NIST 800-53 rev 5 - Difference: Config conformance pack vs. Security Hub standard?

Question

Hi all

For NIST 800-53 rev 5 compliance standard, AWS Config provides conformance pack - https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_5.html, and AWS Security Hub provides a security standard - https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html. Do they have same controls, i.e., if I deploy either of them, I don't need the other one?

Thanks.

Rumaisa · Accepted Answer

While they both aim to help with NIST 800-53 rev 5 compliance, Security Hub's standard is actually the way to go. It's more comprehensive and integrates findings from various AWS services and even third-party tools. The cool thing is, you don't need to use both - Security Hub's standard is sufficient on its own. That said, don't turn off AWS Config completely! Security Hub still needs it for configuration data. Just disable the specific NIST 800-53 conformance pack in Config if you're using Security Hub. This approach gives you the best of both worlds - comprehensive coverage and simpler compliance management. So in a nutshell, go with Security Hub for your NIST 800-53 rev 5 compliance needs, and you'll be all set!
You can refer this doc for more details: https://aws.amazon.com/security-hub/faqs/

AWS-CSingh · Answer

In addition to the above if you have question in the future while exploring any other standard such as -

When do I use Security Hub and AWS Config conformance packs?
If a compliance standard, such as PCI-DSS, is already present in Security Hub, then the fully-managed Security Hub service is the easiest way to operationalize it. You can investigate findings via the Security Hub integration with Amazon Detective, and you can build automated or semi-automated remediation actions using the Security Hub integration with EventBridge. However, if you want to assemble your own compliance or security standard, which may include security, operational or cost optimization checks, AWS Config conformance packs are the way to go.

AWS Config conformance packs are suggested templates that you can use to simplify management of AWS Config rules by packaging a group of AWS Config rules and associated remediation actions into a single entity. This packaging simplifies deployment of rules and remediation actions across an organization. It also enables aggregated reporting, as compliance summaries can be reported at the pack level. You can start with the AWS Config conformance samples we provide, and customize as you see fit.

This is from the FAQ but clears the selection process well.

NIST 800-53 rev 5 - Difference: Config conformance pack vs. Security Hub standard?

Add your answer

Relevant content