Storage accounts should use virtual network rules to restrict network access

NIS2 Directive (EU 2022/2555)

• 1 Policy on the security of network and information systems
• 2 Risk management policy
• 6 Security in network and information systems acquisition, development and maintenance
• 11 Access control
• 12 Asset management

NIST SP 800-53 Rev 5

• Information Flow Enforcement (AC-4)
• SC-7: Boundary Protection
• SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

• AC-4 Information Flow Enforcement
• AC-17 (3): Managed Access Control Points
• AC-17(1) Automated Monitoring/Control
• SC-7: Boundary Protection
• SC-7(3) Access Points

NIST SP 800-171 Rev 2

• 3.1.3 Control the flow of CUI in accordance with approved authorizations
• 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
• 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
• 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
• 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

CIS Azure Benchmark v4.0.0

• 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
• 10.3.2.3 Ensure default network access rule for storage accounts is set to deny

CIS Azure Benchmark v5.0.0

• 9.3.2.3 Ensure default network access rule for storage accounts is set to deny

RBI Cyber Security Framework for UCBs

• Annex I (1.3)
• Annex I (5.1)

BSI C5:2025

• IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
• IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
• PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.

CIS Azure Benchmark v2.0.0

• 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny

CIS Azure Benchmark v2.1.0

• 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny

CIS Azure Benchmark v3.0.0

• 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny

CMMC 2.0 Level 2

• AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
• AC.L2-3.1.12 Monitor and control remote access sessions
• AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
• AC.L2-3.1.14 Route remote access via managed access control points

FedRAMP High

• AC-4 Information Flow Enforcement
• SC-7 Boundary Protection
• SC-7(3) Access Points

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(B) Risk management
• 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
• 164.312(a)(1) Access control