AWS securityhub: Add CRI Profile v2.2 requirement mappings to CodeBuild controls

Service: securityhub · 2026-10-15 · Documentation low

File: securityhub/latest/userguide/codebuild-controls.md · Type: encryption

Summary

Adds CRI Profile v2.2 requirement references (e.g., PR.AA-04.01, PR.DS-02.01, PR.AA-01.01, PR.DS-01.01, PR.PS-01.06, PR.PS-04.02, PR.IR-04.01) to the 'Related requirements' lines for several AWS CodeBuild Security Hub CSPM controls, and adds one new requirements line for the log-configuration control. No control behavior or guidance text is changed.

Security assessment

The change only extends the compliance-framework crosswalk for existing CodeBuild controls (including encryption-at-rest SC-13/SC-28 and logging/AU mappings) by citing additional CRI Profile v2.2 requirements; it introduces no new control logic, fixes no weakness and describes no new security feature.

Evidence

+**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6), PCI DSS v4.0.1/10.3.2, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.06, CRI Profile v2.2/PR.PS-04.03

Diff

diff --git a/securityhub/latest/userguide/codebuild-controls.md b/securityhub/latest/userguide/codebuild-controls.md
index bbd890a..84336d1 100644
--- a//securityhub/latest/userguide/codebuild-controls.md
+++ b//securityhub/latest/userguide/codebuild-controls.md
@@ -17 +17 @@ These controls may not be available in all AWS Regions. For more information, se
-**Related requirements:** NIST.800-53.r5 SA-3, PCI DSS v3.2.1/8.2.1, PCI DSS v4.0.1/8.3.2
+**Related requirements:** NIST.800-53.r5 SA-3, PCI DSS v3.2.1/8.2.1, PCI DSS v4.0.1/8.3.2, CRI Profile v2.2/PR.AA-04.01, CRI Profile v2.2/PR.DS-02.01
@@ -68 +68 @@ For more information, refer to [CodeBuild use case-based samples](https://docs.a
-**Related requirements:** NIST.800-53.r5 IA-5(7), NIST.800-53.r5 SA-3, PCI DSS v3.2.1/8.2.1, PCI DSS v4.0.1/8.3.2
+**Related requirements:** NIST.800-53.r5 IA-5(7), NIST.800-53.r5 SA-3, PCI DSS v3.2.1/8.2.1, PCI DSS v4.0.1/8.3.2, CRI Profile v2.2/PR.AA-01.01, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-06.04
@@ -94 +94 @@ You can store environment variables with sensitive values in the AWS Systems Man
-**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6), PCI DSS v4.0.1/10.3.2
+**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6), PCI DSS v4.0.1/10.3.2, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.06, CRI Profile v2.2/PR.PS-04.03
@@ -118 +118 @@ To change the encryption settings for CodeBuild project S3 logs, see [Change a b
-**Related requirements:** NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-9(7), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8)
+**Related requirements:** NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-9(7), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8), CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/PR.IR-04.01, CRI Profile v2.2/PR.PS-04.02
@@ -141,0 +142,2 @@ For more information on how to configure CodeBuild project log settings, see [Cr
+**Related requirements:** CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.06
+