A company manages a set of AWS accounts by using AWS Organizations.

AWS Security Hub is the native AWS service that provides continuous compliance checks against security standards, including the CIS AWS Foundations Benchmark. When integrated with AWS Organizations, Security Hub can automatically enroll existing and newly created accounts, eliminating manual invitations and scripts.

By designating a Security Hub administrator account and enabling automatic account onboarding, the organization ensures consistent security posture monitoring across all accounts. CIS benchmark checks are run continuously, and findings are aggregated centrally, simplifying governance and remediation workflows.

Amazon Inspector focuses on vulnerability scanning for EC2, container images, and Lambda functions—not CIS compliance. GuardDuty is a threat detection service and does not run CIS benchmarks.

Therefore, using AWS Security Hub with automatic organization-wide enrollment is the most efficient solution.