How to Enable and Pass the CIS AWS Foundations Standard in AWS Security Hub

What Security Hub's CIS standard is (and is not)

Security Hub aggregates findings from AWS Config and other providers, then scores them against enabled standards such as CIS AWS Foundations. Enabling the standard turns on the relevant Config rules / controls in that standard pack for the account (and, in multi-account setups, for members under a Security Hub administrator).

• Is: Continuous configuration posture checks mapped to CIS AWS Foundations themes (identity, logging, networking, storage, and related baseline settings).
• Is not: A CIS certification, a QSA letter, or proof that every AWS service you use is hardened — Foundations is account/baseline focused; service-specific CIS Benchmarks (EKS, Amazon Linux, etc.) are separate.

How to enable the CIS AWS Foundations standard

1. Prerequisites: Security Hub enabled in the Regions you care about; AWS Config recording the resource types those controls need; appropriate IAM permissions for Security Hub admins.
2. Console path (typical): Security Hub — Standards — locate CIS AWS Foundations Benchmark — Enable. Prefer enabling from the delegated administrator account when using AWS Organizations.
3. CLI / IaC: Codify enablement with CloudFormation, Terraform, or the Security Hub APIs so Region and OU coverage does not drift from tribal knowledge.
4. Multi-account: Use Security Hub central configuration / administrator patterns so members inherit standards instead of each team flipping switches inconsistently.

Document the standard version label Security Hub shows after enablement next to your CIS PDF edition in the GRC library.

Reading findings without false confidence

Each control surfaces as PASSED, FAILED, or (when allowed) NOT_AVAILABLE / suppressed. Failed findings usually point at a Config rule evaluation or related check — open the finding for the resource ARN, first observed time, and remediation guidance AWS ships with that control.

• Separate account-wide misses (e.g., logging not enabled as required) from resource-local misses (one open security group).
• Expect transient fails during change windows; require re-evaluation after remediation before closing tickets.
• Avoid custom "pass percentages" for sales decks — export native Security Hub / Config evidence instead.

Control themes you will see (not an ID dump)

Exact control IDs and counts change with standard revisions. Programme planning usually organises work by theme:

• Identity and access: Root and privileged MFA, credential hygiene, least-privilege IAM patterns, access key lifecycle.
• Logging and monitoring: CloudTrail (multi-Region / organisation trail patterns), Config, VPC flow logs, CloudWatch alarms on critical API activity where the standard requires them.
• Networking: Restrictive default SG/NACL posture, limited public exposure, VPC design expectations called out by the benchmark.
• Storage and encryption: Default encryption and public-access guards for services the Foundations pack covers (e.g., S3-related checks in current editions).

For the authoritative checklist, open the CIS workbook section that matches your claimed profile (commonly Level 1 for broad compatibility; Level 2 only when operations can absorb the impact).

A practical "get to pass" operating model

1. Baseline inventory: List accounts, Regions, and OU structure in scope for the standard.
2. Fix platform gaps first: Organisation CloudTrail, Config recorders, and Security Hub admin wiring unlock dozens of dependent checks.
3. Batch by theme: IAM and logging usually unblock more findings than one-off resource tweaks.
4. Suppress with discipline: Use Security Hub suppression only with ticket ID, owner, expiry, and compensating control — permanent silent fails become audit debt.
5. Automate remediation where safe: Config remediation, SCP/IAM guardrails, and Infrastructure-as-Code defaults prevent reintroduction.
6. Re-scan and export: After changes, wait for Config/Security Hub re-evaluation; archive dated exports with the CIS PDF version string.

Evidence auditors and customers actually sample

• Screenshot or API export of enabled standards and version
• Finding summaries filtered to FAILED with ageing
• Change tickets linked to remediations
• Suppression / exception register
• Crosswalk note: Security Hub standard version ↔ CIS Benchmark edition

Map those artefacts into CyberSilo CSA so multi-framework programmes reuse the same evidence objects. Pipe critical configuration-change signals into ThreatHawk SIEM when drift matters more than the next monthly scorecard.

Limits and honest expectations

Green CIS Foundations in Security Hub does not mean every workload is CIS-hardened, does not replace penetration testing, and does not equal PCI, FedRAMP, or ISO certification. Treat it as a strong account hygiene programme with automated regression detection.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is enabling the Security Hub CIS standard the same as buying CIS SecureSuite?

No. Security Hub provides AWS-operated checks aligned to CIS AWS Foundations themes. Official CIS PDFs, workbooks, and SecureSuite tooling remain separate products and licences — verify current offerings on CIS and AWS documentation.

Level 1 or Level 2 in Security Hub?

Match the profile your organisation formally adopted. Level 1 is typically the broader compatibility baseline; Level 2 adds stronger settings with more operational impact. Confirm which profile the enabled Security Hub standard implements for your version.

Does a 100% pass mean we are CIS certified?

No. CIS Benchmarks are consensus configuration guides. Passing automated checks supports evidence; it is not a CIS-issued certificate.

Multi-Region — must every Region pass?

Scope deliberately. Enable Security Hub and Config where you run workloads or hold identity/logging control planes, and document explicit exclusions with risk acceptance.

Related Resources

• CIS Benchmarking Tool
• CIS Benchmark for AWS Foundations
• CIS Level 1 vs Level 2
• CIS Cloud Benchmarks Compared
• Compliance Standards Automation
• ThreatHawk SIEM