Azure subscriptions should have Microsoft Defender for Servers enabled

SOC 2

• CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
• CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

ISO/IEC 27001:2022

• A.5.25 Assessment and decision on information security events
• A.8.7 Protection against malware
• A.8.9 Configuration management

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• AC-2(12) Account Monitoring for Atypical Usage
• AU-6 Audit Record Review, Analysis, and Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Central Review And Analysis
• AU-12 Audit Record Generation

NIST Cybersecurity Framework v2.0

• GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.

NIST SP 800-171 Rev 2

• 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
• 3.3.4 Alert in the event of an audit logging process failure
• 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
• 3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities

CIS Azure Benchmark v4.0.0

• 9.1.3.1 Ensure that Defender for Servers is set to 'On'

CIS Azure Benchmark v5.0.0

• 8.1.3.1 Ensure that Defender for Servers is set to 'On'

RBI Cyber Security Framework for UCBs

• Annex I (6)

RBI IT Framework for NBFCs

• 3.1.f Maker-checker
• 3.1.g Trails

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...

CIS Azure Benchmark v1.3.0

• 2.1 Ensure that Azure Defender is set to On for Servers

CIS Azure Benchmark v1.4.0

• 2.1 Ensure that Microsoft Defender for Servers is set to 'On'

CIS Azure Benchmark v1.5.0

• 2.1.1 Ensure That Microsoft Defender for Servers Is Set to 'On'

CIS Azure Benchmark v2.0.0

• 2.1.1 Ensure That Microsoft Defender for Servers Is Set to 'On'
• 2.1.2 Ensure That Microsoft Defender for App Services Is Set To 'On'

CIS Azure Benchmark v2.1.0

• 2.1.1 Ensure That Microsoft Defender for Servers Is Set to 'On'

CIS Azure Benchmark v3.0.0

• 3.1.3.1 Ensure That Microsoft Defender for Servers Is Set to 'On'

FedRAMP High

• AC-2(12) Account Monitoring
• AU-6 Audit Record Review, Analysis And Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Integration / Scanning And Monitoring Capabilities
• AU-12 Audit Generation

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(A) Risk analysis
• 164.308(a)(5)(ii)(B): Administrative Safeguards
• 164.308(a)(6)(ii): Administrative Safeguards