AWS securityhub: Add CRI Profile v2.2 compliance mappings to GuardDuty controls

Service: securityhub · 2026-10-15 · Documentation low

File: securityhub/latest/userguide/guardduty-controls.md

Summary

Adds CRI Profile v2.2 'Related requirements' mappings to multiple GuardDuty Security Hub CSPM control sections (detector tagging, EKS audit log, Lambda, runtime monitoring, malware, RDS, S3 protection, etc.), and appends CRI Profile entries to existing NIST/PCI requirement lists.

Security assessment

The diff only appends compliance-framework identifiers (CRI Profile v2.2 control IDs) to 'Related requirements' lines for existing GuardDuty controls. No vulnerability, misconfiguration, credential, encryption, or authz behavior is described or fixed; it is purely a compliance-mapping metadata update.

Evidence

+**Related requirements:** CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.02, CRI Profile v2.2/DE.CM-03.01, CRI Profile v2.2/DE.CM-03.02, CRI Profile v2.2/DE.CM-03.03, CRI Profile v2.2/PR.PS-04.02, CRI Profile v2.2/PR.PS-04.03, CRI Profile v2.2/RS.AN-07.01

Diff

diff --git a/securityhub/latest/userguide/guardduty-controls.md b/securityhub/latest/userguide/guardduty-controls.md
index 727b6bc..893856e 100644
--- a//securityhub/latest/userguide/guardduty-controls.md
+++ b//securityhub/latest/userguide/guardduty-controls.md
@@ -15 +15 @@ These AWS Security Hub CSPM controls evaluate the Amazon GuardDuty service and r
-**Related requirements:** NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 CA-7, NIST.800-53.r5 CM-8(3), NIST.800-53.r5 RA-3(4), NIST.800-53.r5 SA-11(1), NIST.800-53.r5 SA-11(6), NIST.800-53.r5 SA-15(2), NIST.800-53.r5 SA-15(8), NIST.800-53.r5 SA-8(19), NIST.800-53.r5 SA-8(21), NIST.800-53.r5 SA-8(25), NIST.800-53.r5 SC-5, NIST.800-53.r5 SC-5(1), NIST.800-53.r5 SC-5(3), NIST.800-53.r5 SI-20, NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(1), NIST.800-53.r5 SI-4(13), NIST.800-53.r5 SI-4(2), NIST.800-53.r5 SI-4(22), NIST.800-53.r5 SI-4(25), NIST.800-53.r5 SI-4(4), NIST.800-53.r5 SI-4(5), NIST.800-171.r2 3.4.2, NIST.800-171.r2 3.14.6, NIST.800-171.r2 3.14.7, PCI DSS v3.2.1/11.4, PCI DSS v4.0.1/11.5.1
+**Related requirements:** NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 CA-7, NIST.800-53.r5 CM-8(3), NIST.800-53.r5 RA-3(4), NIST.800-53.r5 SA-11(1), NIST.800-53.r5 SA-11(6), NIST.800-53.r5 SA-15(2), NIST.800-53.r5 SA-15(8), NIST.800-53.r5 SA-8(19), NIST.800-53.r5 SA-8(21), NIST.800-53.r5 SA-8(25), NIST.800-53.r5 SC-5, NIST.800-53.r5 SC-5(1), NIST.800-53.r5 SC-5(3), NIST.800-53.r5 SI-20, NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(1), NIST.800-53.r5 SI-4(13), NIST.800-53.r5 SI-4(2), NIST.800-53.r5 SI-4(22), NIST.800-53.r5 SI-4(25), NIST.800-53.r5 SI-4(4), NIST.800-53.r5 SI-4(5), NIST.800-171.r2 3.4.2, NIST.800-171.r2 3.14.6, NIST.800-171.r2 3.14.7, PCI DSS v3.2.1/11.4, PCI DSS v4.0.1/11.5.1, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/DE.CM-01.02, CRI Profile v2.2/DE.CM-01.03
@@ -128,0 +129,2 @@ To add tags to a GuardDuty detector, see [TagResource](https://docs.aws.amazon.c
+**Related requirements:** CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.02, CRI Profile v2.2/DE.CM-03.01, CRI Profile v2.2/DE.CM-03.02, CRI Profile v2.2/DE.CM-03.03, CRI Profile v2.2/PR.PS-04.02, CRI Profile v2.2/PR.PS-04.03, CRI Profile v2.2/RS.AN-07.01
+
@@ -153 +155 @@ To enable GuardDuty EKS Audit Log Monitoring, see [EKS Audit Log Monitoring](htt
-**Related requirements:** PCI DSS v4.0.1/11.5.1
+**Related requirements:** PCI DSS v4.0.1/11.5.1, CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/DE.CM-01.03, CRI Profile v2.2/DE.CM-02.01
@@ -179 +181 @@ To enable GuardDuty Lambda Protection, see [Configuring Lambda Protection](https
-**Related requirements:** PCI DSS v4.0.1/11.5.1
+**Related requirements:** PCI DSS v4.0.1/11.5.1, CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.02, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/PR.PS-04.02, CRI Profile v2.2/PR.PS-04.03, CRI Profile v2.2/RS.AN-07.01, CRI Profile v2.2/RS.MA-02.01
@@ -204,0 +207,2 @@ To enable EKS Runtime Monitoring with automated agent management, see [Enabling
+**Related requirements:** CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.02, CRI Profile v2.2/GV.OC-04.03, CRI Profile v2.2/GV.RM-09.02, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.DS-01.02, CRI Profile v2.2/PR.PS-04.02, CRI Profile v2.2/PR.PS-04.03, CRI Profile v2.2/PR.PS-05.01, CRI Profile v2.2/RS.AN-07.01, CRI Profile v2.2/RS.MA-02.01
+
@@ -229 +233 @@ To enable GuardDuty Malware Protection for EC2, see [Configuring GuardDuty-initi
-**Related requirements:** PCI DSS v4.0.1/11.5.1
+**Related requirements:** PCI DSS v4.0.1/11.5.1, CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/DE.CM-02.01, CRI Profile v2.2/DE.CM-03.01, CRI Profile v2.2/DE.CM-03.02
@@ -255 +259 @@ To enable GuardDuty RDS Protection, see [GuardDuty RDS Protection](https://docs.
-**Related requirements:** PCI DSS v4.0.1/11.5.1
+**Related requirements:** PCI DSS v4.0.1/11.5.1, CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.01, CRI Profile v2.2/DE.CM-02.01, CRI Profile v2.2/RS.MA-02.01
@@ -280,0 +285,2 @@ To enable GuardDuty S3 Protection, see [Amazon S3 Protection in Amazon GuardDuty
+**Related requirements:** CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/RS.MA-02.01
+
@@ -304,0 +311,2 @@ For information about configuring and enabling GuardDuty Runtime Monitoring, see
+**Related requirements:** CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.02, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/DE.CM-01.03, CRI Profile v2.2/DE.CM-03.01, CRI Profile v2.2/DE.CM-03.02, CRI Profile v2.2/DE.CM-03.03, CRI Profile v2.2/PR.PS-04.02, CRI Profile v2.2/PR.PS-04.03, CRI Profile v2.2/RS.AN-07.01, CRI Profile v2.2/RS.MA-02.01
+
@@ -328,0 +337,2 @@ To enable and manage the security agent for GuardDuty Runtime Monitoring of ECS-
+**Related requirements:** CRI Profile v2.2/DE.AE-02.01, CRI Profile v2.2/DE.AE-03.01, CRI Profile v2.2/DE.AE-03.02, CRI Profile v2.2/DE.AE-07.01, CRI Profile v2.2/DE.CM-01.01, CRI Profile v2.2/DE.CM-03.02
+