Security Hub enabled but no compliance standards activated
- Severity
- Medium
- Service
- Security Hub
- Check ID
- SECURITYHUB_NO_STANDARDS
What this check finds
AWS Security Hub is enabled but no compliance standard (e.g. AWS Foundational Security Best Practices, CIS AWS Benchmark, PCI DSS) is active. Without standards, Security Hub generates no compliance findings and provides no control coverage scores.
Passing looks like: Security Hub standards activated.
How to fix it
Enable at least one standard.
AWS CLI
aws securityhub batch-enable-standards --standards-subscription-requests StandardsArn=arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
Security Hub → Security standards → Enable.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs