Network security groups should have RDP access restrictions configured
Prowler check network_rdp_internet_access_restricted flags Azure NSG inbound rules that Allow TCP traffic to port 3389 from broad sources like 0.0.0.0/0, Internet, or *. The Powerpipe control covers 'User Rights Assignment' Group Policy settings on Windows machines.
Exposed RDP enables Internet-wide brute force and credential stuffing, risking unauthorized console access. Compromise can cause data theft (confidentiality), tampering or malware deployment (integrity), VM lockout or disruption (availability), and lateral movement within the VNet.
What this control checks
Network security groups must restrict RDP access instead of leaving it open
Common pitfalls
Ranges that cover 3389 are flagged
The finding flags rules that Allow TCP traffic to port 3389 from broad sources like 0.0.0.0/0, Internet, or *, including ranges that cover 3389.
Guest Configuration prerequisites required
This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope.
Audit evidence
Evidence that deployed resources meet this control: Prowler check network_rdp_internet_access_restricted (prowler azure --checks network_rdp_internet_access_restricted); PowerPipe control azure_compliance.control.network_security_group_rdp_access_restricted.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security) and A.8.21 (Security of Network Services).
NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 2.3.1 (The relevant entities shall review independently their approach to managing network and information system security and...), 6.7.2.b (determine and apply controls to protect the relevant entities internal network domains from unauthorised access;) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- A.8.20 Network security
- A.8.21 Security of network services
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 8.1 Ensure that RDP access from the Internet is evaluated and restricted
- 7.1 Ensure that RDP access from the Internet is evaluated and restricted
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- Annex I (7.3)
- COS-03.01B The cloud service provider distincts between trusted and untrusted networks. Based on a risk assessment according to OIS-07, these are separated into different security zones for internal and external network areas (and DMZ, if applicable).
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 6.1 Ensure that RDP access is restricted from the internet
- 6.1 Ensure that RDP access is restricted from the internet
- 6.1 Ensure that RDP from the internet access is evaluated and restricted
- 6.1 Ensure that RDP access from the Internet is evaluated and restricted
- 6.1 Ensure that RDP access from the Internet is evaluated and restricted
- 7.1 Ensure that RDP access from the Internet is evaluated and restricted
- 1232.09c3Organizational.12-09.c 09.01 Documented Operating Procedures
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.310(a)(1) Facility access controls
- 164.312(a)(1) Access control
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_rdp_access_restricted - Powerpipe Control:
azure_compliance.control.network_security_group_rdp_access_restricted - Prowler Check:
network_rdp_internet_access_restricted
Last reviewed: 2026-10-13