AWS securityhub: Add CRI Profile v2.2 mappings to ECR Security Hub controls

Service: securityhub · 2026-10-15 · Documentation low

File: securityhub/latest/userguide/ecr-controls.md

Summary

Appends CRI Profile v2.2 requirement identifiers (e.g., ID.RA-01.03, PR.PS-02.01, DE.CM-09.03, ID.AM-02.01, PR.IR-04.02) to the 'Related requirements' lines of three ECR Security Hub CSPM controls (image scanning, image tag immutability, and related configuration controls). No control logic, remediation steps, or AWS behavior is changed.

Security assessment

The only change is the addition of CRI Profile v2.2 compliance-framework identifiers to existing 'Related requirements' metadata lines. This is compliance-mapping bookkeeping for controls that already existed; it introduces no new security guidance, no vulnerability fix, and no change to detection or remediation behavior.

Evidence

+**Related requirements:** NIST.800-53.r5 RA-5, PCI DSS v4.0.1/6.2.3, PCI DSS v4.0.1/6.2.4, CRI Profile v2.2/ID.RA-01.03, CRI Profile v2.2/PR.PS-02.01, CRI Profile v2.2/PR.PS-02.02

Diff

diff --git a/securityhub/latest/userguide/ecr-controls.md b/securityhub/latest/userguide/ecr-controls.md
index c10f7b9..3ee3cb3 100644
--- a//securityhub/latest/userguide/ecr-controls.md
+++ b//securityhub/latest/userguide/ecr-controls.md
@@ -17 +17 @@ These controls may not be available in all AWS Regions. For more information, se
-**Related requirements:** NIST.800-53.r5 RA-5, PCI DSS v4.0.1/6.2.3, PCI DSS v4.0.1/6.2.4
+**Related requirements:** NIST.800-53.r5 RA-5, PCI DSS v4.0.1/6.2.3, PCI DSS v4.0.1/6.2.4, CRI Profile v2.2/ID.RA-01.03, CRI Profile v2.2/PR.PS-02.01, CRI Profile v2.2/PR.PS-02.02
@@ -41 +41 @@ To configure image scanning for an ECR repository, see [Image scanning](https://
-**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-8(1)
+**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-8(1), CRI Profile v2.2/DE.CM-09.03, CRI Profile v2.2/ID.AM-02.01, CRI Profile v2.2/PR.PS-01.01
@@ -65 +65 @@ To create a repository with immutable tags configured or to update the image tag
-**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2)
+**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), CRI Profile v2.2/ID.AM-08.01, CRI Profile v2.2/PR.IR-04.02, CRI Profile v2.2/PR.PS-01.01, CRI Profile v2.2/PR.PS-01.03