Internet-facing virtual machines should use network security groups for protection

NIST SP 800-53 Rev 5

• Information Flow Enforcement (AC-4)
• SC-7: Boundary Protection
• SC-7(3) Access Points

NIST SP 800-171 Rev 2

• 3.1.3 Control the flow of CUI in accordance with approved authorizations
• 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
• 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
• 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
• 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

RBI IT Framework for NBFCs

• 5 Policy for Information System Audit (IS Audit)

FedRAMP High

• AC-4 Information Flow Enforcement
• SC-7 Boundary Protection
• SC-7(3) Access Points

HIPAA HITRUST v9.2

• 0805.01m1Organizational.12-01.m 01.04 Network Access Control
• 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
• 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
• 0810.01n2Organizational.5-01.n 01.04 Network Access Control
• 0811.01n2Organizational.6-01.n 01.04 Network Access Control