Azure Compliance ControlsAzure Monitor
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
Azure Monitor Activity Log alert monitors Network Security Group changes via the Microsoft.Network/networkSecurityGroups/write operation. It captures create/update events across the subscription. The check looks for a subscription-wide Activity Log alert.
What this control checks
Subscription has an Activity Log alert for Network Security Group create or update operations
Framework mappings
The clauses this control is mapped to in each framework.
- CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
- CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
6 more clauses
- 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- 11.5.2: A change-detection mechanism (for example, file integrity monitoring tools) is deployed
- 11.6.1: Unauthorized changes on payment pages are detected and responded to.
- 12.10.5: The security incident response plan includes monitoring and responding to alerts from security monitoring systems
- A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- A3.5.1: Suspicious events are identified and responded to.
- A.8.16 Monitoring activities
- 2 Risk management policy
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
1 more clause
- 11 Access control
- 7.1.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 6.1.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-09.04AC Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
- HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
- IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.
11 more clauses
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-13.03AC Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay.
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.
- 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 6.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(6)(i) Security incident procedures
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
Related controls
- Azure subscriptions should have an Activity Log Alert configured for Delete SQL Server Firewall Rule
- Monitor log profiles should have retention set to 365 days or greater
- Network security group flow logs should have retention set to greater than 90 days
- Databricks subnets should have network security groups configured
- Network security groups should limit inbound TCP port 4333 access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_alert_create_update_nsg - Powerpipe Control:
azure_compliance.control.monitor_log_alert_create_update_nsg - Prowler Check:
monitor_alert_create_update_nsg
Last reviewed: 2026-10-13