Azure Compliance FrameworksCommon Frameworks
CIS Azure Benchmark v5.0.0
Controls by Category
2.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet) (1 control)
2.1.10 Ensure 'Allow Public Network Access' is set to 'Disabled' (1 control)
2.1.11 Ensure private endpoints are used to access Azure Databricks workspaces (1 control)
2.1.2 Ensure that network security groups are configured for Databricks subnets (1 control)
2.1.7 Ensure that diagnostic log delivery is configured for Azure Databricks (1 control)
2.1.8 Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK) (4 controls)
Databricks workspaces should have a customer-managed key configuredStorage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryption
2.1.9 Ensure 'No Public IP' is set to 'Enabled' (2 controls)
3.1.1 Ensure only MFA enabled identities can access privileged Virtual Machine (1 control)
5.1.1 Ensure that 'security defaults' is enabled in Microsoft Entra ID (1 control)
5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users (3 controls)
5.12 Ensure that 'User consent for applications' is set to 'Do not allow user consent' (1 control)
5.13 Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions' (1 control)
5.14 Ensure that 'Users can register applications' is set to 'No' (1 control)
5.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (1 control)
5.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' or 'No one in the organization can invite guest users' (1 control)
5.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' (1 control)
5.2.1 Ensure that 'trusted locations' are defined (1 control)
5.2.2 Ensure that an exclusionary geographic Conditional Access policy is considered (1 control)
5.2.4 Ensure that a multifactor authentication policy exists for all users (3 controls)
5.2.6 Ensure that multifactor authentication is required for Windows Azure Service Management API (1 control)
5.2.7 Ensure that multifactor authentication is required to access Microsoft Admin Portals (1 control)
5.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' (1 control)
5.22 Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes' (1 control)
5.23 Ensure that no custom subscription administrator roles exist (2 controls)
5.24 Ensure that a custom role is assigned permissions for administering resource locks (1 control)
5.25 Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one' (1 control)
5.26 Ensure fewer than 5 users have global administrator assignment (1 control)
5.27 Ensure there are between 2 and 3 subscription owners (1 control)
5.3.2 Ensure that guest users are reviewed on a regular basis (2 controls)
5.3.3 Ensure that use of the 'User Access Administrator' role is restricted (1 control)
5.3.5 Ensure disabled user accounts do not have read, write, or owner permissions (1 control)
5.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes' (1 control)
5.6 Ensure that account 'Lockout threshold' is less than or equal to '10' (1 control)
5.7 Ensure that account 'Lockout duration in seconds' is greater than or equal to '60' (1 control)
5.8 Ensure that a 'Custom banned password list' is set to 'Enforce' (1 control)
6.1.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs (1 control)
6.1.1.2 Ensure Diagnostic Setting captures appropriate categories (2 controls)
6.1.1.3 Ensure the storage account containing the container with activity logs is encrypted with customer-managed key (CMK) (1 control)
6.1.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (1 control)
6.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics (2 controls)
6.1.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled (1 control)
6.1.1.7 Ensure that virtual network flow logs are captured and sent to Log Analytics (1 control)
6.1.1.8 Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Graph activity logs to an appropriate destination (1 control)
6.1.1.9 Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Entra activity logs to an appropriate destination (1 control)
6.1.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)
6.1.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (1 control)
6.1.2.11 Ensure that an Activity Log Alert exists for Service Health (1 control)
6.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)
6.1.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)
6.1.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)
6.1.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)
6.1.2.6 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)
6.1.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule (1 control)
6.1.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (1 control)
6.1.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (1 control)
6.1.3.1 Ensure Application Insights are Configured (1 control)
6.1.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it (1 control)
6.2 Ensure that Resource Locks are set for Mission-Critical Azure Resources (1 control)
7.1 Ensure that RDP access from the Internet is evaluated and restricted (1 control)
7.10 Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway (1 control)
7.11 Ensure subnets are associated with network security groups (1 control)
7.12 Ensure the SSL policy's 'Min protocol version' is set to 'TLSv1_2' or higher on Azure Application Gateway (1 control)
7.13 Ensure 'HTTP2' is set to 'Enabled' on Azure Application Gateway (1 control)
7.14 Ensure request body inspection is enabled in Azure Web Application Firewall policy on Azure Application Gateway (1 control)
7.15 Ensure bot protection is enabled in Azure Web Application Firewall policy on Azure Application Gateway (1 control)
7.2 Ensure that SSH access from the Internet is evaluated and restricted (1 control)
7.3 Ensure that UDP access from the Internet is evaluated and restricted (1 control)
7.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted (2 controls)
7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90 (2 controls)
7.6 Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use (1 control)
7.7 Ensure that Public IP addresses are Evaluated on a Periodic Basis (1 control)
7.8 Ensure that virtual network flow log retention days is set to greater than or equal to 90 (1 control)
7.9 Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration (1 control)
8.1.1.1 Ensure Microsoft Defender CSPM is set to 'On' (1 control)
8.1.10 Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates (1 control)
8.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (1 control)
8.1.12 Ensure That 'All users with the following roles' is set to 'Owner' (1 control)
8.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)
8.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled (1 control)
8.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled (1 control)
8.1.2.1 Ensure Microsoft Defender for APIs is set to 'On' (2 controls)
8.1.3.1 Ensure that Defender for Servers is set to 'On' (1 control)
8.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On' (1 control)
8.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On' (2 controls)
8.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On' (2 controls)
8.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On' (1 control)
8.1.6.1 Ensure That Microsoft Defender for App Services Is Set To 'On' (1 control)
8.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (1 control)
8.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (1 control)
8.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' (1 control)
8.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (1 control)
8.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (1 control)
8.1.9.1 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (1 control)
8.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (1 control)
8.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1 control)
8.3.11 Ensure certificate 'Validity Period (in months)' is less than or equal to '12' (1 control)
8.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults (1 control)
8.3.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1 control)
8.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1 control)
8.3.5 Ensure 'Purge protection' is set to 'Enabled' (2 controls)
8.3.6 Ensure that Role Based Access Control for Azure Key Vault is enabled (1 control)
8.3.7 Ensure Public Network Access is Disabled (2 controls)
8.3.8 Ensure Private Endpoints are used to access Azure Key Vault (1 control)
8.3.9 Ensure automatic key rotation is enabled within Azure Key Vault (1 control)
8.4.1 Ensure an Azure Bastion Host Exists (1 control)
8.5 Ensure Azure DDoS Network Protection is enabled on virtual networks (1 control)
9.1.1 Ensure soft delete for Azure File Shares is Enabled (1 control)
9.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares (1 control)
9.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares (1 control)
9.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled (2 controls)
9.2.2 Ensure that soft delete for containers on Azure Blob Storage storage accounts is Enabled (1 control)
9.2.3 Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts (1 control)
9.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account (2 controls)
9.3.1.2 Ensure that Storage Account access keys are periodically regenerated (2 controls)
9.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled' (1 control)
9.3.11 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts (1 control)
9.3.2.1 Ensure Private Endpoints are used to access Storage Accounts (1 control)
9.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts (2 controls)
9.3.2.3 Ensure default network access rule for storage accounts is set to deny (3 controls)
9.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled' (1 control)
9.3.4 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)
9.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access (1 control)
9.3.6 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2' (1 control)
9.3.7 Ensure 'Cross Tenant Replication' is not enabled (1 control)
9.3.8 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled' (1 control)
Related Frameworks
CIS Azure Benchmark v4.0.0 — 🟢 High overlap (80%)
CIS Azure Benchmark v3.0.0 — 🟢 High overlap (68%)
CIS Azure Benchmark v2.1.0 — 🟢 High overlap (67%)