c1.3 Evaluate cloud security posture
Continuously check your AWS accounts against security best practices with a Cloud Security Posture Management (CSPM) tool. AWS Security Hub CSPM provides this out of the box.
Implementation guidance
Automate your security posture evaluation
Reading the CIS AWS Foundations Benchmark and other best practices and checking your accounts by hand does not scale. Automate the evaluation with a Cloud Security Posture Management (CSPM) tool so misconfigurations surface continuously instead of during a once-a-year review.
AWS Security Hub CSPM
Naming note: the service that runs these security-standard checks was renamed AWS Security Hub CSPM (Cloud Security Posture Management) in late 2025. It was previously called just "AWS Security Hub". The name "AWS Security Hub" now refers to a separate, broader security-operations offering, so this control specifically means Security Hub CSPM.
Enabling Security Hub CSPM with its security standards (for example the AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark) identifies your gaps against best practices and gives you remediation guidance. It turns on in a few clicks, and with central configuration you enable and manage it consistently across every account and Region from a delegated administrator account.
Act on what matters first
This is a detective control (it aligns with the Identify function of the NIST CSF). Detection only adds value if someone acts on it, so assign a person or team on the security side to triage and remediate the critical and high severity findings first, then work down. Track the security score as a KPI and watch the trend improve over time.
Alternatives and complements
For point-in-time (rather than continuous) assessments, the Self-Service Security Assessment tool bundles open-source scanners such as Prowler and ScoutSuite. Cloud Custodian can send its findings natively into Security Hub CSPM. Third-party CSPMs (Prowler, Palo Alto Prisma Cloud, Trend Micro, Check Point CloudGuard, Wiz, and others) are common in multi-cloud environments and can also centralize findings in Security Hub CSPM.
Complement with AWS Trusted Advisor
AWS Trusted Advisor adds a complementary view of misconfigurations and critical security alerts. A core set of security checks is available to everyone; customers with Business or Enterprise Support get the full set of checks.
How to validate
- Is AWS Security Hub CSPM (or another CSPM) enabled across all accounts and Regions using central configuration?
- Is a person or team actively remediating the critical and high severity findings?
- Is the security score reported as a KPI, and is the trend improving over time?
- Or is it enabled inconsistently (for example only in production, or only where AWS Config is on)?
- If you are not using a CSPM: is someone regularly reviewing Trusted Advisor findings, and what is your Support level (the checks available depend on it)?
Threats addressed
- Misconfigurations are a leading cause of cloud security incidents. A CSPM such as AWS Security Hub CSPM continuously identifies resources that drift from best practices and provides remediation guidance, closing gaps before an adversary finds them.
AWS services
AWS Security Hub 
AWS Trusted Advisor Pricing
AWS Security Hub CSPM security checks are billed per check per account per Region, on a tiered scale (first 100,000 checks/month at USD 0.001 each, then lower tiers). A 30-day free trial reports the usage you would be billed for, so you can estimate next month's cost. See Security Hub CSPM pricing.