Azure Compliance FrameworksCore Frameworks
FedRAMP Moderate Baseline Rev 4
The Federal Risk and Authorization Management Program (FedRAMP) Moderate Impact Baseline Revision 4 establishes security requirements for cloud services handling moderate-impact federal information. Managed by the U.S. General Services Administration (GSA), this is the most common FedRAMP baseline requiring implementation of 325 security controls derived from NIST SP 800-53. It applies to cloud service providers offering services to U.S. federal agencies for systems with moderate confidentiality, integrity, and availability requirements.
| Mandatory? | Mandatory for CSPs selling to U.S. federal agencies |
| Who validates? | 3PAO (Third Party Assessment Organization) · No self-assessment |
| Renewal | Continuous monitoring; annual assessment |
| Scope | Cloud service offering for federal use (moderate impact) |
Controls by Category
AC-17 Remote Access (25 controls)
App Configuration should use private linkFunction apps should have remote debugging disabledDisk access resources should use private linkWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC-17(1) Automated Monitoring/Control (25 controls)
App Configuration should use private linkFunction apps should have remote debugging disabledDisk access resources should use private linkWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC-2 Account Management (13 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedAzure subscriptions should limit owners to 3Service Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
AC-2(1) Automated System Account Management (3 controls)
AC-2(12) Account Monitoring (1 control)
AC-2(7) Role-Based Schemes (4 controls)
AC-3 Access Enforcement (13 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityLinux machines should require passwords for all accountsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should require SSH keys for authenticationVirtual machines should use Azure Resource Manager resourcesService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should use Azure Resource Manager resources
AC-4 Information Flow Enforcement (30 controls)
API Management services should use a virtual networkApp Configuration should use private linkApp Service apps should not allow CORS access from every resourceApp Service apps should not allow CORS access from every resourceCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
AC-5 Separation Of Duties (1 control)
AC-6 Least Privilege (2 controls)
AU-11 Audit Record Retention (2 controls)
AU-12 Audit Generation (17 controls)
App Service apps should have resource logs enabledBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledLogic App workflows should have resource logs enabledSearch services should have resource logs enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'SQL servers should have auditing enabledStream Analytics jobs should have resource logs enabled
AU-6 Audit Record Review, Analysis And Reporting (2 controls)
CM-6 Configuration Settings (6 controls)
App Service apps should not allow CORS access from every resourceFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledApp Service apps should not allow CORS access from every resourceLinux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfied
CP-6 Alternate Storage Sites (5 controls)
CP-6(1) Separation From Primary Site (5 controls)
CP-7 Alternate Processing Site (1 control)
CP-9 Information System Backup (7 controls)
Virtual machines should be protected by Azure BackupKey vaults should have deletion protection enabledKey vaults should have soft delete enabledKey vaults should have recoverability configuredMariaDB servers should have geo-redundant backup enabledMySQL servers should have geo-redundant backup enabledPostgreSQL servers should have geo-redundant backup enabled
IA-2 Identification and Authentication (Organizational users) (7 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IA-4 Identifier Management (7 controls)
App Service API apps should use managed identityFunction apps should use managed identityApp Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identityService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
IA-5 Authenticator Management (11 controls)
Windows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should not store passwords using reversible encryptionLinux machines should require SSH keys for authenticationKey vault certificates should have 'Validity Period (in months)' set to 12 or lessKey Vault keys should have an expiration dateKey Vault secrets should have an expiration dateNon-RBAC key vaults should have 'Expiration Date' configured for all keysNon-RBAC key vaults should have 'Expiration Date' configured for all secretsRBAC key vaults should have 'Expiration Date' configured for all keys
IA-5(1) Password-Based Authentication (9 controls)
Windows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should have maximum password age set to 70 daysWindows machines should have minimum password age set to 1 dayWindows machines should have minimum password length set to 14 charactersWindows machines should have the password complexity setting enabledWindows machines should not store passwords using reversible encryptionWindows machines should prohibit reuse of the previous 24 passwords
IR-4 Incident Handling (4 controls)
Azure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'
IR-5 Incident Monitoring (4 controls)
Azure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'
RA-5 Vulnerability Scanning (4 controls)
SC-12 Cryptographic Key Establishment And Management (22 controls)
Batch accounts should use customer-managed keys to encrypt dataCognitive Services accounts should use customer-managed keys to encrypt dataOS and data disks should use customer-managed keys for encryptionManaged disks should use both platform-managed and customer-managed keys for double encryptionContainer Instance container groups should use customer-managed keys for encryptionContainer registries should use customer-managed keys for encryptionData factories should use customer-managed keys for encryptionEvent Hub namespaces should use a customer-managed key for encryptionAzure HDInsight clusters should use customer-managed keys to encrypt data at restAzure HDInsight clusters should use encryption at host to encrypt data at restAzure API for FHIR should use a customer-managed key to encrypt data at restHPC Cache accounts should use customer-managed keys for encryptionAKS clusters should use customer-managed keys to encrypt both OS and data disksAzure Data Explorer clusters should use customer-managed keys for encryption at restAzure Machine Learning workspaces should use customer-managed keys for encryptionSQL managed instances should use customer-managed keys to encrypt data at restMySQL servers should use customer-managed keys to encrypt data at restService Bus Premium namespaces should use a customer-managed key for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts should use customer-managed key for encryptionStorage account encryption scopes should use customer-managed keys to encrypt data at restAzure Synapse workspaces should use customer-managed keys to encrypt data at rest
SC-28 Protection Of Information At Rest (10 controls)
Automation account variables should have encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignStorage accounts should have infrastructure encryption enabled
SC-28(1) Cryptographic Protection (10 controls)
Automation account variables should have encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignStorage accounts should have infrastructure encryption enabled
SC-5 Denial Of Service Protection (3 controls)
SC-7 Boundary Protection (30 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
SC-7(3) Access Points (30 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkCosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rulesData factories should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have private endpoint connections enabledStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessAzure Synapse workspaces should use private link
SC-8 Transmission Confidentiality And Integrity (7 controls)
App Service API apps should require FTPS onlyApp Service API apps should require HTTPS for all accessFunction apps should require FTPS onlyApp Service web apps should require FTPSHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabled
SC-8(1) Cryptographic Or Alternate Physical Protection (7 controls)
App Service API apps should require FTPS onlyApp Service API apps should require HTTPS for all accessFunction apps should require FTPS onlyApp Service web apps should require FTPSHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabled
SI-16 Memory Protection (1 control)
SI-2 Flaw Remediation (3 controls)
SI-3 Malicious Code Protection (1 control)
SI-3(1) Central Management (1 control)
SI-4 Information System Monitoring (6 controls)
Virtual machines should have the Guest Configuration extension installedVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsAzure subscriptions should have Microsoft Defender for Storage enabledCritical SQL servers should have Microsoft Defender for SQL set to 'On'
Related Frameworks
CMMC 2.0 Level 2 — 🟢 High overlap (96%)
NIST SP 800-53 Rev 5 — 🟢 High overlap (89%)
NIST SP 800-171 Rev 2 — 🟢 High overlap (85%)