Virtual machines should have system updates installed

SOC 2

• CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• SI-2 Flaw Remediation

NIST Cybersecurity Framework v2.0

• ID.AM-01: Inventories of hardware managed by the organization are maintained.
• ID.AM-02
• ID.AM-08
• PR.IR-02
• PR.PS-01

NIST SP 800-171 Rev 2

• 3.14.1 Identify, report, and correct system flaws in a timely manner

CIS Azure Benchmark v4.0.0

• 9.1.10 Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates

CIS Azure Benchmark v5.0.0

• 8.1.10 Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates

RBI Cyber Security Framework for UCBs

• Annex I (6)

RBI IT Framework for NBFCs

• 1 IT Governance
• 3.3 Vulnerability Management

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
• OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
• OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
• OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
• OPS-18.02B The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day.

CIS Azure Benchmark v2.0.0

• 2.1.13 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'

CIS Azure Benchmark v2.1.0

• 2.1.12 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'

CIS Azure Benchmark v3.0.0

• 3.1.10 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'

FedRAMP High

• SI-2 Flaw Remediation

HIPAA HITRUST v9.2

• 0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code

HIPAA Security Rule 2003

• 164.308(a)(5)(ii)(B): Administrative Safeguards

PCI DSS v3.2.1

• 6.6 For public-facing web applications, ensure that either one of the requirements are in place
• 11.2.1: Perform quarterly internal vulnerability scans and rescans as needed, until all "high-risk" vulnerabilities (as identified in Requirement 6.1) are resolved. Scans must be performed by qualified personnel.
• Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor- supplied security patches
• For a sample of system components including all operating system types commonly affected by malicious software, verify that anti-virus software is deployed if applicable anti-virus technology exists