AWS securityhub: Add CRI Profile v2.2 mappings to Amazon EFS Security Hub controls

Service: securityhub · 2026-10-15 · Documentation low

File: securityhub/latest/userguide/efs-controls.md

Summary

Appends CRI Profile v2.2 requirement identifiers (e.g., PR.DS-01.01, PR.PS-01.06, PR.AA-03.02, PR.DS-11.01) to the 'Related requirements' lists of multiple Amazon EFS Security Hub CSPM controls, and adds a new Related requirements line to the mount target/subnet control. No control logic, remediation steps, or AWS configuration guidance changed.

Security assessment

The only change is the addition of compliance-framework cross-references (CRI Profile v2.2) to existing control metadata. It does not describe a vulnerability, fix, or new security capability, so it is a documentation/compliance-mapping update with no direct security impact.

Evidence

+**Related requirements:** CRI Profile v2.2/PR.DS-11.01

Diff

diff --git a/securityhub/latest/userguide/efs-controls.md b/securityhub/latest/userguide/efs-controls.md
index f44fe76..94b6e82 100644
--- a//securityhub/latest/userguide/efs-controls.md
+++ b//securityhub/latest/userguide/efs-controls.md
@@ -15 +15 @@ These Security Hub CSPM controls evaluate the Amazon Elastic File System (Amazon
-**Related requirements:** CIS AWS Foundations Benchmark v5.0.0/2.3.1, CIS AWS Foundations Benchmark v3.0.0/2.4.1, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
+**Related requirements:** CIS AWS Foundations Benchmark v5.0.0/2.3.1, CIS AWS Foundations Benchmark v3.0.0/2.4.1, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6), CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.06
@@ -48 +48 @@ For details on how to encrypt a new Amazon EFS file system, see [Encrypting data
-**Related requirements:** NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5)
+**Related requirements:** NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5), CRI Profile v2.2/PR.DS-11.01
@@ -72 +72 @@ To enable automatic backups for an existing Amazon EFS file system, see [Getting
-**Related requirements:** NIST.800-53.r5 AC-6(10)
+**Related requirements:** NIST.800-53.r5 AC-6(10), CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.IR-01.05, CRI Profile v2.2/PR.PS-01.01, CRI Profile v2.2/PR.PS-01.02, CRI Profile v2.2/PR.PS-01.03
@@ -96 +96 @@ For instructions on how to enforce a root directory for an Amazon EFS access poi
-**Related requirements:** NIST.800-53.r5 AC-6(2), PCI DSS v4.0.1/7.3.1
+**Related requirements:** NIST.800-53.r5 AC-6(2), PCI DSS v4.0.1/7.3.1, CRI Profile v2.2/PR.AA-01.01, CRI Profile v2.2/PR.AA-01.02, CRI Profile v2.2/PR.AA-03.02, CRI Profile v2.2/PR.AA-05.01, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.DS-10.01
@@ -150 +150 @@ To add tags to an EFS access point, see [Tagging Amazon EFS resources](https://d
-**Related requirements:** NIST.800-53.r5 SC-7, NIST.800-171.r2 3.1.20, PCI DSS v4.0.1/1.4.4
+**Related requirements:** NIST.800-53.r5 SC-7, NIST.800-171.r2 3.1.20, PCI DSS v4.0.1/1.4.4, CRI Profile v2.2/PR.AA-03.02, CRI Profile v2.2/PR.IR-01.01, CRI Profile v2.2/PR.PS-01.01
@@ -181,0 +182,2 @@ To associate an existing mount target with a different subnet, you must create a
+**Related requirements:** CRI Profile v2.2/PR.DS-11.01
+
@@ -204 +206 @@ For information about using AWS Backup for EFS file systems, see [Backing up EFS
-**Related requirements:** CIS AWS Foundations Benchmark v5.0.0/2.3.1
+**Related requirements:** CIS AWS Foundations Benchmark v5.0.0/2.3.1, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.06, CRI Profile v2.2/PR.PS-01.07