AWS securityhub: Add CRI Profile v2.2 mappings to DocumentDB Security Hub controls

Service: securityhub · 2026-10-15 · Documentation low

File: securityhub/latest/userguide/documentdb-controls.md

Summary

Appends CRI Profile v2.2 compliance framework requirement IDs to the 'Related requirements' lines of multiple Amazon DocumentDB Security Hub CSPM controls (encryption at rest, backup retention, public snapshot access, audit logging, deletion protection), and adds a new Related requirements line for the deletion protection control.

Security assessment

The only added content is a compliance-framework cross-reference (CRI Profile v2.2) for existing DocumentDB security controls; no control logic, guidance, or vulnerability remediation is introduced, so it is metadata-only and low severity.

Evidence

+**Related requirements:** CRI Profile v2.2/PR.DS-02.01, CRI Profile v2.2/PR.PS-01.06

Diff

diff --git a/securityhub/latest/userguide/documentdb-controls.md b/securityhub/latest/userguide/documentdb-controls.md
index 97db796..f1efa44 100644
--- a//securityhub/latest/userguide/documentdb-controls.md
+++ b//securityhub/latest/userguide/documentdb-controls.md
@@ -15 +15 @@ These AWS Security Hub CSPM controls evaluate the Amazon DocumentDB (with MongoD
-**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
+**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6), CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.06
@@ -39 +39 @@ You can enable encryption at rest when you create an Amazon DocumentDB cluster.
-**Related requirements:** NIST.800-53.r5 SI-12, PCI DSS v4.0.1/3.2.1
+**Related requirements:** NIST.800-53.r5 SI-12, PCI DSS v4.0.1/3.2.1, CRI Profile v2.2/PR.DS-11.01
@@ -67 +67 @@ To change the backup retention period for your Amazon DocumentDB clusters, see [
-**Related requirements:** NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9), PCI DSS v4.0.1/1.4.4
+**Related requirements:** NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9), PCI DSS v4.0.1/1.4.4, CRI Profile v2.2/PR.AA-05.01, CRI Profile v2.2/PR.DS-01.01
@@ -95 +95 @@ To remove public access for Amazon DocumentDB manual cluster snapshots, see [Sha
-**Related requirements:** NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8), PCI DSS v4.0.1/10.3.3
+**Related requirements:** NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8), PCI DSS v4.0.1/10.3.3, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/PR.PS-04.01, CRI Profile v2.2/PR.PS-04.02, CRI Profile v2.2/PR.PS-04.03
@@ -119 +119 @@ To publish Amazon DocumentDB audit logs to CloudWatch Logs, see [Enabling auditi
-**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2)
+**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2), CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.IR-03.01, CRI Profile v2.2/PR.PS-01.01, CRI Profile v2.2/PR.PS-01.03
@@ -142,0 +143,2 @@ To enable deletion protection for an existing Amazon DocumentDB cluster, see [Mo
+**Related requirements:** CRI Profile v2.2/PR.DS-02.01, CRI Profile v2.2/PR.PS-01.06
+