Azure Compliance ControlsAzure Network Watcher
Flow log resources should have flow logging enabled
Audit for flow log resources to verify if flow log status is enabled. Enabling flow logs allows to log information about IP traffic flowing. Azure policy 27960feb-a23c-4577-8d36-ef8b5f35e0be audits flow log resources in a disabled state.
What this control checks
All flow log resources should be in enabled state
Framework mappings
The clauses this control is mapped to in each framework.
- A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
5 more clauses
- 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- A.8.15 Logging
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
2 more clauses
- 11 Access control
- 12 Asset management
NIST Cybersecurity Framework v2.0
- DE.CM-01
- ID.AM-03
- 7.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 8.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 8.8 Ensure that virtual network flow log retention days is set to greater than or equal to 90
- 6.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.1.1.7 Ensure that virtual network flow logs are captured and sent to Log Analytics
- 7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90
- 7.8 Ensure that virtual network flow log retention days is set to greater than or equal to 90
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- 3.1.g Trails
- 5 Policy for Information System Audit (IS Audit)
- AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
8 more clauses
- OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
- OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident.
- OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records.
- OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
- SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 5.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_watcher_flow_log_enabled - Powerpipe Control:
azure_compliance.control.network_watcher_flow_log_enabled - Prowler Checks:
network_flow_log_captured_sent,network_flow_log_more_than_90_days - Azure Policy Definition:
27960feb-a23c-4577-8d36-ef8b5f35e0be - Trivy Check:
AZU-0073
Last reviewed: 2026-10-14