Storage accounts should use private link

Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to your storage account, data leakage risks are reduced. Prowler checks for Private Endpoint connections.

What this control checks

Framework mappings

The clauses this control is mapped to in each framework.

NIS2 Directive (EU 2022/2555)

1 Policy on the security of network and information systems
6 Security in network and information systems acquisition, development and maintenance
11 Access control
12 Asset management

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0

2.2.2.1 Ensure Private Endpoints are used to access {service}
10.3.2.1 Ensure Private Endpoints are used to access Storage Accounts

CIS Azure Benchmark v5.0.0

9.3.2.1 Ensure Private Endpoints are used to access Storage Accounts

RBI Cyber Security Framework for UCBs

Annex I (1.3)

BSI C5:2025

IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.

CIS Azure Benchmark v1.5.0