Azure Compliance FrameworksSpecialized Frameworks
BSI C5:2025
Best for: The C5 criteria catalogue is primarily intended for professional cloud service providers, their auditors and customers. Cloud service customers use it as a guide to selecting a provider and as a foundation for customer-specific risk management.
Controls by Category
AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service... (9 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
AM-09.01B Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits. (1 control)
AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
AM-09.04AC Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4. (9 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreUnattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionDatabricks workspaces should have a customer-managed key configuredMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabled
COS-03.01B The cloud service provider distincts between trusted and untrusted networks. Based on a risk assessment according to OIS-07, these are separated into different security zones for internal and external network areas (and DMZ, if applicable). (3 controls)
COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements. (4 controls)
PostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Delete Network Security Group
COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness. (9 controls)
App Service apps should use the latest TLS versionApp Service web apps should use the latest TLS versionSQL servers should have minimum TLS version set to 1.2 or higherAzure Cosmos DB accounts should have firewall rulesMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts should have 'Minimum TLS version' set to 'Version 1.2'
CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents... (2 controls)
CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data. (13 controls)
Azure Service Management API should require multifactor authenticationApp Service apps should use the latest TLS versionApp Service web apps should use the latest TLS versionSQL servers should have minimum TLS version set to 1.2 or higherUnattached managed disks should be encrypted with ADE or customer-managed keysUnattached managed disks should use customer-managed keys (CMK) for encryptionKey vault keys should have automatic rotation enabledMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts should each have 'Enable key rotation reminders' enabledStorage accounts should have 'Minimum TLS version' set to 'Version 1.2'
CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud... (13 controls)
Azure Service Management API should require multifactor authenticationApp Service apps should use the latest TLS versionApp Service web apps should use the latest TLS versionSQL servers should have minimum TLS version set to 1.2 or higherUnattached managed disks should be encrypted with ADE or customer-managed keysUnattached managed disks should use customer-managed keys (CMK) for encryptionKey vault keys should have automatic rotation enabledMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts should each have 'Enable key rotation reminders' enabledStorage accounts should have 'Minimum TLS version' set to 'Version 1.2'
CRY-05.01AC The cloud service provider ensures that secure encryption mechanisms are in place to prevent the recovery of cloud service customer data when resources are reallocated or physical media are recovered. (1 control)
CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest). (1 control)
CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure. (8 controls)
Unattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionDatabricks workspaces should have a customer-managed key configuredStorage accounts containing operational log containers should use customer-managed keys for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryption
CRY-06.01B Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion. (4 controls)
Storage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabled
CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this... (2 controls)
CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited. (2 controls)
CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module. (12 controls)
Key vault keys should have automatic rotation enabledKey vaults should have resource logs enabledKey vaults should have deletion protection enabledKey vaults should have Role-Based Access Control (RBAC) enabledKey vaults should have soft delete enabledAzure Key Vaults should use private linkKey vaults should have public network access disabledNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all keysRBAC key vaults should have 'Expiration Date' configured for all secretsAzure subscriptions should have Microsoft Defender for Key Vault enabled
CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and... (12 controls)
Key vault keys should have automatic rotation enabledKey vaults should have resource logs enabledKey vaults should have deletion protection enabledKey vaults should have Role-Based Access Control (RBAC) enabledKey vaults should have soft delete enabledAzure Key Vaults should use private linkKey vaults should have public network access disabledNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all keysRBAC key vaults should have 'Expiration Date' configured for all secretsAzure subscriptions should have Microsoft Defender for Key Vault enabled
CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to... (7 controls)
Key vault keys should have automatic rotation enabledKey vaults should have resource logs enabledAzure Key Vaults should use private linkNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all keysRBAC key vaults should have 'Expiration Date' configured for all secrets
CRY-14.01B The cloud service provider has documented and implemented procedures to deactivate cryptographic keys once they expire. These procedures ensure that: - Expired keys are no longer used for encryption purposes, but may still be used for decryption if necessary;- Expired keys are no... (5 controls)
Key vault keys should have automatic rotation enabledKey vaults should have Role-Based Access Control (RBAC) enabledNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all secrets
CRY-16.02B Procedures for the recovery of lost or corrupted keys are in place. (2 controls)
CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud... (5 controls)
Key vaults should have resource logs enabledKey vaults should have Role-Based Access Control (RBAC) enabledStorage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryption
DEV-02.01AC The cloud service provider documents and implements a procedure that makes it possible to supervise and control the outsourced development activity, in order to ensure that the outsourced development activity is compliant with the secure development policy of the cloud service... (1 control)
DEV-02.01B In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development... (4 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appFunction apps should use the latest supported runtime version (~4)
DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation. (12 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and... (4 controls)
HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
HR-04.01B The cloud service provider classifies information of security-sensitive positions according to their level of risk, including positions related to IT administration and all positions with access to cloud service customer data or system components for the provisioning of the cloud... (1 control)
IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and... (8 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID users with VM access should have multifactor authentication enabledAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' role
IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant. (4 controls)
IAM-03.01AS The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service... (4 controls)
Function apps should have function keys configuredStorage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryption
IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts. (5 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should have a custom role for administering resource locksContainer registries should have the admin user disabledAzure subscriptions should restrict use of the 'User Access Administrator' role
IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy. (9 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID users with VM access should have multifactor authentication enabledAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should restrict use of the 'User Access Administrator' roleMicrosoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle'). (11 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID users with VM access should have multifactor authentication enabledAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleMicrosoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse. (7 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
IAM-06.09B The cloud service provider requires two- or more factor authentication for accessing the administration interfaces used by the cloud service provider. (3 controls)
IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect. (5 controls)
Azure Service Management API should require multifactor authenticationPrivileged Microsoft Entra ID users should have multifactor authentication enabledMicrosoft Entra ID users with VM access should have multifactor authentication enabledVirtual machines should use just-in-time network access control for management portsAzure subscriptions should restrict use of the 'User Access Administrator' role
IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-... (6 controls)
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID users with VM access should have multifactor authentication enabledKey vault keys should have automatic rotation enabledStorage accounts should each have 'Enable key rotation reminders' enabled
IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01. (5 controls)
Unattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionDatabricks workspaces should have a customer-managed key configuredSQL servers should use customer-managed keys to encrypt data at rest
IAM-09.01AC Access to the non-production environment requires two-factor or multi-factor authentication. (3 controls)
IAM-09.02B Access to the production environment requires two-factor or multi-factor authentication. (2 controls)
IAM-09.03B Within the production environment, user authentication takes place through passwords, digitally signed certificates or procedures that achieve at least an equivalent level of security. If digitally signed certificates are used, administration is carried out in accordance with the... (1 control)
IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel. (28 controls)
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationApp Service apps should have FTP deployments disabledApp Service function apps should have public access restrictions configuredFunction apps should have function keys configuredMicrosoft Entra ID users with VM access should have multifactor authentication enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledVirtual machines should use just-in-time network access control for management portsContainer registries should have public network access disabledContainer registries should use private linkAzure subscriptions should restrict use of the 'User Access Administrator' roleKey vaults should have public network access disabledKubernetes clusters should have public access restrictions configuredNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetPostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabledAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should have shared key access disabledStorage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabledStorage accounts should use private link
IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems. (26 controls)
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationApp Service apps should have FTP deployments disabledApp Service function apps should have public access restrictions configuredFunction apps should have function keys configuredMicrosoft Entra ID users with VM access should have multifactor authentication enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetVirtual machines should use just-in-time network access control for management portsContainer registries should have public network access disabledContainer registries should use private linkAzure subscriptions should restrict use of the 'User Access Administrator' roleKey vaults should have public network access disabledKubernetes clusters should have public access restrictions configuredNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetPostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabledAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should have shared key access disabledStorage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabledStorage accounts should use private link
INQ-02.01B The cloud service provider informs the affected cloud service customer(s) without undue delay. Exceptions for this information of the customer need to be justified by the legal basis of this request or because there are clear indications of illegal actions of the customer in... (1 control)
OIS-02.01B Top management of the cloud service provider has adopted an information security policy. (6 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Azure Service Management API should require multifactor authenticationAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' role
OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers. (6 controls)
Azure Service Management API should require multifactor authenticationAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleMicrosoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'
OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles. (8 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should have a custom role for administering resource locksMicrosoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment... (4 controls)
Azure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' role
OIS-04.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures. (2 controls)
OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud... (5 controls)
Storage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabledStorage accounts should have secure transfer enabled
OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly. (8 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have an Activity Log alert for Service Health incidentsKey vaults should have resource logs enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OIS-08.08B The cloud service provider prioritises the risk treatment according to the level of cyber risks related to the cloud service. (2 controls)
OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components... (27 controls)
Virtual machines should have endpoint protection installedSecurity contacts should have attack path email notifications enabled at the configured minimum risk levelRunning container images should have no unresolved vulnerabilitiesAzure subscriptions should have Microsoft Defender for IoT Hub enabledVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Azure Cosmos DB enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledMicrosoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selectedAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledSecurity Center should have Windows Defender ATP (WDATP) integration selectedCritical SQL servers should have Microsoft Defender for SQL set to 'On'Unprotected Azure SQL servers should have Azure Defender for SQL enabled
OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s). (9 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appFunction apps should use the latest supported runtime version (~4)SQL servers should have minimum TLS version set to 1.2 or higherVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email
OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions. (11 controls)
Security contacts should have attack path email notifications enabled at the configured minimum risk levelAzure subscriptions should have an Activity Log alert for Service Health incidentsVirtual machines should have system updates installedAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledMicrosoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected
OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis. (9 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appFunction apps should use the latest supported runtime version (~4)SQL servers should have minimum TLS version set to 1.2 or higherVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email
OPS-05.03AC The configuration of the protection mechanisms is monitored automatically. (7 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the... (6 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or morePostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysSQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more
OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06. (6 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreUnattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionSQL servers should use customer-managed keys to encrypt data at rest
OPS-09.02B The data classification of the original data is applied to backups. (2 controls)
OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments. (16 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have an Activity Log alert for Service Health incidentsPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and... (9 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsVirtual machine backup policies should have daily retention set to the configured minimum or moreAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleFlow log resources should have flow logging enabledPostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysSQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more
OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential... (7 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentSQL servers should have VA 'Send scan reports to' configured
OPS-13.03AC Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay. (3 controls)
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Delete Network Security Group
OPS-13.03B The cloud service provider protects all SIEM logs to avoid tampering and deletion. (4 controls)
OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected. (6 controls)
Virtual machine backup policies should have daily retention set to the configured minimum or moreFlow log resources should have flow logging enabledPostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysSQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more
OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management). (6 controls)
Storage accounts containing operational log containers should use customer-managed keys for encryptionSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryption
OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them. (10 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident. (9 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records. (9 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events. (10 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors. (5 controls)
Azure Service Management API should require multifactor authenticationMicrosoft Entra ID users with VM access should have multifactor authentication enabledAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should restrict use of the 'User Access Administrator' roleStorage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
OPS-18.02B The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day. (4 controls)
Running container images should have no unresolved vulnerabilitiesVirtual machines should have system updates installedAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabled
OPS-18.03B The cloud service provider also mandates in its policies and procedures that for 'high' vulnerabilities, engagement is to begin within one working day after identification, with regular follow-up of the vulnerability until it has been remediated. (4 controls)
Running container images should have no unresolved vulnerabilitiesVirtual machines should have system updates installedAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabled
OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness. (10 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appSQL servers should have minimum TLS version set to 1.2 or higherMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have email notifications for high severity alerts enabledSecurity Center should have Windows Defender ATP (WDATP) integration selectedSMB file shares should have 'SMB protocol version' set to 'SMB 3.1.1' or higherStorage accounts should have 'Minimum TLS version' set to 'Version 1.2'
OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications. (7 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OPS-26.03B If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images. (3 controls)
OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications. (10 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action. (6 controls)
Azure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
OPS-27.01B The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known... (5 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appFunction apps should use the latest supported runtime version (~4)Virtual machines should have system updates installed
OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software. (6 controls)
SQL servers should have minimum TLS version set to 1.2 or higherKey vault keys should have automatic rotation enabledSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts should each have 'Enable key rotation reminders' enabled
OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle... (7 controls)
Running container images should have no unresolved vulnerabilitiesContainer registries should have the admin user disabledContainer registries should have public network access disabledContainer registries should use private linkAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
OPS-33.02B Patch management procedures are harmonised with the cloud service provider's overall software change management process. (6 controls)
App Service web apps should use the latest 'Java version' when Java is part of the appApp Service web apps should use the latest 'PHP version' when PHP is part of the appApp Service web apps should use the latest 'Python version' when Python is part of the appFunction apps should use the latest supported runtime version (~4)Virtual machines should have system updates installedStorage accounts should have blob versioning enabled
PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks. (6 controls)
Network security groups should prohibit inbound HTTP (port 80) access from the internetVirtual machine scale sets should be in a load balancer backend poolAzure Cosmos DB accounts should have firewall rulesNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internet
PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means. (2 controls)
PS-02.01AS The cloud service is provided from more than two locations that provide each other with redundancy. The locations are sufficiently far apart to achieve georedundancy. If two locations fail at the same time, at least one third location is still available to prevent a total service failure. (1 control)
PS-02.01B The cloud service is provided from at least two locations that provide each other with operational redundancy and resilience. The locations meet the security requirements of the cloud service provider (cf. PS-01) and are located in an adequate distance to each other to achieve... (1 control)
PS-02.02AS The georedundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met. (1 control)
PS-02.02B Operational redundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met. (1 control)
PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised. (19 controls)
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationFunction apps should have function keys configuredMicrosoft Entra ID users with VM access should have multifactor authentication enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetVirtual machines should use just-in-time network access control for management portsAzure subscriptions should restrict use of the 'User Access Administrator' roleKey vaults should have public network access disabledKubernetes clusters should have public access restrictions configuredNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetPostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabledStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should have shared key access disabledStorage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the... (12 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that... (4 controls)
Azure Service Management API should require multifactor authenticationNon-privileged Microsoft Entra ID users should have multifactor authentication enabledPrivileged Microsoft Entra ID users should have multifactor authentication enabledMicrosoft Entra ID users with VM access should have multifactor authentication enabled
PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced. (2 controls)
PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials. (12 controls)
Key vault keys should have automatic rotation enabledKey vaults should have resource logs enabledKey vaults should have deletion protection enabledKey vaults should have Role-Based Access Control (RBAC) enabledKey vaults should have soft delete enabledAzure Key Vaults should use private linkKey vaults should have public network access disabledNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all keysRBAC key vaults should have 'Expiration Date' configured for all secretsAzure subscriptions should have Microsoft Defender for Key Vault enabled
PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method). (5 controls)
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should restrict use of the 'User Access Administrator' role
PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so... (5 controls)
Virtual machines should use an approved custom imageContainer registries should have the admin user disabledContainer registries should have public network access disabledContainer registries should use private linkAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabled
PSS-12.02AC Within these partitions, the following operations by the cloud service provider are restricted to occur only within the geographical boundaries of the customer-selected partitions: - Privileged access to the production environment by the cloud service provider, including potential... (1 control)
PSS-12.03AC Monitoring of threat intelligence data, which excludes any cloud service customer data and Account data, and logging of required routing information such as IP addresses are not required to be geographically limited to a single partition. (1 control)
SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner. (2 controls)
SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident. (3 controls)
SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service... (12 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident. (12 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
SP-01.04B The policies and instructions are approved by the top management of the cloud service provider or an authorised body. (5 controls)
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID users with VM access should have multifactor authentication enabledAzure subscriptions should have a custom role for administering resource locksAzure subscriptions should restrict use of the 'User Access Administrator' role
Related Frameworks
NIS2 Directive (EU 2022/2555) — 🟢 High overlap (83%)
CIS Azure Benchmark v2.0.0 — 🟢 High overlap (75%)
CIS Azure Benchmark v2.1.0 — 🟢 High overlap (75%)