Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments

NIST SP 800-53 Rev 5

• AC-17 Remote Access
• AC-17(1) Monitoring And Control
• Access Enforcement (AC-3)
• IA-5: Authenticator Management
• IA-5(1) Password-based Authentication

FedRAMP Moderate Baseline Rev 4

• AC-3 Access Enforcement
• AC-17 (3): Managed Access Control Points
• AC-17(1) Automated Monitoring/Control
• AU-12 Audit Generation
• IA-5 (1): Password-Based Authentication

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.12: Monitor and control remote access sessions.
• 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
• 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
• 3.5.8: Prohibit password reuse for a specified number of generations.

CMMC 2.0 Level 2

• AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
• SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
• SI.L2-3.14.7 Identify unauthorized use of organizational systems

FedRAMP High

• AC-3 Access Enforcement
• AC-17 Remote Access
• AC-17(1) Automated Monitoring / Control
• IA-5 Authenticator Management
• IA-5(1) Password-Based Authentication

PCI DSS v3.2.1

• Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
• Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters