NIST SP 800-171 Revision 2 in Security Hub

NIST Special Publication 800-171 Revision 2 (NIST SP 800-171 Rev. 2) is a cybersecurity and compliance framework developed by the National Institute of Standards and Technology (NIST), an agency that's part of the U.S. Department of Commerce. This compliance framework provides recommended security requirements for protecting the confidentiality of Controlled Unclassified Information in systems and organizations that aren't part of the U.S. federal government. Controlled Unclassified Information, also referred to as CUI, is sensitive information that doesn't meet government criteria for classification but must be protected. It's information that is considered sensitive and is created or possessed by the U.S. federal government or other entities on behalf of the U.S. federal government.

NIST SP 800-171 Rev. 2 provides recommended security requirements for protecting the confidentiality of CUI when:

The requirements apply to all components of non-federal systems and organizations that process, store, or transmit CUI, or provide security protection for the components. For more information, see NIST SP 800-171 Rev. 2 in the NIST Computer Security Resource Center.

Amazon Security Hub provides security controls that support a subset of NIST SP 800-171 Revision 2 requirements. The controls perform automated security checks for certain Amazon Web Services services and resources. To enable and manage these controls, you can enable the NIST SP 800-171 Revision 2 framework as a standard in Security Hub. Note that the controls don't support NIST SP 800-171 Revision 2 requirements that require manual checks.

Configuring resource recording for controls that apply to the standard

To optimize coverage and the accuracy of findings, it's important to enable and configure resource recording in Amazon Config before you enable the NIST SP 800-171 Revision 2 standard in Amazon Security Hub. When you configure resource recording, also be sure to enable it for all the types of Amazon resources that are checked by controls that apply to the standard. Otherwise, Security Hub might not be able to evaluate the appropriate resources, and generate accurate findings for controls that apply to the standard.

For information about how Security Hub uses resource recording in Amazon Config, see Enabling and configuring Amazon Config for Security Hub. For information about configuring resource recording in Amazon Config, see Working with the configuration recorder in the Amazon Config Developer Guide.

The following table specifies the types of resources to record for controls that apply to the NIST SP 800-171 Revision 2 standard in Security Hub.

Determining which controls apply to the standard

The following list specifies the controls that support NIST SP 800-171 Revision 2 requirements and apply to the NIST SP 800-171 Revision 2 standard in Amazon Security Hub. For details about specific requirements that a control supports, choose the control. Then refer to the Related requirements field in the details for the control. This field specifies each NIST requirement that the control supports. If the field doesn't specify a particular NIST requirement, the control doesn't support the requirement.