Azure Compliance ControlsMicrosoft Defender for Cloud
Azure subscriptions should have email notifications for high severity alerts enabled
Email notification for high severity alerts should be enabled. To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, enable email notifications for high severity alerts in Security Center.
What this control checks
Security Center email notifications for high severity alerts must be enabled.
Framework mappings
The clauses this control is mapped to in each framework.
- CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- IR-6(2) Vulnerabilities Related to Incidents
- SI-4(12) Automated Organization-Generated Alerts
NIST Cybersecurity Framework v2.0
- DE.AE-06: Information on adverse events is provided to authorized staff and tools.
- DE.AE-08
- RC.CO-03
- RC.CO-04
- RC.RP-06
7 more clauses
- RS.AN-08
- RS.CO-02: Internal and external stakeholders are notified of incidents.
- RS.CO-03: Information is shared with designated internal and external stakeholders.
- RS.MA-02: Incident reports are triaged and validated.
- RS.MA-03: Incidents are categorized and prioritized.
- RS.MA-04
- RS.MA-05: The criteria for initiating incident recovery are applied.
- 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
- 3.14.3 Monitor system security alerts and advisories and take action in response
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 9.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled
- 8.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- 1 IT Governance
- 3.1.f Maker-checker
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- OIS-08.08B The cloud service provider prioritises the risk treatment according to the level of cyber risks related to the cloud service.
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-18.02B The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day.
- OPS-18.03B The cloud service provider also mandates in its policies and procedures that for 'high' vulnerabilities, engagement is to begin within one working day after identification, with regular follow-up of the vulnerability until it has been remediated.
2 more clauses
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident.
- 2.14 Ensure that 'Notify about alerts with the following severity' is set to 'High'
- 2.14 Ensure that 'Notify about alerts with the following severity' is set to 'High'
- 2.3.3 Ensure That 'Notify about alerts with the following severity' is Set to 'High'
- 2.1.20 Ensure That 'Notify about alerts with the following severity' is Set to 'High'
- 2.1.19 Ensure That 'Notify about alerts with the following severity' is Set to 'High'
- 3.1.14 Ensure That 'Notify about alerts with the following severity' is Set to 'High'
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- 164.308(a)(6)(i) Security incident procedures
- 164.308(a)(6)(ii): Administrative Safeguards
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_notify_alerts_configured - Powerpipe Control:
azure_compliance.control.securitycenter_notify_alerts_configured - Prowler Check:
defender_ensure_notify_alerts_severity_is_high
Last reviewed: 2026-10-15