Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

SOC 2

• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 4 Business continuity and crisis management
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• IR-4 Incident Handling
• IR-5 Incident Monitoring
• IR-6(2) Vulnerabilities Related to Incidents
• SI-4(12) Automated Organization-Generated Alerts

NIST Cybersecurity Framework v2.0

• DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
• RC.CO-03
• RS.MA-01

FedRAMP Moderate Baseline Rev 4

• IR-4 Incident Handling
• IR-5 Incident Monitoring

NIST SP 800-171 Rev 2

• 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
• 3.14.3 Monitor system security alerts and advisories and take action in response
• 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks

CIS Azure Benchmark v4.0.0

• 9.1.12 Ensure That 'All users with the following roles' is set to 'Owner'

CIS Azure Benchmark v5.0.0

• 8.1.12 Ensure That 'All users with the following roles' is set to 'Owner'

RBI Cyber Security Framework for UCBs

• Annex I (7.4)

RBI IT Framework for NBFCs

• 1 IT Governance
• 3.1.c Role based Access Control
• 3.1.f Maker-checker

BSI C5:2025

• BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
• OPS-18.02B The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day.
• OPS-18.03B The cloud service provider also mandates in its policies and procedures that for 'high' vulnerabilities, engagement is to begin within one working day after identification, with regular follow-up of the vulnerability until it has been remediated.
• SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.

CIS Azure Benchmark v1.3.0

• 2.15 Ensure that 'All users with the following roles' is set to 'Owner'

CIS Azure Benchmark v1.4.0

• 2.15 Ensure that 'All users with the following roles' is set to 'Owner'

CIS Azure Benchmark v1.5.0

• 2.3.1 Ensure That 'All users with the following roles' is set to 'Owner'

CIS Azure Benchmark v2.0.0

• 2.1.18 Ensure That 'All users with the following roles' is set to 'Owner'

CIS Azure Benchmark v2.1.0

• 2.1.17 Ensure That 'All users with the following roles' is set to 'Owner'

CIS Azure Benchmark v3.0.0

• 3.1.12 Ensure That 'All users with the following roles' is set to 'Owner'

CMMC 2.0 Level 2

• IR.L2-3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
• SI.L2-3.14.3 Monitor system security alerts and advisories and take action in response
• SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks

FedRAMP High

• IR-4 Incident Handling
• IR-5 Incident Monitoring

HIPAA Security Rule 2003

• 164.308(a)(6)(i) Security incident procedures
• 164.308(a)(6)(ii): Administrative Safeguards