ISO/IEC 27001:2022

ActiveCore framework

Best for: Organizations that want to bring information security under explicit management control through an Information Security Management System (ISMS). Businesses seeking certification for an implementation deployed on in-scope Azure services can use the relevant Azure certifications in their assessment.

Mandatory?	Voluntary — demanded by B2B contracts
Who validates?	Accredited certification body (IAF member). No self-assessment.
Renewal	3-year cert; annual surveillance
Observation period	Surveillance: years 1 and 2

Controls by category

74 controls are Mapped to ISO/IEC 27001:2022.

Access Control

Control	Status
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'	Mapped
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'	Mapped
Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID tenants should have 'security defaults' enabled	Mapped
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped
Microsoft Entra ID conditional access policies should have trusted locations configured	Mapped
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

Access Rights

Control	Status
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'	Mapped
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'	Mapped
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

Assessment And Decision On Information Security Events

Control	Status
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped
Azure subscriptions should have Microsoft Defender for Databases enabled	Mapped
Azure subscriptions should have Azure Defender for DNS enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

Authentication Information

Control	Status
Azure Service Management API should require multifactor authentication	Mapped
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Microsoft Entra ID users with VM access should have multifactor authentication enabled	Mapped

Collection Of Evidence

Control	Status
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped
Azure subscriptions should have Microsoft Defender for Databases enabled	Mapped
Azure subscriptions should have Azure Defender for DNS enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped

Configuration Management

Control	Status
Running container images should have no unresolved vulnerabilities	Mapped
Azure subscriptions should have Microsoft Defender for IoT Hub enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped
Azure subscriptions should have Microsoft Defender for Databases enabled	Mapped
Azure subscriptions should have Azure Defender for DNS enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

Data Leakage Prevention

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service web apps should use the latest TLS version	Mapped
SQL databases should have transparent data encryption enabled	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts should have secure transfer enabled	Mapped

Identity Management

Control	Status
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped

Information Access Restriction

Control	Status
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'	Mapped
Function apps should have function keys configured	Mapped
PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled	Mapped
Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled	Mapped

Logging

Control	Status
App Service apps should have 'HTTP logs' enabled	Mapped
PostgreSQL flexible servers should have log_connections enabled	Mapped
PostgreSQL flexible servers should have log_disconnections enabled	Mapped
Key vaults should have resource logs enabled	Mapped
MySQL flexible servers should have 'audit_log_enabled' set to 'ON'	Mapped
MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'	Mapped
Flow log resources should have flow logging enabled	Mapped
PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'	Mapped
PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days	Mapped
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped

Managing Information Security In The ICT Supply Chain

Control	Status
Running container images should have no unresolved vulnerabilities	Mapped
Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled	Mapped

Monitoring Activities

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment	Mapped
Azure subscriptions should have Microsoft Defender CSPM set to 'On'	Mapped

Network Security

Control	Status
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Public IP addresses should not be listed in Shodan	Mapped
Container registries should have public network access disabled	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Databricks workspaces should have 'No Public IP' set to 'Enabled'	Mapped
Kubernetes clusters should have network policy enabled	Mapped
Azure subscriptions should have at least one Azure Bastion host	Mapped
Virtual networks should have Azure DDoS Protection Standard enabled	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
Network security groups should have UDP services restricted from the internet	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Flow log resources should have flow logging enabled	Mapped

Privileged Access Rights

Control	Status
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

Protection Against Malware

Control	Status
Azure subscriptions should have Microsoft Defender for IoT Hub enabled	Mapped
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped
Azure subscriptions should have Microsoft Defender for Databases enabled	Mapped
Azure subscriptions should have Azure Defender for DNS enabled	Mapped
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled	Mapped

Roles and Responsibilities

Control	Status
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

Secure Authentication

Control	Status
Azure Service Management API should require multifactor authentication	Mapped
App Service web apps should use the latest TLS version	Mapped
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Microsoft Entra ID users with VM access should have multifactor authentication enabled	Mapped

Security of Network Services

Control	Status
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Public IP addresses should not be listed in Shodan	Mapped
Container registries should have public network access disabled	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Kubernetes clusters should have network policy enabled	Mapped
Azure subscriptions should have at least one Azure Bastion host	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
Network security groups should have UDP services restricted from the internet	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Flow log resources should have flow logging enabled	Mapped

Segregation of Networks

Control	Status
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Container registries should have public network access disabled	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Kubernetes clusters should have network policy enabled	Mapped
Azure subscriptions should have at least one Azure Bastion host	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
Network security groups should have UDP services restricted from the internet	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Flow log resources should have flow logging enabled	Mapped

Use of Cryptography

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service web apps should use the latest TLS version	Mapped
Unattached managed disks should be encrypted with ADE or customer-managed keys	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Unattached managed disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
SQL databases should have transparent data encryption enabled	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped
Storage accounts should have secure transfer enabled	Mapped

Framework	Control overlap	Note
NIS2 Directive (EU 2022/2555)	High 95%
CIS Azure Benchmark v2.1.0	High 86%
CIS Azure Benchmark v3.0.0	High 86%

Frequently asked questions

What does ISO/IEC 27001:2022 specify?

ISO/IEC 27001:2022 formally specifies an Information Security Management System (ISMS). It sets requirements for implementing, maintaining, monitoring, and continually improving the ISMS. It also covers documentation, divisions of responsibility, availability, access control, auditing, and corrective and preventive measures.

What is the difference between ISO/IEC 27001:2022 and ISO/IEC 27002:2022?

ISO/IEC 27002:2022 provides guidelines and best practices, but it is not a management standard. The audit vehicle is ISO/IEC 27001:2022, which relies on the detailed guidelines in ISO/IEC 27002:2022 for control implementation.

Who is responsible for assessing my own ISO/IEC 27001 implementation?

The customer is responsible for engaging an assessor to evaluate their implementation for compliance. The customer is also responsible for the controls and processes within their own organization. Azure certifications can be used in the compliance assessment.

How does Azure Policy relate to ISO/IEC 27001?

Microsoft provides Azure Policy regulatory compliance built-in initiatives for Azure and Azure Government. The initiatives map to ISO/IEC 27001 domains and controls. Azure Policy compliance is only a partial view of overall compliance status.