App Service API apps should require HTTPS for all access

PCI DSS v4.0

• 1.2.5: Network security controls (NSCs) are configured and maintained.
• 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
• 2.2.7: System components are configured and managed securely.
• 4.2.1: PAN is protected with strong cryptography during transmission.
• 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

NIST Cybersecurity Framework v2.0

• GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
• PR.DS-02

FedRAMP Moderate Baseline Rev 4

• SC-8 (1): Cryptographic Or Alternate Physical Protection
• SC-8(1) Cryptographic Or Alternate Physical Protection

RBI Cyber Security Framework for UCBs

• Annex I (1.3)

RBI IT Framework for NBFCs

• 3.1.h Public Key Infrastructure (PKI)

CIS Azure Benchmark v2.0.0

• 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service

CIS Azure Benchmark v2.1.0

• 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service

CIS Azure Benchmark v3.0.0

• 9.1 Ensure 'HTTPS Only' is set to `On`

CMMC 2.0 Level 2

• SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards

FedRAMP High

• SC-8 Transmission Confidentiality And Integrity
• SC-8(1) Cryptographic Or Alternate Physical Protection

HIPAA HITRUST v9.2

• 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
• 0810.01n2Organizational.5-01.n 01.04 Network Access Control
• 0811.01n2Organizational.6-01.n 01.04 Network Access Control
• 0812.01n2Organizational.8-01.n 01.04 Network Access Control
• 0814.01n1Organizational.12-01.n 01.04 Network Access Control

HIPAA Security Rule 2003

• 164.312(e)(1) Transmission security
• 164.312(e)(2)(ii) Encryption

PCI DSS v3.2.1

• 6.5.3: Insecure cryptographic storage.
• Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
• Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks