Azure Compliance FrameworksSpecialized Frameworks
CMMC 2.0 Level 2
Best for: The page states that 32 CFR Part 170 establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
| Mandatory? | Applies to DoD solicitations and contracts where a contractor will process, store, or transmit FCI or CUI, with requirements phased in over four phases. |
| Who validates? | Self-assessment by the organization (Level 2 (Self)) or a CMMC Third-Party Assessment Organization (C3PAO) (Level 2 (C3PAO)) |
| Renewal |
🏛 Department of Defense (DoD), through the Cybersecurity Maturity Model Certification (CMMC) Program in 32 CFR Part 170 Official source →
Controls by Category
AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems) (40 controls)
App Configuration should use private linkApp Service API apps should use managed identityFunction apps should have remote debugging disabledFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityDisk access resources should use private linkLinux machines should require passwords for all accountsLinux machines should prohibit remote connections from accounts without passwordsLinux machines should require SSH keys for authenticationVirtual machines should use Azure Resource Manager resourcesContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedAzure subscriptions should limit owners to 3Kubernetes clusters should use Role-Based Access Control (RBAC)MariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkService Fabric clusters should use only Azure Active Directory for client authenticationAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use Azure Resource Manager resourcesAzure Synapse workspaces should use private link
AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute (16 controls)
App Service API apps should use managed identityFunction apps should have remote debugging disabledFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityVirtual machines should use Azure Resource Manager resourcesAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedKubernetes clusters should use Role-Based Access Control (RBAC)Service Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should use Azure Resource Manager resources
AC.L2-3.1.12 Monitor and control remote access sessions (22 controls)
App Configuration should use private linkFunction apps should have remote debugging disabledDisk access resources should use private linkLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions (20 controls)
App Configuration should use private linkDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC.L2-3.1.14 Route remote access via managed access control points (20 controls)
App Configuration should use private linkDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations (30 controls)
API Management services should use a virtual networkApp Configuration should use private linkApp Service apps should not allow CORS access from every resourceApp Service apps should not allow CORS access from every resourceCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC.L2-3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion (1 control)
AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts (3 controls)
AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity (19 controls)
App Service apps should have resource logs enabledBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledLogic App workflows should have resource logs enabledSearch services should have resource logs enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'SQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or moreStream Analytics jobs should have resource logs enabled
AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions (19 controls)
App Service apps should have resource logs enabledBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledLogic App workflows should have resource logs enabledSearch services should have resource logs enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'SQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or moreStream Analytics jobs should have resource logs enabled
AU.L2-3.3.4 Alert in the event of an audit logging process failure (2 controls)
AU.L2-3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity (2 controls)
CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles (6 controls)
App Service apps should not allow CORS access from every resourceFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledApp Service apps should not allow CORS access from every resourceLinux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfied
CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems (6 controls)
App Service apps should not allow CORS access from every resourceFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledApp Service apps should not allow CORS access from every resourceLinux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfied
IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices (7 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems (15 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityWindows machines should not store passwords using reversible encryptionLinux machines should require SSH keys for authenticationKey vault certificates should have 'Validity Period (in months)' set to 12 or lessKey Vault keys should have an expiration dateKey Vault secrets should have an expiration dateNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all keysService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IA.L2-3.5.10 Store and transmit only cryptographically-protected passwords (1 control)
IA.L2-3.5.5 Prevent reuse of identifiers for a defined period (7 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IA.L2-3.5.6 Disable identifiers after a defined period of inactivity (7 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created (2 controls)
IA.L2-3.5.8 Prohibit password reuse for a specified number of generations (1 control)
IR.L2-3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization (2 controls)
MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations (7 controls)
Virtual machines should be protected by Azure BackupKey vaults should have deletion protection enabledKey vaults should have soft delete enabledKey vaults should have recoverability configuredMariaDB servers should have geo-redundant backup enabledMySQL servers should have geo-redundant backup enabledPostgreSQL servers should have geo-redundant backup enabled
RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified (4 controls)
RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments (4 controls)
SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems (31 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledNetwork security groups should have flow logs configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks (30 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems (22 controls)
Batch accounts should use customer-managed keys to encrypt dataCognitive Services accounts should use customer-managed keys to encrypt dataOS and data disks should use customer-managed keys for encryptionManaged disks should use both platform-managed and customer-managed keys for double encryptionContainer Instance container groups should use customer-managed keys for encryptionContainer registries should use customer-managed keys for encryptionData factories should use customer-managed keys for encryptionEvent Hub namespaces should use a customer-managed key for encryptionAzure HDInsight clusters should use customer-managed keys to encrypt data at restAzure HDInsight clusters should use encryption at host to encrypt data at restAzure API for FHIR should use a customer-managed key to encrypt data at restHPC Cache accounts should use customer-managed keys for encryptionAKS clusters should use customer-managed keys to encrypt both OS and data disksAzure Data Explorer clusters should use customer-managed keys for encryption at restAzure Machine Learning workspaces should use customer-managed keys for encryptionSQL managed instances should use customer-managed keys to encrypt data at restMySQL servers should use customer-managed keys to encrypt data at restService Bus Premium namespaces should use a customer-managed key for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts should use customer-managed key for encryptionStorage account encryption scopes should use customer-managed keys to encrypt data at restAzure Synapse workspaces should use customer-managed keys to encrypt data at rest
SC.L2-3.13.16 Protect the confidentiality of CUI at rest (10 controls)
Automation account variables should have encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignStorage accounts should have infrastructure encryption enabled
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems (30 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception) (12 controls)
Application gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have network access restrictions configuredCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesAzure Front Door services should have Web Application Firewall (WAF) enabledKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have public network access disabledMySQL servers should have public network access disabledPostgreSQL servers should have public network access disabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network access
SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards (7 controls)
App Service API apps should require FTPS onlyApp Service API apps should require HTTPS for all accessFunction apps should require FTPS onlyApp Service web apps should require FTPSHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabled
SI.L1-3.14.1 Identify, report, and correct system flaws in a timely manner (4 controls)
SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems (4 controls)
Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for AzureWindows Server virtual machines should have the default Microsoft IaaSAntimalware extension installedWindows virtual machines should have Windows Defender Exploit Guard enabledAzure subscriptions should have Microsoft Defender for Storage enabled
SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available (3 controls)
SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed (3 controls)
SI.L2-3.14.3 Monitor system security alerts and advisories and take action in response (3 controls)
SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks (9 controls)
Virtual machines should have the Guest Configuration extension installedVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsNetwork security groups should have flow logs configuredAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'
SI.L2-3.14.7 Identify unauthorized use of organizational systems (6 controls)
Virtual machines should have the Guest Configuration extension installedVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsAzure subscriptions should have Microsoft Defender for Storage enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'
Related Frameworks
FedRAMP Moderate Baseline Rev 4 — 🟢 High overlap (97%)
NIST SP 800-171 Rev 2 — 🟢 High overlap (87%)
NIST SP 800-53 Rev 5 — 🟢 High overlap (87%)