App Service apps should use the latest TLS version

SOC 2

• CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
• CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives

PCI DSS v4.0

• 1.2.5: Network security controls (NSCs) are configured and maintained.
• 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
• 2.2.7: System components are configured and managed securely.
• 4.2.1: PAN is protected with strong cryptography during transmission.
• 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained

ISO/IEC 27001:2022

• A.8.12 Data leakage prevention
• A.8.24 Use of cryptography

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance
• 9 Cryptography
• 12 Asset management

NIST SP 800-53 Rev 5

• SC-8(1): Cryptographic Protection
• Transmission Confidentiality And Integrity (SC-8)

NIST Cybersecurity Framework v2.0

• GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
• PR.DS-02

NIST SP 800-171 Rev 2

• 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

RBI Cyber Security Framework for UCBs

• Annex I (1.3)

RBI IT Framework for NBFCs

• 3.1.h Public Key Infrastructure (PKI)

BSI C5:2025

• COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
• CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
• CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...

CIS Azure Benchmark v2.0.0

• 9.3 Ensure Web App is using the latest version of TLS encryption

CIS Azure Benchmark v2.1.0

• 9.3 Ensure Web App is using the latest version of TLS encryption

CIS Azure Benchmark v3.0.0

• 9.4 Ensure Web App is using the latest version of TLS encryption

FedRAMP High

• SC-8 Transmission Confidentiality And Integrity
• SC-8(1) Cryptographic Or Alternate Physical Protection

HIPAA HITRUST v9.2

• 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
• 0810.01n2Organizational.5-01.n 01.04 Network Access Control
• 0811.01n2Organizational.6-01.n 01.04 Network Access Control
• 0812.01n2Organizational.8-01.n 01.04 Network Access Control
• 0814.01n1Organizational.12-01.n 01.04 Network Access Control

HIPAA Security Rule 2003

• 164.312(e)(1) Transmission security
• 164.312(e)(2)(ii) Encryption