Kubernetes clusters should have network policy enabled
This control checks if network policy is enabled for Kubernetes cluster. AKS clusters enforce Kubernetes network policies so that pod-to-pod traffic is governed by explicit ingress and egress rules.
Without network policy, pods can talk to any pod. In a Kubernetes cluster configured with default settings, all pods can discover and communicate with each other without any restrictions.
What this control checks
Network policy setting on Kubernetes clusters
Common pitfalls
Any network_policy value is accepted
Checkov CKV_AZURE_7 inspects network_profile/[0]/network_policy and expects ANY_VALUE.
Audit evidence
Evidence that deployed resources meet this control: Prowler check aks_network_policy_enabled (prowler azure --checks aks_network_policy_enabled); PowerPipe control azure_compliance.control.kubernetes_cluster_network_policy_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_7; KICS query "AKS Network Policy Misconfigured" (f5342045-b935-402d-adf1-8dbbd09c0eef); Trivy check AZU-0043.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security), A.8.21 (Security of Network Services) and A.8.22 (Segregation of Networks).
NIS2 Directive (EU 2022/2555): Mapped to 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...) and 4 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Related controls
- Databricks workspaces should be in a customer-managed virtual network
- Network security groups should limit inbound TCP port 21 access from the internet
- Storage accounts should have public network access disabled
- Azure SQL databases should have private endpoint connections enabled
- Azure Synapse workspaces should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_network_policy_enabled - Checkov Check:
CKV_AZURE_7 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_network_policy_enabled - Prowler Check:
aks_network_policy_enabled - KICS Query:
f5342045-b935-402d-adf1-8dbbd09c0eef - Trivy Check:
AZU-0043
Last reviewed: 2026-10-13