Azure Compliance ControlsAzure Virtual Network
Network security groups should prohibit inbound HTTP (port 80) access from the internet
Azure NSG are evaluated for inbound rules that allow public HTTP access on `TCP 80`. This includes cases where `80` is covered by a port range. The source can be `0.0.0.0/0`, `Internet`, or `*`.
What this control checks
Network security groups should not allow inbound HTTP (port 80) access from the internet
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.1: Network connections between trusted and untrusted networks are controlled.
9 more clauses
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.4.4: System components that store cardholder data are not directly accessible from untrusted networks
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 8.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 7.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 7.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.310(a)(1) Facility access controls
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_network_http_internet_access_restricted - Checkov Check:
CKV_AZURE_160 - Prowler Check:
network_http_internet_access_restricted - Trivy Check:
AZU-0047
Last reviewed: 2026-10-11