Question

A financial services company processes cardholder data across 40 AWS accounts managed under AWS Organizations. The security governance team must continuously audit these accounts against the specific control set required by their payment card regulatory obligations, while minimizing the number of irrelevant findings that analysts must triage. They have already enabled Security Hub with central configuration via a delegated administrator account. Which approach best meets these requirements?

Accepted Answer

Create a central configuration policy that enables the PCI DSS standard and associate it with the organizational units containing cardholder-data accounts.

Answer

Enable the AWS Foundational Security Best Practices standard across all accounts and manually filter findings by resource tags indicating cardholder-data workloads.

Answer

Enable the CIS AWS Foundations Benchmark standard organization-wide, since it is the most comprehensive baseline and satisfies all compliance frameworks.

Answer

Build a custom Config conformance pack replicating PCI controls and deploy it instead of using any Security Hub standard.