Function apps should use the latest supported runtime version (~4)

PCI DSS v4.0

• 6.3.3: All system components are protected from known vulnerabilities by installing applicable security patches/updates

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

BSI C5:2025

• DEV-02.01B In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development...
• OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
• OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
• OPS-27.01B The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known...
• OPS-33.02B Patch management procedures are harmonised with the cloud service provider's overall software change management process.