Security Standards
The Security Standards page shows one card per enabled compliance standard with its security score, total control counts, and a direct link into the control list. From a standard you can drill into individual controls, and from a control you can inspect the specific resource checks that are failing and open the Finding Detail drawer for any one of them.
Accessing Security Standards
Select Security standards in the Security Hub CSPM sidebar section. The page header reads Security standards, subtitled "Compliance standards evaluated by Security Hub CSPM". If no standards are enabled yet, the page shows an empty state headed No standards enabled, reading "Use “Manage standards” to enable a compliance standard and start scoring your accounts.", with a Manage standards button that opens the Settings page.
Standards Cards
Each card displays:
- Standard name: the display name of the compliance standard (for example "AWS Foundational Security Best Practices v1.0.0")
- Security score: the percentage of controls passing, shown in large text and color-coded:
- Green: 80% or above
- Amber: 50% to 79%
- Red: below 50%
- Controls passing: the count of passing controls out of the total evaluated (for example "42 / 55 controls passing")
- A color-coded progress bar representing the security score
- A View controls button that navigates to the Standard Detail view for that standard
A standard shows a No data yet chip next to its name — with the score, count and bar replaced by the line "Scores appear once AWS finishes evaluating this standard." — when none of its controls has been scored at all. A standard whose controls have all come back UNKNOWN is not in that state on this page: it has controls counted toward the denominator and none of them passing, so it is drawn as 0% with a red bar. The Compliance Dashboard treats that same standard as "No data yet", so the two pages can label it differently.
Click anywhere on a card, or click View controls, to open the Standard Detail view.
A Manage standards button in the page header opens the Settings page where you can enable or disable standards.
A newly enabled standard shows No data yet until two things have happened: AWS has evaluated its controls, and a Refresh findings run has pulled the resulting findings into Prism. Nothing on this page polls AWS directly, so the score does not appear on its own.
Control status is derived from the local finding store (the data pulled during the last Refresh findings run), not from live AWS. Control statuses show as UNKNOWN or NO_DATA until a refresh completes and AWS Config recording is active.
Standard Detail
The Standard Detail view shows all controls for a single compliance standard, their statuses, severity ratings, and the count of failed checks per control.
Accessing Standard Detail
Click any standard card on the Security Standards page, or click a standard row in the Compliance Dashboard. A breadcrumb trail at the top of the view reads Security Hub CSPM > Security standards > {Standard name} with links back to each level. The header is the standard's display name, subtitled "Control-by-control results for this Security Hub standard".
A View failing findings button in the header opens the Findings page scoped to this standard, pre-filtered to the failing, still-open findings the console counts. It is the only navigation into the findings list scoped to one standard.
Control Status Summary
A panel headed Control status at the top of the Standard Detail view shows a row of colored chips counting the controls in each status for this standard. The counts describe the whole standard and are read from their own unfiltered request, so they do not move when you filter or search the table below — the panel says as much in a caption: "Every control in this standard — unaffected by the filters below."
| Status | Color | Meaning |
|---|---|---|
| Passed | Green | All resource checks for this control are passing |
| Failed | Red | One or more resource checks for this control are failing |
| Unknown | Amber | The control could not be evaluated (for example, AWS Config is not recording) |
| No data | Gray | No evaluation data has been received for this control yet |
Until the counts land the panel reads "Counting controls…" rather than showing four zeroes, so "still loading" and "genuinely zero" stay distinguishable. If the count cannot be read at all it says so — "Couldn't load this standard's control totals — reload the page to try again." — instead of reporting zeros.
Controls Table
The controls table, headed All controls (N) and subtitled "Filter by status or search a control by ID or title", lists every control for the standard with the following columns:
| Column | Description |
|---|---|
| ID | The AWS Security Hub control ID (for example EC2.1) |
| Title | The human-readable control title, truncated to one line with the full title on hover |
| Control status | A colored chip showing Passed / Failed / Unknown / No data |
| Severity | The severity rating assigned to this control, shown as AWS reports it: CRITICAL, HIGH, MEDIUM, LOW or INFORMATIONAL |
| Failed checks | The count of failing resource checks out of the total (for example "3 of 12") |
Click any control row to navigate to the Control Detail view for that control.
Filtering Controls
Use the filter chips and search field above the table to narrow the list:
- Status chips: click All, Failed, Passed, Unknown, or No data to show only controls in that status; the active filter chip is highlighted
- Search controls: type any text to match a control by its ID or its title
Both are applied by the server, so each change re-queries the control list. While that query runs, a thin progress bar appears above the table if rows are already on screen — the previous result stays visible rather than collapsing — and the first load of a standard shows "Loading controls…" in place of the table instead. When nothing matches, the table reads "No controls match this filter — clear the search or pick another status."
Control Detail
The Control Detail view shows metadata for a single control and the individual resource checks (findings) that make up its pass/fail result.
Accessing Control Detail
Click any control row in the Standard Detail controls table. A breadcrumb trail reads Security Hub CSPM > {Standard name} > {Control ID} with links back to each level.
Control Header
The top of the Control Detail view shows:
- Title: the full human-readable name of the control (the control ID is used as the title until the control loads, and if the control is not found)
- Description: a brief explanation of what the control evaluates (may be empty for some controls)
- Remediation: a button that opens the AWS Security Hub documentation page for this control's remediation guidance in a new tab (present only when AWS supplies a remediation URL)
A summary panel shows:
| Field | Description |
|---|---|
| Control status | The aggregate status chip: Passed, Failed, Unknown or No data |
| Severity | The severity rating for this control, as AWS reports it (HIGH, MEDIUM, …) |
| Failed checks | Count of failing checks out of the total checks evaluated |
Checks Table
The Checks table, headed Checks (N) and subtitled "Individual resource evaluations behind this control", lists individual resource findings that make up this control's evaluation, with the following columns:
| Column | Description |
|---|---|
| Compliance | The compliance status chip for this check (PASSED / FAILED / WARNING / NOT_AVAILABLE) |
| Workflow | The workflow status chip (NEW / NOTIFIED / SUPPRESSED / RESOLVED) |
| Account | The AWS account ID where the resource lives |
| Region | The AWS region where the resource lives |
| Resource type | The type of AWS resource being checked, as Security Hub reports it (for example AwsS3Bucket). The resource's own ARN or identifier is in the finding's detail drawer, not in this table |
| Updated | The date and time the finding was last observed |
Rows are ordered by last-observed time, newest first.
Click any check row to open the Finding Detail drawer for that specific finding. The drawer shows full finding details and lets you update the workflow status; a successful update reloads the control, so the summary panel and the rows reflect the change as soon as the drawer closes. If the control has no findings for your enrolled accounts, the table reads "No checks yet — this control has no findings for your enrolled accounts."
The checks table shows up to 50 findings per control, and it has no pagination of its own — there is no "Load more" here. For a control with more than 50 checks, open the Findings page and narrow it there: use View failing findings on this control's standard to scope the list to that standard, then type the control's title into Search title. The findings list has no control-ID filter, so the control title is the way to isolate one control's checks.
Related Pages
- Compliance Dashboard, Overview with per-standard progress bars
- Findings, Browse and filter the full findings list with more filter options
- Settings, Enable or disable compliance standards
- AWS Config, Enable recording so controls can evaluate your resources