Azure subscriptions should have more than one owner

NIST SP 800-53 Rev 5

• AC-5 Separation of Duties

NIST Cybersecurity Framework v2.0

• GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.

FedRAMP Moderate Baseline Rev 4

• AC-5 Separation Of Duties

NIST SP 800-171 Rev 2

• 3.1.4: Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

RBI IT Framework for NBFCs

• 3.1.c Role based Access Control

CMMC 2.0 Level 2

• AC.L2-3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion

FedRAMP High

• AC-5 Separation Of Duties

HIPAA HITRUST v9.2

• 1145.01c2System.1-01.c 01.02 Authorized Access to Information Systems
• 1152.01c3System.2-01.c 01.02 Authorized Access to Information Systems

PCI DSS v3.2.1

• 7.1.1: Define access needs for each role, including: - System components and data resources that each role needs to access for their job function - Level of privilege required (for example, user, administrator, etc.) for accessing resources.
• 7.1.3: Assign access based on individual personnel's job classification and function.
• Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities