r2.2 Define and enforce secure configuration standards (hardening)
Establish secure configuration standards for all system components, aligned with recognized industry hardening standards (e.g. CIS Benchmarks), and apply them consistently.
AWS services
AWS Systems Manager 
AWS Config 
AWS Security Hub 
EC2 Image Builder Requirement 2
Apply Secure Configurations to All System Components
PCI sub-requirements covered
- 2.2 System components are configured and managed securely
How to implement on AWS
Adopt CIS Benchmarks and enforce them with AWS Systems Manager (State Manager and Compliance). Distribute secure configurations via golden AMIs and SSM documents. Define a single primary function per server where applicable and disable insecure services/protocols. Verify compliance with AWS Config and Security Hub (CIS AWS Foundations Benchmark standard).
Practical implementation
How this control is implemented in each reference architecture:
Apply a CIS Benchmark via SSM State Manager to the EC2 instances in the app and data tiers, and enable the CIS standard in Security Hub for the account. Track drift with AWS Config in the single account.
Single-account, 3-tier →Deploy the hardening baseline and the CIS Security Hub standard organization-wide from the security tooling account (delegated admin), and enforce it across every PCI OU account with a Config conformance pack, so all CDE accounts are held to the same standard.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine system configuration standards to verify they define processes covering all elements of the requirement and are updated as new vulnerabilities are identified (2.2.1.a, 2.2.1.b).
- Examine configuration settings and interview personnel to verify the standards are applied when new system components are configured and before or immediately after connection to production (2.2.1.c).
- Examine system configurations to verify that only required functionality is enabled and unnecessary functionality is removed or disabled (2.2.4.b).
Evidence in AWS
- Documented configuration standards referencing CIS Benchmarks.
- SSM State Manager / AWS Config compliance report for in-scope components.
- CIS AWS Foundations Benchmark standard enabled in Security Hub.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 2.2 — All system components are configured securely and consistently and in accordance with industry-accepted hardening standards or vendor recommendations.
Learning resources
References
- AWS Security Maturity Model: Configuration management
- CIS AWS Foundations Benchmark