Azure Compliance FrameworksCommon Frameworks
CIS Azure Benchmark v4.0.0
Controls by Category
10.1.1 Ensure soft delete for Azure File Shares is Enabled (1 control)
10.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares (1 control)
10.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares (1 control)
10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled (2 controls)
10.2.2 Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts (1 control)
10.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account (2 controls)
10.3.1.2 Ensure that Storage Account access keys are periodically regenerated (1 control)
10.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled' (1 control)
10.3.12 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts (1 control)
10.3.2.1 Ensure Private Endpoints are used to access Storage Accounts (1 control)
10.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts (2 controls)
10.3.2.3 Ensure default network access rule for storage accounts is set to deny (3 controls)
10.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled' (1 control)
10.3.4 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)
10.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access (1 control)
10.3.6 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage (2 controls)
10.3.7 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2' (1 control)
10.3.8 Ensure 'Cross Tenant Replication' is not enabled (1 control)
10.3.9 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled' (1 control)
2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK) (20 controls)
Batch accounts should use customer-managed keys to encrypt dataCognitive Services accounts should use customer-managed keys to encrypt dataOS and data disks should use customer-managed keys for encryptionContainer Instance container groups should use customer-managed keys for encryptionContainer registries should use customer-managed keys for encryptionAzure Cosmos DB accounts should use customer-managed keys to encrypt data at restDatabricks workspaces should have a customer-managed key configuredEvent Hub namespaces should use a customer-managed key for encryptionAzure HDInsight clusters should use customer-managed keys to encrypt data at restAzure API for FHIR should use a customer-managed key to encrypt data at restHPC Cache accounts should use customer-managed keys for encryptionAzure Data Explorer clusters should use customer-managed keys for encryption at restAzure Machine Learning workspaces should use customer-managed keys for encryptionStorage accounts containing operational log containers should use customer-managed keys for encryptionMySQL servers should use customer-managed keys to encrypt data at restService Bus Premium namespaces should use a customer-managed key for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionAzure Synapse workspaces should use customer-managed keys to encrypt data at rest
2.2.1.1 Ensure public network access is Disabled (10 controls)
Cognitive Services accounts should have public network access disabledContainer registries should have public network access disabledData factories should have public network access disabledKey vaults should have public network access disabledMariaDB servers should have public network access disabledMySQL servers should have public network access disabledPostgreSQL servers should have public network access disabledAzure Cognitive Search services should have public network access disabledAzure SQL databases should have public network access disabledStorage accounts should have public network access disabled
2.2.1.2 Ensure Network Access Rules are set to Deny-by-default (7 controls)
Cognitive Services accounts should have network access restrictions configuredManaged disks should not have 'Disk Network Access' set to 'Enable public access from all networks'Container registries should not allow unrestricted network accessService Bus namespaces should not allow overly permissive network accessStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network access
2.2.2.1 Ensure Private Endpoints are used to access {service} (24 controls)
App Configuration should use private linkCognitive Services should use private linkDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledRecovery Services vaults should use private linkAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet) (1 control)
3.1.2 Ensure that network security groups are configured for Databricks subnets (1 control)
3.1.7 Ensure that diagnostic log delivery is configured for Azure Databricks (1 control)
3.1.8 Ensure that data at rest and in transit is encrypted in Azure Databricks using customer managed keys (CMK) (1 control)
4.1.1 Ensure only MFA enabled identities can access privileged Virtual Machine (1 control)
6.1.1 Ensure that 'security defaults' is enabled in Microsoft Entra ID (1 control)
6.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users (2 controls)
6.12 Ensure that 'User consent for applications' is set to 'Do not allow user consent' (1 control)
6.13 Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions' (1 control)
6.14 Ensure that 'Users can register applications' is set to 'No' (1 control)
6.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (1 control)
6.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' (1 control)
6.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' (1 control)
6.2.1 Ensure that 'trusted locations' are defined (1 control)
6.2.6 Ensure that multifactor authentication is required for Windows Azure Service Management API (2 controls)
6.2.7 Ensure that multifactor authentication is required to access Microsoft Admin Portals (1 control)
6.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' (1 control)
6.23 Ensure that no custom subscription administrator roles exist (2 controls)
6.24 Ensure that a custom role is assigned permissions for administering resource locks (1 control)
6.26 Ensure fewer than 5 users have global administrator assignment (1 control)
6.3.2 Ensure that guest users are reviewed on a regular basis (1 control)
6.3.3 Ensure that use of the 'User Access Administrator' role is restricted (1 control)
6.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes' (1 control)
7.1.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs (1 control)
7.1.1.2 Ensure Diagnostic Setting captures appropriate categories (2 controls)
7.1.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK) (1 control)
7.1.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (1 control)
7.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics (2 controls)
7.1.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled (1 control)
7.1.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)
7.1.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (1 control)
7.1.2.11 Ensure that an Activity Log Alert exists for Service Health (1 control)
7.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)
7.1.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)
7.1.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)
7.1.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)
7.1.2.6 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)
7.1.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule (1 control)
7.1.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (1 control)
7.1.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (1 control)
7.1.3.1 Ensure Application Insights are Configured (1 control)
8.1 Ensure that RDP access from the Internet is evaluated and restricted (1 control)
8.2 Ensure that SSH access from the Internet is evaluated and restricted (1 control)
8.3 Ensure that UDP access from the Internet is evaluated and restricted (1 control)
8.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted (2 controls)
8.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (2 controls)
8.6 Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use (1 control)
8.8 Ensure that virtual network flow log retention days is set to greater than or equal to 90 (1 control)
9.1.10 Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates (1 control)
9.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (1 control)
9.1.12 Ensure That 'All users with the following roles' is set to 'Owner' (1 control)
9.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)
9.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled (1 control)
9.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled (1 control)
9.1.17 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On' (1 control)
9.1.3.1 Ensure that Defender for Servers is set to 'On' (1 control)
9.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On' (1 control)
9.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On' (1 control)
9.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On' (2 controls)
9.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On' (1 control)
9.1.6.1 Ensure That Microsoft Defender for App Services Is Set To 'On' (1 control)
9.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (1 control)
9.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (1 control)
9.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' (1 control)
9.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (1 control)
9.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (1 control)
9.1.9.1 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (1 control)
9.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (1 control)
9.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1 control)
9.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults. (1 control)
9.3.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1 control)
9.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1 control)
9.3.5 Ensure the Key Vault is Recoverable (3 controls)
9.3.6 Ensure that Role Based Access Control for Azure Key Vault is enabled (1 control)
9.3.7 Ensure that Public Network Access when using Private Endpoint is disabled (1 control)
9.3.8 Ensure that Private Endpoints are Used for Azure Key Vault (1 control)
9.3.9 Ensure automatic key rotation is enabled within Azure Key Vault (1 control)
9.4.1 Ensure an Azure Bastion Host Exists (1 control)
Related Frameworks
CIS Azure Benchmark v5.0.0 — 🟢 High overlap (66%)
CIS Azure Benchmark v3.0.0 — 🟢 High overlap (61%)
CIS Azure Benchmark v2.1.0 — 🟡 Medium overlap (59%)