AWS Security Hub Standards Triage Checklist

Retrospective: this article looks back at events from November 2018, written in 2026 with the benefit of hindsight.

AWS Security Hub can produce hundreds of failed controls on day one. This checklist helps you triage them without drowning.

Set up correctly first

• Security Hub is enabled in every account and region via the delegated administrator.
• Cross-region aggregation sends findings to your home region.
• The AWS Foundational Security Best Practices standard is enabled; add CIS if you report against it.
• AWS Config is recording in every region (Security Hub controls depend on it).

Prioritize

• Start with critical and high severity failed controls.
• Then focus on controls affecting internet-facing resources and sensitive data.
• Group findings by control, not by resource — fixing a pattern fixes many findings.

Common high-value controls to fix early

• Root user MFA and no root access keys.
• S3 Block Public Access at the account level.
• CloudTrail enabled and logging to a protected bucket.
• GuardDuty enabled.
• Security groups not allowing unrestricted access to SSH or RDP.
• EBS default encryption enabled.
• IMDSv2 required on EC2 instances.

Reduce noise

• Disable controls that don't apply to your environment, with a documented reason.
• Suppress findings for accepted risks with an owner and expiry date.
• Use automation rules to adjust severity or assign owners.

Operate

• Weekly review of new critical and high findings.
• Monthly security score trend reported to leadership.
• Recurring findings feed preventive controls (SCPs, Config remediation, infrastructure-as-code templates).