Azure subscriptions should have Microsoft Defender for Containers enabled

SOC 2

• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

ISO/IEC 27001:2022

• A.5.25 Assessment and decision on information security events
• A.5.28 Collection of evidence
• A.8.7 Protection against malware
• A.8.9 Configuration management

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• AC-2(12) Account Monitoring for Atypical Usage
• AU-6 Audit Record Review, Analysis, and Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Central Review And Analysis
• AU-12 Audit Record Generation

NIST SP 800-171 Rev 2

• 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
• 3.3.4 Alert in the event of an audit logging process failure
• 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
• 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified

CIS Azure Benchmark v4.0.0

• 9.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'

CIS Azure Benchmark v5.0.0

• 8.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'

RBI Cyber Security Framework for UCBs

• Annex I (6)

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
• OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...

CIS Azure Benchmark v2.0.0

• 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'

CIS Azure Benchmark v2.1.0

• 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On'
• 2.1.16 Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On'

CIS Azure Benchmark v3.0.0

• 3.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'

FedRAMP High

• AC-2(12) Account Monitoring
• AU-6 Audit Record Review, Analysis And Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Integration / Scanning And Monitoring Capabilities
• AU-12 Audit Generation

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(A) Risk analysis