Azure Compliance ControlsAzure Kubernetes Service
Kubernetes clusters should have network policy enabled
This control checks if network policy is enabled for Kubernetes cluster. AKS clusters enforce Kubernetes network policies so that pod-to-pod traffic is governed by explicit ingress and egress rules.
What this control checks
Network policy setting on Kubernetes clusters
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Related controls
- Databricks workspaces should be in a customer-managed virtual network
- Network security groups should limit inbound TCP port 21 access from the internet
- Storage accounts should have public network access disabled
- Azure SQL databases should have private endpoint connections enabled
- Azure Synapse workspaces should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_network_policy_enabled - Checkov Check:
CKV_AZURE_7 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_network_policy_enabled - Prowler Check:
aks_network_policy_enabled - KICS Query:
f5342045-b935-402d-adf1-8dbbd09c0eef - Trivy Check:
AZU-0043
Last reviewed: 2026-10-13