Azure Compliance FrameworksSpecialized Frameworks
CIS Azure Benchmark v3.0.0
Controls by Category
2.1.1 Ensure Security Defaults is enabled on Microsoft Entra ID (1 control)
2.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users (1 control)
2.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users (1 control)
2.12 Ensure `User consent for applications` is set to `Do not allow user consent` (1 control)
2.13 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers' (1 control)
2.14 Ensure That 'Users Can Register Applications' Is Set to 'No' (1 control)
2.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (1 control)
2.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' (1 control)
2.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' (1 control)
2.2.1 Ensure Trusted Locations Are Defined (1 control)
2.2.7 Ensure Multi-factor Authentication is Required for Windows Azure Service Management API (1 control)
2.2.7 Ensure Multifactor Authentication is Required for Windows Azure Service Management API (1 control)
2.2.8 Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals (1 control)
2.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' (1 control)
2.23 Ensure That No Custom Subscription Administrator Roles Exist (2 controls)
2.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks (1 control)
2.26 Ensure fewer than 5 users have global administrator assignment (1 control)
2.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes' (1 control)
2.4 Ensure Guest Users Are Reviewed on a Regular Basis (1 control)
3.1.1.1 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (1 control)
3.1.1.2 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected (1 control)
3.1.10 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' (1 control)
3.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (1 control)
3.1.12 Ensure That 'All users with the following roles' is set to 'Owner' (1 control)
3.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)
3.1.14 Ensure That 'Notify about alerts with the following severity' is Set to 'High' (1 control)
3.1.16 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On' (1 control)
3.1.3.1 Ensure That Microsoft Defender for Servers Is Set to 'On' (1 control)
3.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On' (1 control)
3.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On' (1 control)
3.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On' (2 controls)
3.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On' (1 control)
3.1.6.1 Ensure That Microsoft Defender for App Services Is Set To 'On' (1 control)
3.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (1 control)
3.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (1 control)
3.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' (1 control)
3.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (1 control)
3.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (1 control)
3.1.9.1 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (1 control)
3.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (1 control)
3.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1 control)
3.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults. (1 control)
3.3.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1 control)
3.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1 control)
3.3.5 Ensure the Key Vault is Recoverable (3 controls)
3.3.6 Enable Role Based Access Control for Azure Key Vault (1 control)
3.3.7 Ensure that Private Endpoints are Used for Azure Key Vault (1 control)
3.3.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services (1 control)
4.1 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)
4.10 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage (2 controls)
4.11 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK) (3 controls)
4.12 Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests (1 control)
4.13 Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests (1 control)
4.14 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests (1 control)
4.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2' (1 control)
4.16 Ensure 'Cross Tenant Replication' is not enabled (1 control)
4.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled` (1 control)
4.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled' (1 control)
4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account (2 controls)
4.4 Ensure that Storage Account Access Keys are Periodically Regenerated (1 control)
4.6 Ensure that 'Public Network Access' is `Disabled' for storage accounts (1 control)
4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny (3 controls)
4.8 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access (1 control)
4.9 Ensure Private Endpoints are used to access Storage Accounts (1 control)
5.1.1 Ensure that 'Auditing' is set to 'On' (1 control)
5.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) (1 control)
5.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key (1 control)
5.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers (2 controls)
5.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database (2 controls)
5.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days' (3 controls)
5.1.7 Ensure Public Network Access is Disabled (1 control)
5.2.1 Ensure server parameter 'require_secure_transport' is set to 'ON' for PostgreSQL flexible server (1 control)
5.2.2 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL flexible server (1 control)
5.2.3 Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL flexible server (1 control)
5.2.4 Ensure server parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL flexible server (1 control)
5.2.5 Ensure 'Allow public access from any Azure service within Azure to this server' for PostgreSQL flexible server is disabled (1 control)
5.2.6 [LEGACY] Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL single server (1 control)
5.2.6 [LEGACY]Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL single Server (1 control)
5.2.7 [LEGACY] Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL single server (1 control)
5.2.7 [LEGACY]Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL single Server (1 control)
5.2.8 [LEGACY]Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' (1 control)
5.3.1 Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL flexible server (2 controls)
5.3.2 Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server (1 control)
5.3.3 Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL flexible server (1 control)
5.3.4 Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL flexible server (1 control)
5.4.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks (2 controls)
5.4.2 Ensure That Private Endpoints Are Used Where Possible (1 control)
5.4.3 Use Entra ID Client Authentication and Azure RBAC where possible (1 control)
6.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs (1 control)
6.1.2 Ensure Diagnostic Setting captures appropriate categories (2 controls)
6.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (1 control)
6.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (1 control)
6.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics (2 controls)
6.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled (1 control)
6.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)
6.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (1 control)
6.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)
6.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)
6.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)
6.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)
6.2.6 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)
6.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule (1 control)
6.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (1 control)
6.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (1 control)
6.3.1 Ensure Application Insights are Configured (1 control)
6.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads) (4 controls)
7.1 Ensure that RDP access from the Internet is evaluated and restricted (1 control)
7.2 Ensure that SSH access from the Internet is evaluated and restricted (1 control)
7.3 Ensure that UDP access from the Internet is evaluated and restricted (1 control)
7.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted (2 controls)
7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (2 controls)
7.6 Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use (1 control)
8.1 Ensure an Azure Bastion Host Exists (1 control)
8.10 Ensure only MFA enabled identities can access privileged Virtual Machine (1 control)
8.11 Ensure Trusted Launch is enabled on Virtual Machines (1 control)
8.2 Ensure Virtual Machines are utilizing Managed Disks (2 controls)
8.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) (1 control)
8.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) (2 controls)
8.5 Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks' (1 control)
8.6 Ensure that 'Enable Data Access Authentication Mode' is 'Checked' (1 control)
8.8 Ensure that Endpoint Protection for all Virtual Machines is installed (1 control)
9.1 Ensure 'HTTPS Only' is set to `On` (2 controls)
9.10 Ensure that 'HTTP20enabled' is set to 'true' (if in use) (1 control)
9.12 Ensure that 'Remote debugging' is set to 'Off' (1 control)
9.2 Ensure App Service Authentication is set up for apps in Azure App Service (1 control)
9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled' (3 controls)
9.4 Ensure Web App is using the latest version of TLS encryption (2 controls)
9.5 Ensure that Register with Entra ID is enabled on App Service (2 controls)
9.7 Ensure that 'PHP version' is currently supported (if in use) (1 control)
9.8 Ensure that 'Python version' is currently supported (if in use) (1 control)
9.9 Ensure that 'Java version' is currently supported (if in use) (1 control)
Related Frameworks
CIS Azure Benchmark v2.1.0 — 🟢 High overlap (96%)
CIS Azure Benchmark v2.0.0 — 🟢 High overlap (92%)
NIS2 Directive (EU 2022/2555) — 🟢 High overlap (72%)