AWS announced support for Cyber Risk Institute (CRI) Profile v2.2 in Security Hub CSPM on October 15, 2026. According to AWS’s announcement, the service provides 404 controls supporting a subset of the framework’s requirements. Requirements that need manual checks are explicitly outside that coverage.
Automated coverage has a defined boundary
AWS describes the CRI Profile as a framework that brings cybersecurity and regulatory expectations for financial services into a common set of requirements. Its stated aim is to let organizations assess themselves once and report against multiple regulations.
For engineering teams, the important distinction is between automated posture evidence and a complete framework assessment. Passing the supported checks would not establish that every CRI requirement has been met. Enabling the standard should not be treated as a compliance verdict.
A useful implementation plan would track three things separately:
- Requirements supported by automated controls.
- Requirements needing manual review or other assessment work.
- Responsibility for closing each evidence gap.
The control count describes the scope of the technical checks; it does not, by itself, measure overall compliance coverage.
Availability and deployment scope
AWS says the standard is available in all AWS Regions where Security Hub CSPM is available, including AWS GovCloud (US) and China Regions. The company recommends Security Hub central configuration to enable it across all or selected organization accounts and all Regions linked to Security Hub with a single action. These availability and configuration details are set out in the AWS announcement.
Before broad enablement, teams should confirm the intended account and Region scope and identify owners for reviewing findings. Pairing centralized configuration with a requirements inventory can help teams use automated checks in risk reporting without losing sight of assessment work those checks do not cover.
See the original announcement for availability and release details.