FedRAMP High

ActiveSpecialized framework

Best for: FedRAMP is mandatory for federal agency cloud deployments and service models at the low, moderate, and high-risk impact levels. Companies that employ cloud technologies in products or services used by the federal government may be required to obtain an ATO.

Mandatory?	FedRAMP is mandatory for federal agency cloud deployments and service models at the low, moderate, and high-risk impact levels
Who validates?	Independent third-party assessment organization (3PAO) accredited by the program, plus technical review by the FedRAMP PMO
Renewal
Scope	Cloud service providers and cloud services used by US federal agencies
Governing body	Federal Risk and Authorization Management Program (FedRAMP). Official source

Controls by category

177 controls are Mapped to FedRAMP High.

AC-17 Remote Access

Control	Status
App Configuration should use private link	Mapped
App Service apps should have remote debugging disabled	Mapped
Function apps should have remote debugging disabled	Mapped
Cognitive Services should use private link	Mapped
Disk access resources should use private link	Mapped
Linux virtual machines should have the Linux Guest Configuration extension installed for assignments	Mapped
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Linux machines should prohibit remote connections from accounts without passwords	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Data factories should use private link	Mapped
Azure Event Grid domains should use private link	Mapped
Azure Event Grid topics should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
IoT Hub device provisioning service instances should use private link	Mapped
Azure Key Vaults should use private link	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure Spring Cloud should use network injection	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use private link	Mapped
Azure File Sync should use private link	Mapped
Azure Synapse workspaces should use private link	Mapped

AC-17(1) Automated Monitoring / Control

Control	Status
App Configuration should use private link	Mapped
App Service apps should have remote debugging disabled	Mapped
Function apps should have remote debugging disabled	Mapped
Cognitive Services should use private link	Mapped
Disk access resources should use private link	Mapped
Linux virtual machines should have the Linux Guest Configuration extension installed for assignments	Mapped
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Linux machines should prohibit remote connections from accounts without passwords	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Data factories should use private link	Mapped
Azure Event Grid domains should use private link	Mapped
Azure Event Grid topics should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
IoT Hub device provisioning service instances should use private link	Mapped
Azure Key Vaults should use private link	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure Spring Cloud should use network injection	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use private link	Mapped
Azure File Sync should use private link	Mapped
Azure Synapse workspaces should use private link	Mapped

AC-2 Account Management

Control	Status
Function apps should use managed identity	Mapped
App Service apps should use managed identity	Mapped
Azure subscriptions should not have blocked accounts with read and write permissions	Mapped
Azure subscriptions should not have blocked accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with read permissions	Mapped
Azure subscriptions should not have guest accounts with write permissions	Mapped
Custom RBAC roles should not be used	Mapped
Azure subscriptions should limit owners to 3	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

AC-2(1) Automated System Account Management

Control	Status
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

AC-2(12) Account Monitoring

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

AC-2(7) Role-Based Schemes

Control	Status
Custom RBAC roles should not be used	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

AC-3 Access Enforcement

Control	Status
Function apps should use managed identity	Mapped
App Service apps should use managed identity	Mapped
Linux machines should require passwords for all accounts	Mapped
Linux virtual machines should have the Linux Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Linux machines should require SSH keys for authentication	Mapped
Virtual machines should use Azure Resource Manager resources	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped
Storage accounts should use Azure Resource Manager resources	Mapped

AC-4 Information Flow Enforcement

Control	Status
API Management services should use a virtual network	Mapped
App Configuration should use private link	Mapped
App Service apps should not allow CORS access from every resource	Mapped
Cognitive Services should use private link	Mapped
Disk access resources should use private link	Mapped
Virtual machines should use just-in-time network access control for management ports	Mapped
Virtual machines should have all network ports restricted by their associated network security groups	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Container registries should not allow unrestricted network access	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Data factories should use private link	Mapped
Azure Event Grid domains should use private link	Mapped
Azure Event Grid topics should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
IoT Hub device provisioning service instances should use private link	Mapped
Key vaults should have a firewall enabled	Mapped
Azure Key Vaults should use private link	Mapped
Kubernetes clusters should have authorized IP ranges configured	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
MySQL servers should have public network access disabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
Virtual machines should have management ports closed	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should have public network access disabled	Mapped
Azure Cognitive Search services should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have public network access disabled	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should prohibit public access	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should use private link	Mapped
Azure File Sync should use private link	Mapped
Azure Synapse workspaces should use private link	Mapped

AC-5 Separation Of Duties

Control	Status
Azure subscriptions should have more than one owner	Mapped

AC-6 Least Privilege

Control	Status
Custom RBAC roles should not be used	Mapped
Azure subscriptions should limit owners to 3	Mapped

AC-6(7) Review Of User Privileges

Control	Status
Custom RBAC roles should not be used	Mapped
Azure subscriptions should limit owners to 3	Mapped

AU-12 Audit Generation

Control	Status
App Service apps should have resource logs enabled	Mapped
Linux Azure Arc machines should have the Log Analytics extension installed	Mapped
Windows Azure Arc machines should have the Log Analytics extension installed	Mapped
Batch accounts should have resource logs enabled	Mapped
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Data Lake Analytics accounts should have resource logs enabled	Mapped
Data Lake Store accounts should have resource logs enabled	Mapped
Event Hub namespaces should have resource logs enabled	Mapped
IoT hubs should have resource logs enabled	Mapped
Key vaults should have resource logs enabled	Mapped
Logic App workflows should have resource logs enabled	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Search services should have resource logs enabled	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Service Bus namespaces should have resource logs enabled	Mapped
SQL servers should have auditing enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped
Stream Analytics jobs should have resource logs enabled	Mapped

AU-12(1) System-Wide / Time-Correlated Audit Trail

Control	Status
App Service apps should have resource logs enabled	Mapped
Linux Azure Arc machines should have the Log Analytics extension installed	Mapped
Windows Azure Arc machines should have the Log Analytics extension installed	Mapped
Batch accounts should have resource logs enabled	Mapped
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Data Lake Analytics accounts should have resource logs enabled	Mapped
Data Lake Store accounts should have resource logs enabled	Mapped
Event Hub namespaces should have resource logs enabled	Mapped
IoT hubs should have resource logs enabled	Mapped
Key vaults should have resource logs enabled	Mapped
Logic App workflows should have resource logs enabled	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Search services should have resource logs enabled	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Service Bus namespaces should have resource logs enabled	Mapped
SQL servers should have auditing enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped
Stream Analytics jobs should have resource logs enabled	Mapped

AU-6 Audit Record Review, Analysis And Reporting

Control	Status
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped

AU-6(4) Central Review And Analysis

Control	Status
App Service apps should have resource logs enabled	Mapped
Linux Azure Arc machines should have the Log Analytics extension installed	Mapped
Windows Azure Arc machines should have the Log Analytics extension installed	Mapped
Batch accounts should have resource logs enabled	Mapped
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Data Lake Analytics accounts should have resource logs enabled	Mapped
Data Lake Store accounts should have resource logs enabled	Mapped
Event Hub namespaces should have resource logs enabled	Mapped
IoT hubs should have resource logs enabled	Mapped
Key vaults should have resource logs enabled	Mapped
Logic App workflows should have resource logs enabled	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Search services should have resource logs enabled	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Service Bus namespaces should have resource logs enabled	Mapped
SQL servers should have auditing enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped
Stream Analytics jobs should have resource logs enabled	Mapped

AU-6(5) Integration / Scanning And Monitoring Capabilities

Control	Status
App Service apps should have resource logs enabled	Mapped
Linux Azure Arc machines should have the Log Analytics extension installed	Mapped
Windows Azure Arc machines should have the Log Analytics extension installed	Mapped
Batch accounts should have resource logs enabled	Mapped
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Data Lake Analytics accounts should have resource logs enabled	Mapped
Data Lake Store accounts should have resource logs enabled	Mapped
Event Hub namespaces should have resource logs enabled	Mapped
IoT hubs should have resource logs enabled	Mapped
Key vaults should have resource logs enabled	Mapped
Logic App workflows should have resource logs enabled	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Search services should have resource logs enabled	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Service Bus namespaces should have resource logs enabled	Mapped
SQL servers should have auditing enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped
Stream Analytics jobs should have resource logs enabled	Mapped

CM-6 Configuration Settings

Control	Status
App Service apps should have Client Certificates (Incoming client certificates) enabled	Mapped
App Service apps should not allow CORS access from every resource	Mapped
App Service apps should have remote debugging disabled	Mapped
Function apps should have 'Client Certificates (Incoming client certificates)' enabled	Mapped
Function apps should not allow CORS access from every resource	Mapped
Function apps should have remote debugging disabled	Mapped
Linux machines should have the Azure compute security baseline requirements satisfied	Mapped
Windows machines should have the Azure compute security baseline requirements satisfied	Mapped
AKS clusters should have the Azure Policy Add-on installed and enabled	Mapped

CM-7 Least Functionality

Control	Status
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped

CP-6 Alternate Storage Sites

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

CP-6(1) Separation From Primary Site

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

CP-7 Alternate Processing Site

Control	Status
Virtual machines should have disaster recovery configured	Mapped

CP-9 System Backup

Control	Status
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped

IA-2 Identification and Authentication (Organizational users)

Control	Status
Function apps should use managed identity	Mapped
App Service apps should use managed identity	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

IA-4 Identifier Management

Control	Status
Function apps should use managed identity	Mapped
App Service apps should use managed identity	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

IA-5 Authenticator Management

Control	Status
Linux virtual machines should have the Linux Guest Configuration extension installed for assignments	Mapped
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Windows machines should not store passwords using reversible encryption	Mapped
Linux machines should require SSH keys for authentication	Mapped
Key Vault keys should have an expiration date	Mapped
Key Vault secrets should have an expiration date	Mapped

IA-5(1) Password-Based Authentication

Control	Status
Linux virtual machines should have the Linux Guest Configuration extension installed for assignments	Mapped
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Windows machines should have the password complexity setting enabled	Mapped
Windows machines should not store passwords using reversible encryption	Mapped

IR-4 Incident Handling

Control	Status
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped

IR-5 Incident Monitoring

Control	Status
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped

RA-5 Vulnerability Scanning

Control	Status
Virtual machines should have a vulnerability assessment solution enabled	Mapped
SQL managed instances should have vulnerability assessment enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
SQL databases should have vulnerability findings resolved	Mapped
SQL servers should have vulnerability assessment enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped
Synapse workspaces should have vulnerability assessment enabled	Mapped

SC-12 Cryptographic Key Establishment And Management

Control	Status
Batch accounts should use customer-managed keys to encrypt data	Mapped
Cognitive Services accounts should use customer-managed keys to encrypt data	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Managed disks should use both platform-managed and customer-managed keys for double encryption	Mapped
Container registries should use customer-managed keys for encryption	Mapped
Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest	Mapped
Event Hub namespaces should use a customer-managed key for encryption	Mapped
Azure HDInsight clusters should use customer-managed keys to encrypt data at rest	Mapped
Azure HDInsight clusters should use encryption at host to encrypt data at rest	Mapped
Azure API for FHIR should use a customer-managed key to encrypt data at rest	Mapped
HPC Cache accounts should use customer-managed keys for encryption	Mapped
AKS clusters should use customer-managed keys to encrypt both OS and data disks	Mapped
Azure Data Explorer clusters should use customer-managed keys for encryption at rest	Mapped
Azure Machine Learning workspaces should use customer-managed keys for encryption	Mapped
SQL managed instances should use customer-managed keys to encrypt data at rest	Mapped
MySQL servers should use customer-managed keys to encrypt data at rest	Mapped
PostgreSQL servers should use customer-managed keys to encrypt data at rest	Mapped
Service Bus Premium namespaces should use a customer-managed key for encryption	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage account encryption scopes should use customer-managed keys to encrypt data at rest	Mapped
Azure Synapse workspaces should use customer-managed keys to encrypt data at rest	Mapped

SC-28 Protection Of Information At Rest

Control	Status
App Service environments should have internal encryption enabled	Mapped
Automation account variables should have encryption enabled	Mapped
Virtual machines and virtual machine scale sets should have encryption at host enabled	Mapped
Azure Stack Edge devices should have double encryption enabled	Mapped
AKS clusters should have encryption at host enabled for temporary disks and agent node pool caches	Mapped
Azure Data Explorer clusters should have disk encryption enabled	Mapped
Azure Data Explorer clusters should have double encryption enabled	Mapped
MySQL servers should have infrastructure encryption enabled	Mapped
PostgreSQL servers should have infrastructure encryption enabled	Mapped
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped

SC-28(1) Cryptographic Protection

Control	Status
App Service environments should have internal encryption enabled	Mapped
Automation account variables should have encryption enabled	Mapped
Virtual machines and virtual machine scale sets should have encryption at host enabled	Mapped
Azure Stack Edge devices should have double encryption enabled	Mapped
AKS clusters should have encryption at host enabled for temporary disks and agent node pool caches	Mapped
Azure Data Explorer clusters should have disk encryption enabled	Mapped
Azure Data Explorer clusters should have double encryption enabled	Mapped
MySQL servers should have infrastructure encryption enabled	Mapped
PostgreSQL servers should have infrastructure encryption enabled	Mapped
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped

SC-3 Security Function Isolation

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped

SC-5 Denial Of Service Protection

Control	Status
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped

SC-7 Boundary Protection

Control	Status
API Management services should use a virtual network	Mapped
App Configuration should use private link	Mapped
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Cognitive Services should use private link	Mapped
Disk access resources should use private link	Mapped
Virtual machines should use just-in-time network access control for management ports	Mapped
Virtual machines should have all network ports restricted by their associated network security groups	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Container registries should not allow unrestricted network access	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Data factories should use private link	Mapped
Azure Event Grid domains should use private link	Mapped
Azure Event Grid topics should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Azure API for FHIR should use private link	Mapped
IoT Hub device provisioning service instances should use private link	Mapped
Key vaults should have a firewall enabled	Mapped
Azure Key Vaults should use private link	Mapped
Kubernetes clusters should have authorized IP ranges configured	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
MySQL servers should have public network access disabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
Virtual machines should have management ports closed	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should have public network access disabled	Mapped
Azure Cognitive Search services should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have public network access disabled	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should prohibit public access	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should use private link	Mapped
Azure File Sync should use private link	Mapped
Azure Synapse workspaces should use private link	Mapped

SC-7(3) Access Points

Control	Status
API Management services should use a virtual network	Mapped
App Configuration should use private link	Mapped
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Cognitive Services should use private link	Mapped
Disk access resources should use private link	Mapped
Virtual machines should use just-in-time network access control for management ports	Mapped
Virtual machines should have all network ports restricted by their associated network security groups	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Container registries should not allow unrestricted network access	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Data factories should use private link	Mapped
Azure Event Grid domains should use private link	Mapped
Azure Event Grid topics should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Azure API for FHIR should use private link	Mapped
IoT Hub device provisioning service instances should use private link	Mapped
Key vaults should have a firewall enabled	Mapped
Azure Key Vaults should use private link	Mapped
Kubernetes clusters should have authorized IP ranges configured	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
MySQL servers should have public network access disabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
Virtual machines should have management ports closed	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should have public network access disabled	Mapped
Azure Cognitive Search services should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have public network access disabled	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should prohibit public access	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should use private link	Mapped
Azure File Sync should use private link	Mapped
Azure Synapse workspaces should use private link	Mapped

SC-8 Transmission Confidentiality And Integrity

Control	Status
App Service API apps should require FTPS only	Mapped
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
HDInsight clusters should have encryption in transit enabled for communication between cluster nodes	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

SC-8(1) Cryptographic Or Alternate Physical Protection

Control	Status
App Service API apps should require FTPS only	Mapped
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
HDInsight clusters should have encryption in transit enabled for communication between cluster nodes	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

SI-16 Memory Protection

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped

SI-2 Flaw Remediation

Control	Status
Function apps should use the latest 'HTTP Version' when used to run the app	Mapped
App Service web apps should use the latest 'HTTP Version' when used to run the app	Mapped
Virtual machines should have system updates installed	Mapped
Virtual machines should have a vulnerability assessment solution enabled	Mapped
Kubernetes clusters should use a non-vulnerable Kubernetes version	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
SQL databases should have vulnerability findings resolved	Mapped

SI-3 Malicious Code Protection

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped

SI-3(1) Central Management

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped

SI-4 Information System Monitoring

Control	Status
Linux Azure Arc machines should have the Log Analytics extension installed	Mapped
Windows Azure Arc machines should have the Log Analytics extension installed	Mapped
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Linux virtual machines should have the network traffic data collection agent installed	Mapped
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Unprotected Azure SQL servers should have Azure Defender for SQL enabled	Mapped

Framework	Control overlap	Note
NIST SP 800-53 Rev 5	High 99%
NIST SP 800-171 Rev 2	High 96%
FedRAMP Moderate Baseline Rev 4	High 69%