Service-managed standards in Security Hub
A service-managed standard is a security standard that another Amazon Web Services service manages but that you can view in Security Hub. For example, Service-Managed Standard: Amazon Control Tower is a service-managed standard that Amazon Control Tower manages. A service-managed standard differs from a security standard that Amazon Security Hub manages in the following ways:
-
Standard creation and deletion – You create and delete a service-managed standard with the managing service's console or API, or with the Amazon CLI. Until you create the standard in the managing service in one of those ways, the standard doesn't appear in the Security Hub console and isn't accessible by the Security Hub API or Amazon CLI.
-
No automatic enablement of controls – When you create a service-managed standard, Security Hub and the managing service don't automatically enable the controls that apply to the standard. In addition, when Security Hub releases new controls for the standard, they're not automatically enabled. This is a departure from standards that Security Hub manages. For more information about the usual way of configuring controls in Security Hub, see Understanding security controls in Security Hub.
-
Enabling and disabling controls – We recommend enabling and disabling controls in the managing service to avoid drift.
-
Availability of controls – The managing service chooses which controls are available as part of the service-managed standard. Available controls may include all, or a subset of, the existing Security Hub controls.
After the managing service creates the service-managed standard and makes controls available for it, you can access your control findings, control statuses, and standard security score in the Security Hub console, Security Hub API, or Amazon CLI. Some or all of this information may also be available in the managing service.
Select a service-managed standard from the following list to view more details about it.