Azure Compliance ControlsAzure Monitor
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group
Checks that the subscription has an Activity Log alert for Network Security Group delete operations. The alert rule triggers when a Network Security Group is deleted (Microsoft.Network/networkSecurityGroups/delete). Category must be Administrative.
What this control checks
Subscription has an Activity Log alert for Network Security Group delete operations
Framework mappings
The clauses this control is mapped to in each framework.
- CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
- CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- A.8.16 Monitoring activities
- 2 Risk management policy
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
1 more clause
- 11 Access control
- 7.1.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 6.1.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-09.04AC Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
- COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.
- HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
12 more clauses
- IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-13.03AC Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay.
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 6.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(6)(i) Security incident procedures
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
Related controls
- Network security groups should have Diagnostic Settings configured
- Network Watcher flow logs should have traffic analytics enabled
- Network security groups should have HTTP(S) access on ports 80 and 443 from the internet evaluated and restricted
- Network security groups should limit inbound TCP port 21 access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_alert_delete_nsg - Powerpipe Control:
azure_compliance.control.monitor_log_alert_delete_nsg - Prowler Check:
monitor_alert_delete_nsg - Azure Policy Definition:
b954148f-4c11-4c38-8221-be76711e194a
Last reviewed: 2026-10-13