (IR-4)

fedramp_moderate_rev_4_ac_17_1

AC-17(1) Automated Monitoring/Control

fedramp_moderate_rev_4_ac_2_1

AC-2(1) Automated System Account Management

fedramp_moderate_rev_4_ac_2_12_a

AC-2(12)(a)

fedramp_moderate_rev_4_ac_2_4

AC-2(4) Automated Audit Actions

fedramp_moderate_rev_4_ac_2_g

AC-2(g)

fedramp_moderate_rev_4_au_6_1_3

AU-6(1)(3)

fedramp_moderate_rev_4_ca_7_a_b

CA-7(a)(b)

fedramp_moderate_rev_4_ir_4_1

IR-4(1) Automated Incident Handling Processes

fedramp_moderate_rev_4_ir_6_1

IR-6(1) Automated Reporting

fedramp_moderate_rev_4_ir_7_1

IR-7(1) Automation Support For Availability Of Information / Support

fedramp_moderate_rev_4_sa_10

Developer Configuration Management (SA-10)

fedramp_moderate_rev_4_si_4_16

SI-4(16) Correlate Monitoring Information

fedramp_moderate_rev_4_si_4_2

SI-4(2) Automated Tools For Real-Time Analysis

fedramp_moderate_rev_4_si_4_4

SI-4(4) Inbound and Outbound Communications Traffic

fedramp_moderate_rev_4_si_4_5

SI-4(5) System-Generated Alerts

fedramp_moderate_rev_4_si_4_a_b_c

SI-4(a)(b)(c)

ffiec_d_2_is_is_b_1

D2.IS.Is.B.1

ffiec_d_2_ti_ti_b_1

D2.TI.Ti.B.1

ffiec_d_2_ti_ti_b_2

D2.TI.Ti.B.2

ffiec_d_2_ti_ti_b_3

D2.TI.Ti.B.3

ffiec_d_3_dc_an_b_1

D3.DC.An.B.1

ffiec_d_3_dc_an_b_2

D3.DC.An.B.2

ffiec_d_3_dc_ev_b_3

D3.DC.Ev.B.3

ffiec_d_3_dc_th_b_1

D3.DC.Th.B.1

ffiec_d_5_dr_de_b_1

D5.DR.De.B.1

ffiec_d_5_dr_de_b_3

D5.DR.De.B.3

gxp_21_cfr_part_11_11_300_d

11.300(d)

gxp_eu_annex_11_general_1

1 Risk Management

hipaa_164_308_a_1_ii_d

164.308(a)(1)(ii)(D) Information system activity review

hipaa_164_308_a_3_ii_a

164.308(a)(3)(ii)(A) Authorization and/or supervision

hipaa_164_308_a_5_ii_c

164.308(a)(5)(ii)(C) Log-in monitoring

hipaa_164_308_a_6_i

164.308(a)(6)(i) Security incident procedures

hipaa_164_308_a_6_ii

164.308(a)(6)(ii) Response and reporting

hipaa_164_308_a_8

164.308(a)(8) Evaluation

hipaa_164_312_b

164.312(b) Audit controls

hipaa_164_312_e_2_i

164.312(e)(2)(i) Integrity controls

nist_800_171_rev_2_3_11_2

3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified

nist_800_171_rev_2_3_11_3

3.11.3 Remediate vulnerabilities in accordance with risk assessments

nist_800_171_rev_2_3_12_4

3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems

nist_800_171_rev_2_3_13_1

3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems

nist_800_171_rev_2_3_14_1

3.14.1 Identify, report, and correct system flaws in a timely manner

nist_800_171_rev_2_3_14_2

3.14.2 Provide protection from malicious code at designated locations within organizational systems

nist_800_171_rev_2_3_14_3

3.14.3 Monitor system security alerts and advisories and take action in response

nist_800_171_rev_2_3_14_6

3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks

nist_800_171_rev_2_3_14_7

3.14.7 Identify unauthorized use of organizational systems

nist_800_171_rev_2_3_1_12

3.1.12 Monitor and control remote access sessions

nist_800_171_rev_2_3_3_1

3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity

nist_800_171_rev_2_3_3_4

3.3.4 Alert in the event of an audit logging process failure

nist_800_171_rev_2_3_3_5

3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity

nist_800_171_rev_2_3_6_1

3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities

nist_800_171_rev_2_3_6_2

3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization

nist_800_53_rev_4_ac_17_1

nist_800_53_rev_4_ac_2

nist_800_53_rev_4_ac_2_1

nist_800_53_rev_4_ac_2_12

AC-2(12) Account Monitoring

nist_800_53_rev_4_ac_2_4

nist_800_53_rev_4_au_6_1

AU-6(1) Process Integration

nist_800_53_rev_4_au_6_3

AU-6(3) Correlate Audit Repositories

nist_800_53_rev_4_ca_7

nist_800_53_rev_4_sa_10

nist_800_53_rev_4_si_4

Information System Monitoring (SI-4)

nist_800_53_rev_4_si_4_16

nist_800_53_rev_4_si_4_2

nist_800_53_rev_4_si_4_4

nist_800_53_rev_4_si_4_5

nist_800_53_rev_5_au_12_3

AU-12(3) Changes By Authorized Individuals

nist_800_53_rev_5_au_14_a

AU-14(a)

nist_800_53_rev_5_au_14_b

AU-14(b)

nist_800_53_rev_5_au_6_1

AU-6(1) Automated Process Integration

nist_800_53_rev_5_au_6_5

AU-6(5) Central Review And Analysis

nist_800_53_rev_5_ca_2_d

CA-2(d)

nist_800_53_rev_5_ca_7

nist_800_53_rev_5_ca_7_b

CA-7(b)

nist_800_53_rev_5_pm_14_a_1

PM-14(a)(1)

nist_800_53_rev_5_pm_14_b

PM-14(b)

nist_800_53_rev_5_pm_31

Continuous Monitoring Strategy (PM-31)

nist_csf_de_ae_2

DE.AE-2

nist_csf_de_ae_4

DE.AE-4

nist_csf_de_cm_1

DE.CM-1

nist_csf_de_cm_2

DE.CM-2

nist_csf_de_cm_3

DE.CM-3

nist_csf_de_cm_4

DE.CM-4

nist_csf_de_cm_5

DE.CM-5

nist_csf_de_cm_6

DE.CM-6

nist_csf_de_cm_7

DE.CM-7

nist_csf_de_dp_4

DE.DP-4

nist_csf_id_ra_1

ID.RA-1

nist_csf_id_ra_2

ID.RA-2

nist_csf_id_ra_3

ID.RA-3

nist_csf_id_ra_5

ID.RA-5

nist_csf_id_sc_4

ID.SC-4

nist_csf_pr_ds_5

PR.DS-5

nist_csf_pr_ds_8

PR.DS-8

rbi_cyber_security_annex_i_7_4

Annex I (7.4)

AWS Security Hub should be enabled for an AWS Account

Run individual configuration, compliance and security controls or full compliance benchmarks for CIS, FFIEC, PCI, NIST, HIPAA, RBI CSF, GDPR, SOC 2, Audit Manager Control Tower, FedRAMP, GxP and AWS Foundational Security Best Practices controls across all your AWS accounts using Steampipe.

Apache License 2.0

steampipe-mod-aws-compliance

turbot/aws_compliance

Control: AWS Security Hub should be enabled for an AWS Account

Description

Usage

SQL

Tags

Steampipe

Resources

Community