Skip to main content

Security Hub CSPM

Security Hub CSPM evaluates every enrolled member account in your AWS organization against a set of compliance standards and surfaces the results in Prism. A single delegated administrator account aggregates findings from all enrolled members across every linked region so you can measure compliance posture without opening the AWS Console in each account individually.

What is Security Hub CSPM?​

AWS Security Hub CSPM (Cloud Security Posture Management) runs continuous automated checks, called controls, against your AWS resources and scores each account against industry standards such as the AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, and PCI DSS. Prism configures a delegated administrator account with a cross-region aggregator, enrolls your member accounts under that administrator, and enables the compliance standards you choose.

Key capabilities include:

  • Standards-based scoring, Evaluate every enrolled account against any of the eight supported compliance standards and see per-standard security scores on the Compliance Dashboard
  • Control drill-down, Navigate from a standard to its individual controls, and from a control to the specific resource checks that are failing
  • Findings browse and triage, Filter and search findings by account, title, severity, workflow status and compliance status; update workflow status, with an optional note, in the Finding Detail drawer
  • Member enrollment, Enroll, retry, and remove member accounts at any time after initial setup; track per-account enrollment phase with live auto-polling
  • Standards and region management, Add or remove compliance standards and linking regions after setup without disabling the engine
info

Security Hub CSPM requires AWS Config recording in every enrolled account and region to evaluate most controls. Prism prompts you to set up AWS Config when you complete the setup wizard and whenever recording is missing. See AWS Config for details on managing recorders.

Once Security Hub CSPM is enabled, the sidebar shows a collapsible Security Hub CSPM row. Expand it for the engine's five pages:

Sidebar entryDescription
SummaryThe compliance dashboard: severity stat cards, per-standard progress bars, regional breakdowns, and the top-findings asset table
Security standardsOne card per enabled standard with its security score; drill into controls and individual resource checks
FindingsFull findings list with multi-dimensional filters and the Finding Detail slide-in drawer
EnrollmentView, add, retry, and remove member accounts and track per-account enrollment phase
SettingsChange compliance standards, add or remove linking regions, and disable Security Hub CSPM

When CSPM is not yet set up, the sidebar shows a single Enable Security Hub CSPM row in place of that dropdown. Clicking it opens the setup wizard.

CSPM also appears as a capability card titled Posture management, sourced from "Amazon Security Hub CSPM", describing itself as "Security Hub CSPM checks — standards, controls, and a compliance score across your accounts." and listing FSBP, CIS AWS Foundations, NIST 800-53 and PCI DSS. Its button reads Enable before setup; afterwards it reads Configure and a green Enabled marker appears alongside it. You will find the card in two places: on the Security Hub Overview under the heading Enable Security Hub, while no engine is enabled at all, and permanently on the Capabilities tab of the Configuration page, where the same panel is headed Security capabilities.

All of that copy — the card's name, source, description and bullet list — is served by the backend, so it is the same on both surfaces.

Prerequisites​

Before enabling Security Hub CSPM, ensure the following:

  • Your organization has been onboarded to Prism by CloudKeeper
  • Security Hub has been enabled for your organization as a beta feature by CloudKeeper
  • Security Hub access enabled for your account by an Admin in Preferences > Admin Management
  • At least one AWS account is onboarded in Prism to act as the delegated administrator