Security Standards and Compliance Scores

Aggregating findings is half of Security Hub's value. The other half is continuously checking your account against best-practice standards and giving you a score. This tells you not just what attacked you, but how exposed your configuration is in the first place.

A security standard is a curated set of automated controls that check resources against best practices. Security Hub runs these checks on a schedule and reports each control as passed or failed, turning vague "are we secure?" questions into concrete, measurable results.

Security Hub offers standards including the AWS Foundational Security Best Practices (FSBP), the Center for Internet Security (CIS) AWS Foundations Benchmark, and standards aligned to PCI DSS and NIST. Each targets a different audience, from general hardening to specific compliance regimes.

The FSBP standard is AWS's own broad set of checks covering many services, like "S3 buckets should block public access" or "IAM root user should have MFA". It is the recommended starting point for most accounts because it reflects current AWS guidance across the board.

The CIS AWS Foundations Benchmark is an industry-standard hardening guide maintained by the Center for Internet Security. Enabling it in Security Hub checks your account against well-known consensus controls, which is useful when auditors expect CIS alignment specifically.

Each standard is made of individual controls, and each control reports a status: passed, failed, or not available. Failed controls generate findings you can fix. You can disable controls that do not apply to your environment so they do not skew your results.

Security Hub calculates a security score, a percentage of controls passing out of those enabled. A higher score means a stronger posture. The score gives leadership a simple metric to track over time, while the underlying failed controls give engineers the to-do list.

Many controls overlap across standards. Security Hub can consolidate control findings so a single underlying issue is not reported many times. This keeps the score and the finding list clean even when several standards check the same thing.

Failed controls are findings you remediate, often with documented remediation steps. You can route them through EventBridge for automated fixes or to a ticketing system. The score then improves as controls move from failed to passed, giving measurable progress.

Not every control fits every account. You can disable individual controls that do not apply, and some controls accept parameters to match your policy, such as the required minimum password length. Tuning controls keeps the security score meaningful, because a score dragged down by irrelevant checks would mislead rather than guide remediation.

An important dependency: some Security Hub controls rely on AWS Config recording resource configuration. If Config is not recording the relevant resource types, those controls cannot evaluate and may show as no data. So a complete posture program enables Config alongside Security Hub. The exam may hide this dependency, expecting you to know that Config underpins many control checks.

Match standards to needs.

Security Hub measures posture by running security standards, sets of automated controls, including the AWS FSBP, the CIS Benchmark, and PCI DSS/NIST-aligned standards. Each control reports passed or failed, producing a security score (percent passing). Disable irrelevant controls, consolidate overlapping ones, and remediate failures to raise the score.