PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 6 / c6.1
Quick Wins Vulnerability ManagementSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c6.1 Automated vulnerability scanning with Amazon Inspector

Enable continuous, automated vulnerability scanning of EC2, container images (ECR), and Lambda functions to identify and rank known security weaknesses.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: High Applies to CDE: Yes

Requirement 6

Develop and Maintain Secure Systems and Software

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

6.3 Security vulnerabilities are identified and addressed
  • 6.3.1 Security vulnerabilities identified and risk-ranked Covered
  • 6.3.2 Inventory of bespoke/custom software and components maintained Covered
  • 6.3.3 All system components protected via patches (critical within 1 month) Covered

How to implement on AWS

Enable Amazon Inspector across the entire organization. Prioritize by severity and exploitability. Send findings to Security Hub and alert with EventBridge. Align risk ranking with the vulnerability-ranking process required by PCI.

Practical implementation

How this control is implemented in each reference architecture:

Continuously scan compute for known vulnerabilities and feed a risk-ranked backlog, the baseline for the PCI 6.3 vulnerability process.

  1. Enable Amazon Inspector in the account so EC2, ECR container images, and Lambda functions are scanned continuously and automatically.
    Account-wide detection Amazon Inspector
  2. Route Inspector findings to Security Hub and rank them by severity/exploitability to feed your documented vulnerability process.
    Account-wide detection Security Hub
  3. Maintain the software-component inventory (SBOM) that Inspector uses so third-party and bespoke components are tracked.
    Build/registry Amazon ECR

How to validate: Inspector coverage shows EC2/ECR/Lambda scanned, and findings appear in Security Hub with CVSS severity feeding the risk ranking.

Avoid: Running one-off scans before an audit. PCI expects continuous identification; Inspector runs continuously, so use it that way and act on the ranked findings.

Single-account, 3-tier →

Scan every CDE account automatically from the delegated administrator and consolidate the risk-ranked findings centrally.

  1. Enable Inspector organization-wide from the delegated administrator with auto-enable for new accounts.
    Security tooling account → PCI OU Amazon Inspector AWS Organizations
  2. Consolidate findings and the risk ranking in the delegated-admin Security Hub.
    Security tooling account Security Hub
  3. Standardize the SBOM/registry scanning so bespoke and third-party components are covered in every account.
    Each CDE workload account Amazon ECR

How to validate: Inspector organization status shows all accounts enrolled, and the delegated-admin Security Hub shows consolidated, ranked findings.

Avoid: Enabling Inspector per account. New accounts get missed; use org auto-enable from the delegated admin.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine policies and procedures to verify processes are defined to identify and manage security vulnerabilities, including risk ranking, per all elements of the requirement (6.3.1.a).
  • Interview personnel, examine documentation, and observe processes to verify vulnerabilities are identified from recognized sources and managed accordingly (6.3.1.b).
  • Verify an inventory of bespoke/custom and third-party software components is maintained and used to identify and address vulnerabilities (6.3.2.a).

Evidence in AWS

  • Amazon Inspector enabled on in-scope accounts and its scan coverage.
  • Inspector findings with severity/CVSS integrated in Security Hub.
  • Documented vulnerability ranking and remediation process.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 6.3 — New system and software vulnerabilities that may impact the security of account data are monitored, cataloged, and risk-assessed, and applicable patches are installed within an appropriate time frame.

AWS services

Amazon Inspector Amazon ECR AWS Security Hub Amazon EventBridge

Learning resources

References

  • AWS Security Maturity Model: Infrastructure vulnerability management