App Service web apps should use the latest 'PHP version' when PHP is part of the app

NIS2 Directive (EU 2022/2555)

• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

RBI Cyber Security Framework for UCBs

• Annex I (6)

BSI C5:2025

• DEV-02.01B In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development...
• OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
• OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
• OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
• OPS-27.01B The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known...

CIS Azure Benchmark v2.0.0

• 9.6 Ensure That 'PHP version' is the Latest, If Used to Run the Web App

CIS Azure Benchmark v2.1.0

• 9.5 Ensure That 'PHP version' is the Latest, If Used to Run the Web App

CIS Azure Benchmark v3.0.0

• 9.7 Ensure that 'PHP version' is currently supported (if in use)