Question 1

Is flow_log_cloudwatch_log_group_kms_key_id enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 2

Is flow_log_cloudwatch_log_group_retention_in_days enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is map_public_ip_on_launch enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, Ensure that AWS Virtual Private Cloud (AWS VPC) subnets are assigned a public IP address. The control is compliant if AWS VPC does not have subnets that are assigned a public IP address. The control is non-compliant if AWS VPC has subnets that are assigned a public IP address.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 164.312(b)	164.312(b)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled 164.308(a)(1)(ii)(B)	164.308(a)(1)(ii)(B)
VPC subnet auto assign public IP should be disabledvpc_subnet_auto_assign_public_ip_disabled 164.312(e)(1)	164.312(e)(1)

Controls