Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled

SOC 2

• CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
• CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

ISO/IEC 27001:2022

• A.5.25 Assessment and decision on information security events
• A.8.7 Protection against malware
• A.8.9 Configuration management

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• AC-2(12) Account Monitoring for Atypical Usage
• AC-16 Security and Privacy Attributes
• AU-6 Audit Record Review, Analysis, and Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Central Review And Analysis

NIST Cybersecurity Framework v2.0

• ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.

NIST SP 800-171 Rev 2

• 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
• 3.3.4 Alert in the event of an audit logging process failure
• 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
• 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified

CIS Azure Benchmark v4.0.0

• 9.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

CIS Azure Benchmark v5.0.0

• 8.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

RBI Cyber Security Framework for UCBs

• Annex I (6)

RBI IT Framework for NBFCs

• 3.1.f Maker-checker
• 3.1.g Trails

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...

CIS Azure Benchmark v1.3.0

• 2.4 Ensure that Azure Defender is set to On for SQL servers on machines

CIS Azure Benchmark v1.4.0

• 2.4 Ensure that Microsoft Defender for SQL servers on machines is set to 'On'

CIS Azure Benchmark v1.5.0

• 2.1.5 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

CIS Azure Benchmark v2.0.0

• 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
• 2.1.5 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

CIS Azure Benchmark v2.1.0

• 2.1.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

CIS Azure Benchmark v3.0.0

• 3.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

FedRAMP High

• AC-2(12) Account Monitoring

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(A) Risk analysis