Azure Compliance ControlsAzure Virtual Network
Network security groups should have UDP services restricted from the internet
Azure NSG rules are assessed for inbound UDP exposure to the public Internet (e.g., `0.0.0.0/0`, `*`, `Internet`). The finding identifies allow rules that permit unsolicited UDP traffic from any external source to attached resources.
What this control checks
NSG must not allow inbound UDP from the Internet (0.0.0.0/0, *, Internet).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 8.3 Ensure that UDP access from the Internet is evaluated and restricted
- 7.3 Ensure that UDP access from the Internet is evaluated and restricted
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- COS-03.01B The cloud service provider distincts between trusted and untrusted networks. Based on a risk assessment according to OIS-07, these are separated into different security zones for internal and external network areas (and DMZ, if applicable).
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 6.6 Ensure that UDP Services are restricted from the Internet
- 6.6 Ensure that UDP Services are restricted from the Internet
- 6.3 Ensure that UDP access from the Internet is evaluated and restricted
- 6.3 Ensure that UDP access from the Internet is evaluated and restricted
- 6.3 Ensure that UDP access from the Internet is evaluated and restricted
- 7.3 Ensure that UDP access from the Internet is evaluated and restricted
- 164.308(a)(1)(ii)(B) Risk management
Related controls
- Network security groups should limit inbound TCP port 5900 access from the internet
- Network security groups should limit inbound TCP port 135 access from the internet
- Virtual networks should have Azure DDoS Protection Standard enabled
- Storage accounts should use virtual network rules to restrict network access
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_udp_service_restricted - Powerpipe Control:
azure_compliance.control.network_security_group_udp_service_restricted - Prowler Check:
network_udp_internet_access_restricted - Trivy Check:
AZU-0047
Last reviewed: 2026-10-14