Skip to main content

Comparison

FSBP or CIS v3.0: what are the differences, which to enable?

AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark are the two most widely used security standards on AWS. They partly overlap, but they have neither the same goal nor the same scope.

Published September 27, 2026 · 2 min read

In short

  • FSBP is AWS's own standard: many controls, service by service, extended over time.
  • CIS v3.0 is an independent benchmark: a versioned account hardening baseline, recognised beyond AWS.
  • The right answer is often both: FSBP for service coverage, CIS for the baseline and external recognition.

FSBP and CIS v3.0 side by side

Comparison of AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark v3.0
CriterionAWS FSBPCIS AWS Foundations v3.0
PublisherAWSCenter for Internet Security, by practitioner consensus
GoalSecurity best practices specific to each AWS serviceSecure baseline configuration of an AWS account
ScopeDozens of services: EC2, S3, RDS, Lambda, ECS, EKS, API Gateway, CloudFront, OpenSearch…Five sections: IAM, storage, logging, monitoring, networking
SizeOver 200 controlsA few dozen recommendations, automated or manual
EvolutionControls added continuously by AWSNumbered versions (1.2, 1.4, 3.0…)
RecognitionAWS native standardFrequent reference for external auditors (SOC 2, ISO 27001)
In Security HubStandard you can enableCIS v3.0.0 standard you can enable, automating part of the recommendations

Where they overlap

Some controls exist in both standards, under different identifiers:

  • MFA and no access keys on the root user;
  • MFA for console users, access key rotation, over-permissive policies;
  • multi-region CloudTrail, log validation and encryption;
  • S3 buckets that are public or accept HTTP;
  • default EBS encryption and RDS encryption;
  • security groups open on administration ports.

What only FSBP covers

  • Controls specific to application services: outdated Lambda runtimes, privileged ECS task definitions, API Gateway logging, CloudFront and load balancer configuration.
  • Data services beyond S3 and RDS: DynamoDB, OpenSearch, Redshift, ElastiCache…
  • Backups and high availability for many services.

What only CIS covers

  • Password policy details and disabling credentials unused for 45 days.
  • Permissions granted through groups, the dedicated AWS Support role.
  • The 15 CloudWatch metric filters and alarms of section 4.
  • MFA Delete on critical S3 buckets.

Which one to enable?

  • Both, if your Security Hub budget allows: they complement each other.
  • Turn on Security Hub's consolidated control findings option: a control shared by both standards then produces a single finding per resource.
  • If you must choose: FSBP for broad service coverage; CIS if a customer, an auditor or a regulator asks for it.

How the Silamir audit combines the two

  • A score per standard, then an overall score.
  • Shared findings are deduplicated: a single line, tagged FSBP+CIS, with both references.
  • Findings specific to each standard stay identified, so you know where each gap comes from.
  • Everything is prioritised with the other nine domains, based on the attack scenarios it enables.

Ready to audit your AWS account?

Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.

Subscribe on AWS MarketplaceSee how it works