Is AWS Security Hub enough for SOC 2?
No. AWS Security Hub finds technical misconfigurations, but it has no SOC 2 standard and AWS says its standards do not guarantee compliance. A SOC 2 audit also tests access reviews, change management, policies and evidence across the whole review period.
Last updated November 4, 2026
What Security Hub does well
- Continuous checks against AWS Foundational Security Best Practices, CIS AWS Foundations, NIST 800-53 Rev 5, NIST 800-171 Rev 2 and PCI DSS.
- One place for findings from GuardDuty, Inspector, Macie and partner tools.
- A security score per standard that shows where configuration drifts.
That makes it strong evidence for the monitoring and configuration parts of SOC 2. It is not the whole audit.
What a SOC 2 auditor asks for, and whether Security Hub covers it
| SOC 2 criteria | What the auditor wants to see | From Security Hub? |
|---|---|---|
| CC6.1 Logical access | MFA, least privilege, encryption, network restrictions | Partly: IAM, encryption and network findings |
| CC6.2 and CC6.3 Access provisioning and review | Joiners and leavers handled, periodic access reviews signed off | No |
| CC7.1 and CC7.2 Monitoring | Misconfigurations and threats detected and triaged | Yes, this is its strength |
| CC7.3 to CC7.5 Incident response | A plan, and a record of incidents handled | Partly: detections, not the response record |
| CC8.1 Change management | Changes reviewed, approved and tested before production | No: that lives in GitHub or your CI |
| CC1 to CC5 Governance and risk | Policies, risk assessment, oversight, vendor management | No |
| The whole review period | Proof that controls held for 3 to 12 months, not on one day | Only if you retain and organize findings yourself |
How to use Security Hub for SOC 2
- Turn on AWS Foundational Security Best Practices and CIS AWS Foundations across every account in scope.
- Map each control you rely on to the SOC 2 criteria it supports, so findings become evidence rather than noise.
- Fix failing controls, and keep a record of who approved each change and when it was verified.
- Retain findings and fixes across the full review period.
- Add the evidence Security Hub cannot produce: access reviews, change approvals, policies and risk assessments.
Where Obsinto fits
Obsinto checks your AWS accounts, maps every failure to the SOC 2 criteria it affects, and prepares the fix. It applies the fix after your approval where AWS supports a direct change, otherwise as a pull request or runbook, then re-checks it and records the result as evidence for the whole period. Its GitHub connection covers the change-management evidence Security Hub leaves out. Access reviews and policies still need their own process.
Frequently asked questions
Does AWS Security Hub have a SOC 2 standard?
No. Security Hub supports standards such as AWS Foundational Security Best Practices, CIS AWS Foundations, NIST 800-53, NIST 800-171 and PCI DSS, but not SOC 2. AWS also says its standards do not guarantee compliance with any framework or audit.
Can Security Hub findings be used as SOC 2 evidence?
Yes, as evidence for monitoring and configuration controls, if you map them to the SOC 2 criteria and retain them for the whole review period.
What else do I need for SOC 2 besides Security Hub?
Evidence for access reviews, change management, policies, risk assessment and incident response, plus a record that controls held across the review period.
Is Security Hub the same as AWS Audit Manager?
No. Security Hub detects misconfigurations, while Audit Manager organized evidence for audits. Audit Manager closed to new customers on April 30, 2026.
Turn Security Hub-style findings into closed SOC 2 controls.
Sources
Changelog
- November 4, 2026: page published.