Azure Cosmos DB accounts should have firewall rules

ISO/IEC 27001:2022

• A.8.20 Network security
• A.8.21 Security of network services
• A.8.22 Segregation of networks

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 6 Security in network and information systems acquisition, development and maintenance
• 11 Access control

NIST SP 800-53 Rev 5

• Information Flow Enforcement (AC-4)
• SC-7: Boundary Protection
• SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

• AC-4 Information Flow Enforcement
• SC-7: Boundary Protection
• SC-7(3) Access Points

NIST SP 800-171 Rev 2

• 3.1.3 Control the flow of CUI in accordance with approved authorizations
• 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
• 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
• 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
• 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

RBI Cyber Security Framework for UCBs

• Annex I (1.3)

RBI IT Framework for NBFCs

• 5 Policy for Information System Audit (IS Audit)

BSI C5:2025

• COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
• PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.

CIS Azure Benchmark v2.0.0

• 4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks

CIS Azure Benchmark v2.1.0

• 4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks

CIS Azure Benchmark v3.0.0

• 5.4.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks

CMMC 2.0 Level 2

• AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
• SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
• SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
• SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
• SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)

FedRAMP High

• AC-4 Information Flow Enforcement
• SC-7 Boundary Protection
• SC-7(3) Access Points

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(B) Risk management
• 164.312(a)(1) Access control