aws_compliance

AWS Compliance

AWS GuardDuty helps you understand the impact of an incident by classifying findings by severity: low, medium, and high.

guardduty_finding_archived

gxp_eu_annex_11_operational_phase_13

13 Incident Management

hipaa_security_rule_2003_164_308_a_6_ii

164.308(a)(6)(ii) Response and Reporting

hipaa_final_omnibus_security_rule_2013_164_308_a_6_ii

164.308(a)(6)(ii) Response and reporting

hipaa_final_omnibus_security_rule_2013_164_312_b

164.312(b) Audit controls

rbi_itf_nbfc_3_1_g

3.1.g Incident Management

nist_800_171_rev_2_3_11_2

3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified

nist_800_171_rev_2_3_11_3

3.11.3 Remediate vulnerabilities in accordance with risk assessments

rbi_itf_nbfc_3_3

3.3 Vulnerability Management

rbi_itf_nbfc_3_5

3.5 Cyber Crisis Management Plan

nist_800_171_rev_2_3_6_1

3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities

nist_800_171_rev_2_3_6_2

3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization

rbi_itf_nbfc_4_4_i

4.4.i Incident reporting

pci_dss_v321_requirement_6_1_b

6.1.b Interview responsible personnel and observe processes to verify that new security vulnerabilities are identified, a risk ranking is assigned to vulnerabilities that includes identification of all “high risk” and “critical” vulnerabilities and processes to identify new security vulnerabilities include using reputable outside sources for security vulnerability information

rbi_cyber_security_annex_i_6

Annex I (6)

soc_2_cc_3_2

CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed

soc_2_cc_4_2

CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate

soc_2_cc_7_3

CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures

soc_2_cc_7_4

CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate

ffiec_d_3_dc_an_b_1

D3.DC.An.B.1

ffiec_d_5_er_es_b_4

D5.ER.Es.B.4

nist_csf_de_ae_2

DE.AE-2

nist_csf_de_ae_4

DE.AE-4

nist_csf_de_cm_4

DE.CM-4

nist_csf_de_cm_5

DE.CM-5

nist_csf_de_dp_4

DE.DP-4

fedramp_moderate_rev_4_sa_10

Developer Configuration Management (SA-10)

nist_800_53_rev_4_sa_10

all_controls_guardduty

GuardDuty

nist_800_53_rev_4_ir_4_1

IR-4(1) Automated Incident Handling Processes

fedramp_moderate_rev_4_ir_4_1

nist_800_53_rev_5_ir_4_a

IR-4(a)

nist_800_53_rev_4_ir_6_1

IR-6(1) Automated Reporting

fedramp_moderate_rev_4_ir_6_1

nist_800_53_rev_4_ir_7_1

IR-7(1) Automation Support For Availability Of Information / Support

fedramp_moderate_rev_4_ir_7_1

fedramp_low_rev_4_ir_4

Incident Handling (IR-4)

nist_800_53_rev_4_si_4

Information System Monitoring (SI-4)

nist_csf_rs_an_2

RS.AN-2

nist_csf_rs_mi_3

RS.MI-3

fedramp_moderate_rev_4_si_4_a_b_c

SI-4(a)(b)(c)

fedramp_moderate_rev_4_ra_5

Vulnerability Scanning (RA-5)

nist_800_53_rev_4_ra_5

GuardDuty findings should be archived

Run individual configuration, compliance and security controls or full compliance benchmarks for CIS, FFIEC, PCI, NIST, HIPAA, RBI CSF, GDPR, SOC 2, Audit Manager Control Tower, FedRAMP, GxP and AWS Foundational Security Best Practices controls across all your AWS accounts using Powerpipe and Steampipe.

Apache License 2.0

steampipe-mod-aws-compliance

Control: GuardDuty findings should be archived

Description

Usage

SQL

Tags