Azure Compliance FrameworksCore Frameworks
ISO/IEC 27001:2022
ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). The 2022 revision reorganizes Annex A controls into four themes: Organizational, People, Physical, and Technological, with 93 controls replacing the previous 114. It emphasizes risk-based security management, continuous improvement, and alignment with modern threats including cloud security and privacy.
| Mandatory? | Voluntary — demanded by B2B contracts |
| Who validates? | Accredited certification body (IAF member) · No self-assessment |
| Renewal | 3-year cert; annual surveillance |
| Observation period | Surveillance: years 1 and 2 |
Implemented Controls
The following controls are implemented as part of this framework.
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'Azure Service Management API should require multifactor authenticationMicrosoft Entra ID tenants should have 'security defaults' enabledApp Service apps should use the latest TLS versionApp Service apps should have 'HTTP logs' enabledApp Service web apps should use the latest TLS versionFunction apps should have function keys configuredRunning container images should have no unresolved vulnerabilitiesAzure subscriptions should have Microsoft Defender for IoT Hub enabledMicrosoft Entra ID tenants should limit Global Administrators to fewer than 5Non-privileged Microsoft Entra ID users should have multifactor authentication enabledPrivileged Microsoft Entra ID users should have multifactor authentication enabledMicrosoft Entra ID users with VM access should have multifactor authentication enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetPublic IP addresses should not be listed in ShodanPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledUnattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionContainer registries should have public network access disabledAzure Cosmos DB accounts should have firewall rulesDatabricks workspaces should have 'No Public IP' set to 'Enabled'Microsoft Entra ID conditional access policies should have trusted locations configuredMicrosoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'Key vaults should have resource logs enabledKubernetes clusters should have network policy enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentStorage accounts containing operational log containers should use customer-managed keys for encryptionMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Azure subscriptions should have at least one Azure Bastion hostVirtual networks should have Azure DDoS Protection Standard enabledNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetAzure subscriptions should have Network Watcher enabledFlow log resources should have flow logging enabledPostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have Microsoft Defender CSPM set to 'On'Azure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Azure Cosmos DB enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabledStorage accounts should have secure transfer enabledStorage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled