Azure subscriptions should not have blocked accounts with owner permissions

NIST SP 800-53 Rev 5

• AC-2 Account Management

NIST Cybersecurity Framework v2.0

• GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
• PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.

FedRAMP Moderate Baseline Rev 4

• AC-2 (3): Disable Inactive Accounts

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.

RBI IT Framework for NBFCs

• 3.1.a Identification and Classification of Information Assets
• 3.1.c Role based Access Control
• 3.1.f Maker-checker

CMMC 2.0 Level 2

• AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute

FedRAMP High

• AC-2 Account Management

HIPAA HITRUST v9.2

• 1147.01c2System.456-01.c 01.02 Authorized Access to Information Systems

PCI DSS v3.2.1

• 8.1.2 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects
• 8.1.3: Immediately revoke access for any terminated users.
• 8.1.5: Manage IDs used by thid parties to access, support, or maintain system components via remote access. Remote access are as follows: - Enabled only during the time period needed and disabled when not in use. - Monitored when in use.