Azure Compliance FrameworksSpecialized Frameworks
FedRAMP High
The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach for assessing, monitoring, and authorizing cloud computing products and services. FedRAMP is based on the NIST SP 800-53 standard, augmented by FedRAMP controls and control enhancements. FedRAMP High is the highest of three impact levels, and the FedRAMP High baseline has 421 controls.
| Mandatory? | FedRAMP is mandatory for federal agency cloud deployments and service models at the low, moderate, and high-risk impact levels |
| Who validates? | Independent third-party assessment organization (3PAO) accredited by the program, plus technical review by the FedRAMP PMO |
| Renewal | |
| Scope | Cloud service providers and cloud services used by US federal agencies |
🏛 The FedRAMP.gov site is an official website of the GSA's Technology Transformation Services. Official source →
Controls by Category
AC-17 Remote Access (33 controls)
App Configuration should use private linkApp Service apps should have remote debugging disabledFunction apps should have remote debugging disabledCognitive Services should use private linkDisk access resources should use private linkLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
AC-17(1) Automated Monitoring / Control (33 controls)
App Configuration should use private linkApp Service apps should have remote debugging disabledFunction apps should have remote debugging disabledCognitive Services should use private linkDisk access resources should use private linkLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
AC-2 Account Management (11 controls)
Function apps should use managed identityApp Service apps should use managed identityAzure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedAzure subscriptions should limit owners to 3Service Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
AC-2(1) Automated System Account Management (2 controls)
AC-2(12) Account Monitoring (9 controls)
Virtual machines should use just-in-time network access control for management portsAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabled
AC-2(7) Role-Based Schemes (2 controls)
AC-3 Access Enforcement (11 controls)
Function apps should use managed identityApp Service apps should use managed identityLinux machines should require passwords for all accountsLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should require SSH keys for authenticationVirtual machines should use Azure Resource Manager resourcesService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configuredStorage accounts should use Azure Resource Manager resources
AC-4 Information Flow Enforcement (44 controls)
API Management services should use a virtual networkApp Configuration should use private linkApp Service apps should not allow CORS access from every resourceCognitive Services should use private linkDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
AC-5 Separation Of Duties (1 control)
AC-6 Least Privilege (2 controls)
AC-6(7) Review Of User Privileges (2 controls)
AU-12 Audit Generation (30 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
AU-12(1) System-Wide / Time-Correlated Audit Trail (30 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
AU-6 Audit Record Review, Analysis And Reporting (11 controls)
Linux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedAzure subscriptions should have Network Watcher enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
AU-6(4) Central Review And Analysis (30 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
AU-6(5) Integration / Scanning And Monitoring Capabilities (30 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
CM-6 Configuration Settings (9 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service apps should not allow CORS access from every resourceApp Service apps should have remote debugging disabledFunction apps should have 'Client Certificates (Incoming client certificates)' enabledFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledLinux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfiedAKS clusters should have the Azure Policy Add-on installed and enabled
CM-7 Least Functionality (1 control)
CP-6 Alternate Storage Sites (5 controls)
CP-6(1) Separation From Primary Site (5 controls)
CP-7 Alternate Processing Site (1 control)
CP-9 System Backup (5 controls)
IA-2 Identification and Authentication (Organizational users) (4 controls)
IA-4 Identifier Management (4 controls)
IA-5 Authenticator Management (8 controls)
Linux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should not store passwords using reversible encryptionLinux machines should require SSH keys for authenticationKey Vault keys should have an expiration dateKey Vault secrets should have an expiration date
IA-5(1) Password-Based Authentication (6 controls)
Linux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should have the password complexity setting enabledWindows machines should not store passwords using reversible encryption
IR-4 Incident Handling (11 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
IR-5 Incident Monitoring (11 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
RA-5 Vulnerability Scanning (13 controls)
Virtual machines should have a vulnerability assessment solution enabledSQL managed instances should have vulnerability assessment enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledSynapse workspaces should have vulnerability assessment enabled
SC-12 Cryptographic Key Establishment And Management (22 controls)
Batch accounts should use customer-managed keys to encrypt dataCognitive Services accounts should use customer-managed keys to encrypt dataOS and data disks should use customer-managed keys for encryptionManaged disks should use both platform-managed and customer-managed keys for double encryptionContainer registries should use customer-managed keys for encryptionAzure Cosmos DB accounts should use customer-managed keys to encrypt data at restEvent Hub namespaces should use a customer-managed key for encryptionAzure HDInsight clusters should use customer-managed keys to encrypt data at restAzure HDInsight clusters should use encryption at host to encrypt data at restAzure API for FHIR should use a customer-managed key to encrypt data at restHPC Cache accounts should use customer-managed keys for encryptionAKS clusters should use customer-managed keys to encrypt both OS and data disksAzure Data Explorer clusters should use customer-managed keys for encryption at restAzure Machine Learning workspaces should use customer-managed keys for encryptionSQL managed instances should use customer-managed keys to encrypt data at restMySQL servers should use customer-managed keys to encrypt data at restPostgreSQL servers should use customer-managed keys to encrypt data at restService Bus Premium namespaces should use a customer-managed key for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts should use customer-managed key for encryptionStorage account encryption scopes should use customer-managed keys to encrypt data at restAzure Synapse workspaces should use customer-managed keys to encrypt data at rest
SC-28 Protection Of Information At Rest (12 controls)
App Service environments should have internal encryption enabledAutomation account variables should have encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have Transparent Data Encryption enabledStorage accounts should have infrastructure encryption enabled
SC-28(1) Cryptographic Protection (12 controls)
App Service environments should have internal encryption enabledAutomation account variables should have encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have Transparent Data Encryption enabledStorage accounts should have infrastructure encryption enabled
SC-3 Security Function Isolation (2 controls)
SC-5 Denial Of Service Protection (3 controls)
SC-7 Boundary Protection (45 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
SC-7(3) Access Points (45 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
SC-8 Transmission Confidentiality And Integrity (10 controls)
App Service API apps should require FTPS onlyApp Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled
SC-8(1) Cryptographic Or Alternate Physical Protection (10 controls)
App Service API apps should require FTPS onlyApp Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled
SI-16 Memory Protection (2 controls)
SI-2 Flaw Remediation (13 controls)
Function apps should use the latest 'HTTP Version' when used to run the appApp Service web apps should use the latest 'HTTP Version' when used to run the appVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledKubernetes clusters should use a non-vulnerable Kubernetes versionAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolved
SI-3 Malicious Code Protection (2 controls)
SI-3(1) Central Management (2 controls)
SI-4 Information System Monitoring (18 controls)
Linux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringAzure subscriptions should have Network Watcher enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
Related Frameworks
NIST SP 800-53 Rev 5 — 🟢 High overlap (99%)
NIST SP 800-171 Rev 2 — 🟢 High overlap (96%)
FedRAMP Moderate Baseline Rev 4 — 🟢 High overlap (68%)