Azure subscriptions should not have guest accounts with owner permissions

NIST SP 800-53 Rev 5

• AC-2 Account Management

NIST Cybersecurity Framework v2.0

• GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
• PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.

FedRAMP Moderate Baseline Rev 4

• AC-2 (3): Disable Inactive Accounts

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.

RBI IT Framework for NBFCs

• 3.1.a Identification and Classification of Information Assets
• 3.1.c Role based Access Control
• 3.1.f Maker-checker

CMMC 2.0 Level 2

• AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute

FedRAMP High

• AC-2 Account Management

HIPAA HITRUST v9.2

• 1146.01c2System.23-01.c 01.02 Authorized Access to Information Systems

PCI DSS v3.2.1

• 7.2.1 Confirm that access control systems are in place on all system components
• 8.1.2 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects
• 8.1.5: Manage IDs used by thid parties to access, support, or maintain system components via remote access. Remote access are as follows: - Enabled only during the time period needed and disabled when not in use. - Monitored when in use.
• Do not store sensitive authentication data after authorization (even if encrypted)
• Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access