AWS securityhub: Add SageMaker and Bedrock AgentCore controls to FSBP standard list

Service: securityhub · 2026-10-21 · Documentation medium

File: securityhub/latest/userguide/fsbp-standard.md · Type: encryption

Summary

Adds four new FSBP controls to the standard's control list: BedrockAgentCore.7 (private network configuration for custom code interpreters), SageMaker.20 and SageMaker.25 (network isolation for job definitions), and SageMaker.22 (inter-container traffic encryption for monitoring schedules).

Security assessment

Adds security controls that enforce network isolation and inter-container traffic encryption for SageMaker/Bedrock workloads, reducing exposure of model training and monitoring traffic; this is control documentation rather than a fix for a specific incident.

Evidence

+[[SageMaker.22] SageMaker monitoring schedules should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-22)

Diff

diff --git a/securityhub/latest/userguide/fsbp-standard.md b/securityhub/latest/userguide/fsbp-standard.md
index 3093dc3..b648e55 100644
--- a//securityhub/latest/userguide/fsbp-standard.md
+++ b//securityhub/latest/userguide/fsbp-standard.md
@@ -70,0 +71,2 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[BedrockAgentCore.7] Bedrock AgentCore custom code interpreters should use a private network configuration](./bedrockagentcore-controls.html#bedrockagentcore-7)
+
@@ -688,0 +691,6 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[SageMaker.20] SageMaker model explainability job definitions should have network isolation enabled](./sagemaker-controls.html#sagemaker-20)
+
+[[SageMaker.22] SageMaker monitoring schedules should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-22)
+
+[[SageMaker.25] SageMaker model quality job definitions should have network isolation enabled](./sagemaker-controls.html#sagemaker-25)
+