Azure subscriptions should limit owners to 3

NIST SP 800-53 Rev 5

• AC-2 Account Management
• AC-6: Least Privilege
• AC-6(7) Review of User Privileges

NIST Cybersecurity Framework v2.0

• GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
• GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
• GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
• GV.RR-04: Cybersecurity is included in human resources practices.
• GV.SC-02

FedRAMP Moderate Baseline Rev 4

• AC-2 (3): Disable Inactive Accounts
• AC-6 (5): Privileged Accounts

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.

RBI IT Framework for NBFCs

• 3.1.c Role based Access Control
• 3.1.f Maker-checker
• 3.1.g Trails

CMMC 2.0 Level 2

• AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts

FedRAMP High

• AC-2 Account Management
• AC-6 Least Privilege
• AC-6(7) Review Of User Privileges

HIPAA HITRUST v9.2

• 1144.01c1System.4-01.c 01.02 Authorized Access to Information Systems
• 1151.01c3System.1-01.c 01.02 Authorized Access to Information Systems
• 11112.01q2Organizational.67-01.q 01.05 Operating System Access Control

PCI DSS v3.2.1

• 7.1.1: Define access needs for each role, including: - System components and data resources that each role needs to access for their job function - Level of privilege required (for example, user, administrator, etc.) for accessing resources.
• 7.1.3: Assign access based on individual personnel's job classification and function.
• Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities