Azure subscriptions should have Microsoft Defender for Storage enabled

SOC 2

• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

ISO/IEC 27001:2022

• A.5.25 Assessment and decision on information security events
• A.8.7 Protection against malware
• A.8.9 Configuration management

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• AC-2(12) Account Monitoring for Atypical Usage
• AU-6 Audit Record Review, Analysis, and Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Central Review And Analysis
• AU-12 Audit Record Generation

NIST Cybersecurity Framework v2.0

• GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.

FedRAMP Moderate Baseline Rev 4

• AC-2(12) Account Monitoring
• AU-6 Audit Record Review, Analysis And Reporting
• AU-12 Audit Generation
• IR-4 Incident Handling
• IR-5 Incident Monitoring

NIST SP 800-171 Rev 2

• 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
• 3.3.4 Alert in the event of an audit logging process failure
• 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
• 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified

CIS Azure Benchmark v4.0.0

• 9.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On'

CIS Azure Benchmark v5.0.0

• 8.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On'

RBI Cyber Security Framework for UCBs

• Annex I (6)

RBI IT Framework for NBFCs

• 3 Information Security
• 3.1.f Maker-checker
• 3.1.g Trails

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...

CIS Azure Benchmark v1.3.0

• 2.5 Ensure that Azure Defender is set to On for Storage

CIS Azure Benchmark v1.4.0

• 2.5 Ensure that Microsoft Defender for Storage is set to 'On'

CIS Azure Benchmark v1.5.0

• 2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On'

CIS Azure Benchmark v2.0.0

• 2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On'

CIS Azure Benchmark v2.1.0

• 2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On'

CIS Azure Benchmark v3.0.0

• 3.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On'

CMMC 2.0 Level 2

• AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
• AU.L2-3.3.4 Alert in the event of an audit logging process failure
• AU.L2-3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
• RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified

FedRAMP High

• AC-2(12) Account Monitoring
• AU-6 Audit Record Review, Analysis And Reporting
• AU-6(4) Central Review And Analysis
• AU-6(5) Integration / Scanning And Monitoring Capabilities
• AU-12 Audit Generation