Azure subscriptions should not have blocked accounts with read and write permissions

NIST SP 800-53 Rev 5

• AC-2 Account Management

NIST Cybersecurity Framework v2.0

• GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
• PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
• 3.5.6 Disable identifiers after a defined period of inactivity

RBI IT Framework for NBFCs

• 3.1.a Identification and Classification of Information Assets
• 3.1.c Role based Access Control
• 3.1.f Maker-checker

FedRAMP High

• AC-2 Account Management

PCI DSS v3.2.1

• 8.1.2 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects
• 8.1.3: Immediately revoke access for any terminated users.
• 8.1.5: Manage IDs used by thid parties to access, support, or maintain system components via remote access. Remote access are as follows: - Enabled only during the time period needed and disabled when not in use. - Monitored when in use.