# Ensure Security Hub Is Enabled and Its Standard Subscriptions Are Configured

- Source: https://support.icompaas.com/support/solutions/articles/62000233546-ensure-security-hub-is-enabled-and-its-standard-subscriptions-are-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

AWS Security Hub provides a comprehensive view of your security posture across AWS accounts and services. It integrates findings from AWS services and third-party tools, evaluates compliance against security standards, and generates actionable insights. Ensuring Security Hub is enabled and its standard subscriptions are configured helps maintain a secure and compliant environment.

#### **Rationale**

-   Enhanced Security: Consolidates security findings and provides actionable insights.
    
-   Compliance: Evaluates compliance against industry standards such as CIS, PCI DSS, and NIST.
    
-   Risk Mitigation: Identifies and prioritizes security risks across AWS accounts.
    

#### **Impact**

**Pros:**

-   Centralized view of security findings across AWS accounts and services.
    
-   Continuous compliance checks against security standards.
    
-   Integration with AWS services and third-party tools for comprehensive security management.
    

**Cons:**

-   May incur additional costs for findings ingestion and security checks.
    
-   Requires configuration and management of standard subscriptions.
    

#### **Default Value**

By default, AWS Security Hub is not enabled. It must be explicitly activated in each AWS Region.

#### **Pre-Requisite**

IAM Permissions Required:

-   securityhub:EnableSecurityHub
    
-   securityhub:DescribeHub
    
-   securityhub:ListEnabledStandards
    
-   AWS CLI installed and configured.
    

#### **Remediation**

#### **Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Security Hub.
    
3.  If Security Hub is not enabled, you will see a Get Started page. Follow the prompts to enable it.
    
4.  Check the Security Standards section to verify which standards are enabled.
    

**Using AWS CLI:**

1.  Check if Security Hub is enabled:  
    
    aws securityhub describe-hub
    
2.  List enabled security standards:  
    
    aws securityhub get-enabled-standards --query "StandardsSubscriptions\[\*\].{StandardsArn:StandardsArn,StandardsStatus:StandardsStatus}"
    

#### **Implementation Steps:**

**Using AWS Console:**

1.  Enable Security Hub:
    
    -   Navigate to Security Hub in the AWS Management Console.  
        ![](https://support.icompaas.com/assets/kb/7a1784b442c624bc.png)
        
    -   Click Enable Security Hub and follow the prompts.  
        ![](https://support.icompaas.com/assets/kb/f243188a439b8f2f.png)![](https://support.icompaas.com/assets/kb/f9755accd707bffe.png)  
        
2.  Enable Security Standards:  
    ![](https://support.icompaas.com/assets/kb/44259e9442bcd5e9.png)
    
    -   Go to the Security Standards section.
        
    -   Select the desired standards (e.g., CIS AWS Foundations Benchmark, PCI DSS, NIST).
        
    -   Enable the standards to start compliance checks.
        

**Using AWS CLI:**

1.  Enable Security Hub:  
    
    aws securityhub enable-security-hub
    
2.  Enable a specific security standard:  
    
    aws securityhub batch-enable-standards --standards-subscription-requests StandardsArn=<standard-arn>
    
3.  Verify the enabled standards:  
    
    aws securityhub get-enabled-standards
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If enabling Security Hub or configuring standard subscriptions causes issues, sign in to the AWS Management Console.  
    Navigate to Security Hub, go to the Standards section, and disable any problematic standard subscriptions.  
    ![](https://support.icompaas.com/assets/kb/712aca317a6c41a1.png)
    
2.  #### If needed, disable Security Hub by going to Security Hub Settings > General and clicking Disable Security Hub.
    

#### **Using AWS CLI:**

1.  #### To disable a standard subscription:  
    
    aws securityhub batch-disable-standards --standards-subscription-requests "StandardsArn=<STANDARD\_ARN>" --region <REGION>
    
2.  #### To disable Security Hub:  
    
    aws securityhub disable-security-hub --region <REGION>
    

#### **References**

-   [AWS Security Hub Documentation](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html)
    
-   [Enabling Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html)
    
-   [AWS Security Hub Standards](https://docs.aws.amazon.com/securityhub/latest/userguide/standards-view-manage.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.