Azure Compliance FrameworksSpecialized Frameworks
CIS Azure Benchmark v1.4.0
The CIS Microsoft Azure Foundations Benchmark is published by the Center for Internet Security. It provides prescriptive guidance for establishing a secure baseline configuration for Azure. It is for customers who plan to develop, deploy, assess, or secure solutions that incorporate Azure. Version 1.4.0 is organized into compliance domains and controls, including Identity and Access Management, Microsoft Defender for Cloud, and Storage Accounts.
Controls by Category
1.20 Ensure that no custom subscription owner roles are created (1 control)
1.3 Ensure guest users are reviewed on a monthly basis (1 control)
2.1 Ensure that Microsoft Defender for Servers is set to 'On' (1 control)
2.10 Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is Selected (1 control)
2.11 Ensure That Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (1 control)
2.12 Ensure Any of the ASC Default Policy Setting is Not Set to 'Disabled' (1 control)
2.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)
2.14 Ensure that 'Notify about alerts with the following severity' is set to 'High' (1 control)
2.15 Ensure that 'All users with the following roles' is set to 'Owner' (1 control)
2.2 Ensure that Microsoft Defender for App Service is set to 'On' (1 control)
2.3 Ensure that Microsoft Defender for Azure SQL Databases is set to 'On' (1 control)
2.4 Ensure that Microsoft Defender for SQL servers on machines is set to 'On' (1 control)
2.5 Ensure that Microsoft Defender for Storage is set to 'On' (1 control)
2.6 Ensure that Microsoft Defender for Kubernetes is set to 'On' (1 control)
2.7 Ensure that Microsoft Defender for Container Registries is set to 'On' (1 control)
2.8 Ensure that Microsoft Defender for Key Vault is set to 'On' (1 control)
2.9 Ensure that Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected (1 control)
3.1 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)
3.10 Ensure Storage logging is enabled for Blob service for 'Read', 'Write', and 'Delete' requests (1 control)
3.11 Ensure Storage logging is enabled for Table service for 'Read', 'Write', and 'Delete' requests (1 control)
3.12 Ensure the 'Minimum TLS version' is set to 'Version 1.2' (1 control)
3.3 Ensure Storage logging is enabled for Queue service for 'Read', 'Write', and 'Delete' requests (1 control)
3.5 Ensure that 'Public access level' is set to Private for blob containers (1 control)
3.6 Ensure default network access rule for Storage Accounts is set to deny (1 control)
3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access (1 control)
3.8 Ensure soft delete is enabled for Azure Storage (1 control)
3.9 Ensure storage for critical data are encrypted with Customer Managed Key (1 control)
4.1.1 Ensure that 'Auditing' is set to 'On' (1 control)
4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database (1 control)
4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days' (1 control)
4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled' (1 control)
4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account (1 control)
4.2.3 Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server (1 control)
4.2.4 Ensure that VA setting 'Send scan reports to' is configured for a SQL server (1 control)
4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL server (1 control)
4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (1 control)
4.3.2 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (1 control)
4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server (1 control)
4.3.4 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server (1 control)
4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server (1 control)
4.3.6 Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (1 control)
4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' (1 control)
4.4.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server (1 control)
4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server (1 control)
4.5 Ensure that Azure Active Directory Admin is configured (1 control)
4.6 Ensure SQL server's TDE protector is encrypted with Customer-managed key (1 control)
5.1.2 Ensure Diagnostic Setting captures appropriate categories (1 control)
5.1.3 Ensure the storage container storing the activity logs is not publicly accessible (1 control)
5.1.4 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key) (1 control)
5.1.5 Ensure that logging for Azure KeyVault is 'Enabled' (1 control)
5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)
5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)
5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)
5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)
5.2.5 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule (1 control)
5.2.6 Ensure that Activity Log Alert exists for Delete Network Security Group Rule (1 control)
5.2.7 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)
5.2.8 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)
5.2.9 Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule (1 control)
6.1 Ensure that RDP access is restricted from the internet (1 control)
6.2 Ensure that SSH access is restricted from the internet (1 control)
6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP) (1 control)
6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (1 control)
6.5 Ensure that Network Watcher is 'Enabled' (1 control)
6.6 Ensure that UDP Services are restricted from the Internet (1 control)
7.1 Ensure Virtual Machines are utilizing Managed Disks (1 control)
7.2 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) (1 control)
7.3 Ensure that 'Unattached disks' are encrypted with CMK (1 control)
8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1 control)
8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults (1 control)
8.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1 control)
8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1 control)
8.6 Ensure the key vault is recoverable (1 control)
8.7 Enable role-based access control (RBAC) within Azure Kubernetes Services (1 control)
9.1 Ensure App Service Authentication is set up for apps in Azure App Service (1 control)
9.10 Ensure FTP deployments are disabled (1 control)
9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service (1 control)
9.3 Ensure web app is using the latest version of TLS encryption (1 control)
9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' (1 control)
9.5 Ensure that Register with Azure Active Directory is enabled on App Service (1 control)
9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app (1 control)
Related Frameworks
CIS Azure Benchmark v1.3.0 — 🟢 High overlap (91%)
CIS Azure Benchmark v1.5.0 — 🟢 High overlap (90%)
CIS Azure Benchmark v2.0.0 — 🟢 High overlap (88%)