Question

A financial services company must demonstrate continuous compliance against the CIS AWS Foundations Benchmark across 40 member accounts in AWS Organizations. The security team wants to see per-control pass/fail scores centrally, automatically evaluate new accounts as they join the organization, and avoid writing custom evaluation logic. They already have GuardDuty and AWS Config enabled organization-wide via delegated administrator. Which approach BEST meets these requirements with the least operational overhead?

Accepted Answer

Enable Security Hub with the CIS AWS Foundations Benchmark standard from the Security Hub delegated administrator account, turn on auto-enablement for new accounts, and use the aggregation region to view consolidated control scores.

Answer

In the delegated administrator account, enable the AWS Foundational Security Best Practices standard in Security Hub and build custom Config rules to map each CIS control.

Answer

Create a Config conformance pack containing the CIS rules and deploy it as an organization conformance pack, then aggregate results in a Config aggregator dashboard.

Answer

Write a Lambda function triggered by EventBridge on account creation that runs the CIS assessment using the Systems Manager Compliance API and stores scores in DynamoDB.