Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled

SOC 2

• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

PCI DSS v4.0

• 11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
• 11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
• 11.3.1.3: 3 Internal vulnerability scans are performed after any significant change

ISO/IEC 27001:2022

• A.5.21 Managing information security in the ICT supply chain
• A.8.7 Protection against malware

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 3 Incident handling
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

RBI Cyber Security Framework for UCBs

• Annex I (6)

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
• OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
• OPS-26.03B If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images.
• OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
• PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...

HIPAA Security Rule 2003

• 164.308(a)(5)(ii)(B): Administrative Safeguards