ControlTower Compliance Status

Question

Hi,

In my ControlTower settings I see the following message.

"The status of controls owned by AWS Security Hub are unknown in AWS Control Tower. Controls owned by AWS Security Hub are not aggregated in the compliance status of accounts and OUs in AWS Control Tower."

I don't know how to solve it.

![Enter image description here](/media/postImages/original/IMZoO4QHNsTAS7eBNA1qkZKg)

Regards

Answer

That is the expected behavior as documented [here](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html).  The detective controls from Security Hub can be enabled and enforced via Control Tower but the status can only be viewed via Security Hub.  You can think of Control Tower as showing you the status of "preventive controls" and Security Hub showing you the status of "detective controls".

ControlTower Compliance Status

Conteúdo relevante