Container registries should have public network access disabled

SOC 2

• CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

ISO/IEC 27001:2022

• A.8.20 Network security
• A.8.21 Security of network services
• A.8.22 Segregation of networks

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 6 Security in network and information systems acquisition, development and maintenance
• 11 Access control

CIS Azure Benchmark v4.0.0

• 2.2.1.1 Ensure public network access is Disabled

RBI Cyber Security Framework for UCBs

• Annex I (1.3)

BSI C5:2025

• IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
• IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
• OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
• PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...

HIPAA Security Rule 2003

• 164.312(a)(1) Access control