AWS securityhub: Add NIST 800-53 related requirements to SageMaker encryption controls

Service: securityhub · 2026-10-21 · Documentation medium

File: securityhub/latest/userguide/sagemaker-controls.md · Type: encryption

Summary

Adds 'Related requirements' lines mapping existing SageMaker Security Hub controls (model explainability network isolation, monitoring encryption, KMS for inference experiments) to NIST SP 800-53 Rev. 5 requirements including SC-7(10), SC-12(2), SC-13, SC-28, SC-28(1).

Security assessment

The added lines map existing encryption, KMS key management (SC-12/SC-13) and network isolation (SC-7) controls to NIST compliance requirements. It documents security controls but does not fix a vulnerability or specific incident.

Evidence

**Related requirements:** NIST.800-53.r5 AU-9, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6)

Diff

diff --git a/securityhub/latest/userguide/sagemaker-controls.md b/securityhub/latest/userguide/sagemaker-controls.md
index 05707c6..1cfcfa0 100644
--- a//securityhub/latest/userguide/sagemaker-controls.md
+++ b//securityhub/latest/userguide/sagemaker-controls.md
@@ -497,0 +498,2 @@ To enable network isolation for a SageMaker AI model explainability job definiti
+**Related requirements:** NIST.800-53.r5 AU-9, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6)
+
@@ -541,0 +544,2 @@ For an existing SageMaker AI monitoring schedule, inter-container traffic encryp
+**Related requirements:** NIST.800-53.r5 AU-9, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6)
+
@@ -563,0 +568,2 @@ To configure a KMS key for a SageMaker AI inference experiment, specify the `Kms
+**Related requirements:** NIST.800-53.r5 AU-9, NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6)
+