CIS Azure Benchmark v1.3.0

The CIS Microsoft Azure Foundations Benchmark is published by the Center for Internet Security. It provides prescriptive guidance for establishing a secure baseline configuration for Azure. It is for customers who plan to develop, deploy, assess, or secure solutions that incorporate Azure. This entry covers version 1.3.0.

Controls by Category

2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected (1 control)

Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected

2.11 Ensure that 'Automatic provisioning of monitoring agent' is set to 'On' (1 control)

Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

2.12 Ensure any of the ASC Default policy setting is not set to \"Disabled\" (1 control)

ASC Default policy settings should not have any setting set to 'Disabled'

2.13 Ensure 'Additional email addresses' is configured with a security contact email (1 control)

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email

2.14 Ensure that 'Notify about alerts with the following severity' is set to 'High' (1 control)

Azure subscriptions should have email notifications for high severity alerts enabled

2.15 Ensure that 'All users with the following roles' is set to 'Owner' (1 control)

Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

2.2 Ensure that Azure Defender is set to On for App Service (1 control)

Azure subscriptions should have Microsoft Defender for App Service enabled

2.3 Ensure that Azure Defender is set to On for Azure SQL database servers (1 control)

Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled

2.4 Ensure that Azure Defender is set to On for SQL servers on machines (1 control)

Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled

2.5 Ensure that Azure Defender is set to On for Storage (1 control)

Azure subscriptions should have Microsoft Defender for Storage enabled

2.6 Ensure that Azure Defender is set to On for Kubernetes (1 control)

Azure subscriptions should have Microsoft Defender for Kubernetes enabled

2.7 Ensure that Azure Defender is set to On for Container Registries (1 control)

Azure subscriptions should have Microsoft Defender for container registries enabled

2.8 Ensure that Azure Defender is set to On for Key Vault (1 control)

Azure subscriptions should have Microsoft Defender for Key Vault enabled

2.9 Ensure that Windows Defender ATP (WDATP) integration with Security Center is selected (1 control)

Security Center should have Windows Defender ATP (WDATP) integration selected

3.1 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)

Storage accounts should have secure transfer enabled

3.10 Ensure Storage logging is enabled for Blob service for read, write, and delete requests (1 control)

Storage account Blob services should have classic logging enabled

3.11 Ensure Storage logging is enabled for Table service for read, write, and delete requests (1 control)

Storage account Table services should have classic logging enabled

3.3 Ensure Storage logging is enabled for Queue service for read, write, and delete requests (1 control)

Storage account Queue services should have classic logging enabled

3.5 Ensure that 'Public access level' is set to Private for blob containers (1 control)

Blob containers should have 'Public access level' set to 'Private'

3.6 Ensure default network access rule for Storage Accounts is set to deny (1 control)

Storage accounts should have network access restrictions configured

3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access (1 control)

Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled

3.8 Ensure soft delete is enabled for Azure Storage (1 control)

Storage accounts should have soft delete enabled

3.9 Ensure storage for critical data are encrypted with Customer Managed Key (1 control)

Storage accounts should use customer-managed key for encryption

4.1.1 Ensure that 'Auditing' is set to 'On' (1 control)

SQL servers should have auditing enabled

4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database (1 control)

SQL databases should have transparent data encryption enabled

4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days' (1 control)

SQL servers should have 'Auditing' retention set to greater than 90 days

4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled' (1 control)

Critical SQL servers should have Microsoft Defender for SQL set to 'On'

4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account (1 control)

SQL servers should have vulnerability assessment enabled

4.2.3 Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server (1 control)

SQL servers should have VA 'Periodic Recurring Scans' enabled

4.2.4 Ensure that VA setting Send scan reports to is configured for a SQL server (1 control)

SQL servers should have VA 'Send scan reports to' configured

4.2.5 Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server (1 control)

SQL servers should each have VA 'Also send email notifications to admins and subscription owners' configured

4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (1 control)

PostgreSQL servers should have 'Enforce SSL connection' enabled

4.3.2 Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server (1 control)

MySQL servers should have 'Enforce SSL connection' enabled

4.3.3 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (1 control)

PostgreSQL servers should have 'log_checkpoints' set to 'ON'

4.3.4 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server (1 control)

PostgreSQL servers should have 'log_connections' set to 'ON'

4.3.5 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server (1 control)

PostgreSQL servers should have 'log_disconnections' set to 'ON'

4.3.6 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server (1 control)

PostgreSQL servers should have 'connection_throttling' set to 'ON'

4.3.7 Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (1 control)

PostgreSQL servers should have 'log_retention_days' set to greater than 3 days

4.4 Ensure that Azure Active Directory Admin is configured (1 control)

SQL servers should have a Microsoft Entra ID admin configured

4.5 Ensure SQL server's TDE protector is encrypted with Customer-managed key (1 control)

SQL servers should use customer-managed keys to encrypt data at rest

5.1.2 Ensure Diagnostic Setting captures appropriate categories (1 control)

Azure Monitor diagnostic settings should have appropriate log categories configured

5.1.3 Ensure the storage container storing the activity logs is not publicly accessible (1 control)

Storage containers storing operational logs should prohibit public access

5.1.4 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key) (1 control)

Storage accounts containing operational log containers should use customer-managed keys for encryption

5.1.5 Ensure that logging for Azure KeyVault is 'Enabled' (1 control)

Key vaults should have resource logs enabled

5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create Policy Assignment

5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group

5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group

5.2.5 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group Rule

5.2.6 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group Rule

5.2.7 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution

5.2.8 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Security Solution

5.2.9 Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create, Update, or Delete SQL Server Firewall Rule

6.1 Ensure that RDP access is restricted from the internet (1 control)

Network security groups should have RDP access restrictions configured

6.2 Ensure that SSH access is restricted from the internet (1 control)

Network security groups should have SSH access from the internet restricted

6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP) (1 control)

SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)

6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (1 control)

Network security group flow logs should have retention set to greater than 90 days

6.5 Ensure that Network Watcher is 'Enabled' (1 control)

Azure subscriptions should have Network Watcher enabled

6.6 Ensure that UDP Services are restricted from the Internet (1 control)

Network security groups should have UDP services restricted from the internet

7.1 Ensure Virtual Machines are utilizing Managed Disks (1 control)

Virtual machines should use managed disks

7.2 Ensure that 'OS and Data' disks are encrypted with CMK (1 control)

OS and data disks should use customer-managed keys for encryption

7.3 Ensure that 'Unattached disks' are encrypted with CMK (1 control)

Unattached managed disks should use customer-managed keys (CMK) for encryption

8.1 Ensure that the expiration date is set on all keys (1 control)

Key Vault keys should have an expiration date

8.2 Ensure that the expiration date is set on all Secrets (1 control)

Key Vault secrets should have an expiration date

8.4 Ensure the key vault is recoverable (1 control)

Key vaults should have recoverability configured

8.5 Enable role-based access control (RBAC) within Azure Kubernetes Services (1 control)