Running container images should have no unresolved vulnerabilities
Running container images are evaluated for unresolved vulnerability findings (`CVEs`) reported by Microsoft Defender for Cloud. The check reviews images currently in use across Kubernetes workloads and identifies where vulnerabilities remain unremediated.
Unremediated CVEs in active images enable: RCE, container escape, and node takeover affecting integrity/availability. Adversaries can use public exploits to pivot across clusters and pipelines, tamper images, and disrupt services.
What this control checks
Running container images have no unresolved vulnerabilities
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability..." (17f4b1cc-c55c-4d94-b1f9-2978f6ac2957); Prowler check defender_container_images_resolved_vulnerabilities (prowler azure --checks defender_container_images_resolved_vulnerabilities).
Framework-specific interpretation
SOC 2: Mapped to CC3.2 (COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks...), CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
ISO/IEC 27001:2022: Mapped to A.5.21 (Managing Information Security In The ICT Supply Chain) and A.8.9 (Configuration Management).
NIS2 Directive (EU 2022/2555): Mapped to 3.1.2.d (documents to be used in the course of incident detection and response such as incident response manuals, escalation...), 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...), 5.1.4.f (an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.21 Managing information security in the ICT supply chain
- A.8.9 Configuration management
- 3 Incident handling
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (6)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-18.02B The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day.
- OPS-18.03B The cloud service provider also mandates in its policies and procedures that for 'high' vulnerabilities, engagement is to begin within one working day after identification, with regular follow-up of the vulnerability until it has been remediated.
- OPS-26.03B If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images.
- OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
- 164.308(a)(5)(ii)(B): Administrative Safeguards
Related controls
- Kubernetes clusters should use a non-vulnerable Kubernetes version
- Container registries should have the admin user disabled
- Container registries should use private link
- Kubernetes clusters should have HTTP application routing disabled
- Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_defender_container_images_resolved_vulnerabilities - Prowler Check:
defender_container_images_resolved_vulnerabilities - Azure Policy Definition:
17f4b1cc-c55c-4d94-b1f9-2978f6ac2957
Last reviewed: 2026-10-11