AWS securityhub: Add NIST 800-53 Rev.5 standard to KMS encryption controls reference
Summary
Updates the controls reference so Bedrock.1 and SageMaker.21/23/24 (customer managed KMS encryption controls) now list NIST SP 800-53 Rev. 5 as an applicable standard in addition to the prior entry.
Security assessment
Change documents that encryption-at-rest controls (customer managed KMS keys) are now mapped to NIST SP 800-53 Rev. 5. It is compliance mapping, not a fix for a specific vulnerability.
Evidence
[Bedrock.1](./bedrock-controls.html#bedrock-1) | Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys | NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered
Diff
diff --git a/securityhub/latest/userguide/securityhub-controls-reference.md b/securityhub/latest/userguide/securityhub-controls-reference.md index 190b81d..e64d776 100644 --- a//securityhub/latest/userguide/securityhub-controls-reference.md +++ b//securityhub/latest/userguide/securityhub-controls-reference.md @@ -81 +81 @@ Security control ID | Security control title | Applicable standards | Severity | -[Bedrock.1](./bedrock-controls.html#bedrock-1) | Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered +[Bedrock.1](./bedrock-controls.html#bedrock-1) | Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys | NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered @@ -576 +576 @@ Security control ID | Security control title | Applicable standards | Severity | -[SageMaker.21](./sagemaker-controls.html#sagemaker-21) | SageMaker notebook instances should be encrypted with customer managed AWS KMS keys | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered +[SageMaker.21](./sagemaker-controls.html#sagemaker-21) | SageMaker notebook instances should be encrypted with customer managed AWS KMS keys | NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered @@ -578,2 +578,2 @@ Security control ID | Security control title | Applicable standards | Severity | -[SageMaker.23](./sagemaker-controls.html#sagemaker-23) | SageMaker inference experiments should have instance storage volume encrypted with customer managed AWS KMS keys | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered -[SageMaker.24](./sagemaker-controls.html#sagemaker-24) | SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys | AWS Foundational Security Best Practices | MEDIUM | No | Change triggered +[SageMaker.23](./sagemaker-controls.html#sagemaker-23) | SageMaker inference experiments should have instance storage volume encrypted with customer managed AWS KMS keys | NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered +[SageMaker.24](./sagemaker-controls.html#sagemaker-24) | SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys | NIST SP 800-53 Rev. 5 | MEDIUM | No | Change triggered