AWS securityhub: List Bedrock.1 and SageMaker encryption controls under NIST 800-53

Service: securityhub · 2026-10-21 · Documentation low

File: securityhub/latest/userguide/standards-reference-nist-800-53.md · Type: encryption

Summary

Adds Bedrock.1, SageMaker.21, SageMaker.23, and SageMaker.24 (customer managed KMS encryption controls) to the list of controls that support NIST SP 800-53 Revision 5.

Security assessment

Adds encryption-related controls to the NIST standard compliance listing. Security-relevant documentation of controls, but no vulnerability or incident is addressed.

Evidence

  * [[Bedrock.1] Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys](./bedrock-controls.html#bedrock-1)

Diff

diff --git a/securityhub/latest/userguide/standards-reference-nist-800-53.md b/securityhub/latest/userguide/standards-reference-nist-800-53.md
index a899aa4..a77c53e 100644
--- a//securityhub/latest/userguide/standards-reference-nist-800-53.md
+++ b//securityhub/latest/userguide/standards-reference-nist-800-53.md
@@ -119,0 +120,2 @@ The following list specifies the controls that support NIST SP 800-53 Revision 5
+  * [[Bedrock.1] Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys](./bedrock-controls.html#bedrock-1)
+
@@ -629,0 +632,6 @@ The following list specifies the controls that support NIST SP 800-53 Revision 5
+  * [[SageMaker.21] SageMaker notebook instances should be encrypted with customer managed AWS KMS keys](./sagemaker-controls.html#sagemaker-21)
+
+  * [[SageMaker.23] SageMaker inference experiments should have instance storage volume encrypted with customer managed AWS KMS keys](./sagemaker-controls.html#sagemaker-23)
+
+  * [[SageMaker.24] SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys](./sagemaker-controls.html#sagemaker-24)
+