NIS2 Directive (EU 2022/2555)

The NIS2 Directive (EU 2022/2555) is the European Union's updated cybersecurity legislation that strengthens security requirements for essential and important entities across critical sectors. It expands the scope of the original NIS Directive, introduces stricter supervisory measures, and harmonizes cybersecurity risk management and incident reporting obligations across EU member states. Effective from October 2024.

Mandatory?	Mandatory for essential/important entities in 18 EU sectors
Who validates?	National competent authority (EU member state) · No self-assessment
Renewal	Ongoing; no fixed audit cycle
Scope	Essential and important entities in energy, transport, health, digital infrastructure, etc.

Controls by Category

1.1.1.a set out the relevant entities approach to managing the security of their network and information systems; (1 control)

Storage accounts should use private link

1.1.1.c set out network and information security objectives; (3 controls)

Network security groups should prohibit inbound HTTP (port 80) access from the internet Flow log resources should have flow logging enabled Storage accounts should use private link

1.2.1 As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities... (5 controls)

Network security groups should prohibit inbound HTTP (port 80) access from the internet Kubernetes clusters should have network policy enabled Storage accounts should have the default network access rule set to deny Storage accounts should have network access restrictions configured Storage accounts should use virtual network rules to restrict network access

1.2.4 Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles. (2 controls)

SQL servers should have a Microsoft Entra ID admin configured SQL servers should have an Azure Active Directory administrator configured

11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network... (17 controls)

App Service apps should have App Service authentication configured App Service apps should have FTP deployments disabled Network security groups should prohibit inbound HTTP (port 80) access from the internet Public IP addresses should not be listed in Shodan Container registries should have public network access disabled Azure Cosmos DB accounts should have firewall rules Kubernetes clusters should have network policy enabled Azure subscriptions should have at least one Azure Bastion host Network security groups should have RDP access restrictions configured Network security groups should have SSH access from the internet restricted Network security groups should have UDP services restricted from the internet Azure subscriptions should have Network Watcher enabled Flow log resources should have flow logging enabled Azure Cognitive Search services should have public network access disabled Storage accounts should have the default network access rule set to deny Storage accounts should have network access restrictions configured Storage accounts should use virtual network rules to restrict network access

11.1.2.c ensure that access is only granted to users that have been adequately authenticated. (2 controls)

App Service apps should have App Service authentication configured App Service apps should have FTP deployments disabled

11.2.1 The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1. (3 controls)

Storage accounts should have the default network access rule set to deny Storage accounts should have network access restrictions configured Storage accounts should use virtual network rules to restrict network access

11.2.2.a assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties; (9 controls)

11.2.2.d ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration; (13 controls)

11.2.2.f apply logging to the management of access rights. (10 controls)

App Service apps should have 'HTTP logs' enabled PostgreSQL flexible servers should have log_connections enabled PostgreSQL flexible servers should have log_disconnections enabled Key vaults should have resource logs enabled MySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabled PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1. (3 controls)

11.3.2.a establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts; (4 controls)

Azure Service Management API should require multifactor authentication Non-privileged Microsoft Entra ID users should have multifactor authentication enabled Privileged Microsoft Entra ID users should have multifactor authentication enabled Microsoft Entra ID users with VM access should have multifactor authentication enabled

11.3.2.b set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance; (1 control)

Microsoft Entra ID tenants should limit Global Administrators to fewer than 5

11.3.2.c individualise and restrict system administration privileges to the highest extent possible, (9 controls)

11.3.2.d provide that system administration accounts are only used to connect to system administration systems. (4 controls)

Microsoft Entra ID tenants should limit Global Administrators to fewer than 5 Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'

11.4.2.b separate logically such systems from application software not used for system administrative purposes, (4 controls)

11.4.2.c protect access to system administration systems through authentication and encryption. (4 controls)

Azure Service Management API should require multifactor authentication Privileged Microsoft Entra ID users should have multifactor authentication enabled Microsoft Entra ID users with VM access should have multifactor authentication enabled Microsoft Entra ID conditional access policies should have trusted locations configured

11.5.2.a set up unique identities for network and information systems and their users; (1 control)

Function apps should use managed identity

11.5.2.d apply logging to the management of identities. (5 controls)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control. (5 controls)

App Service apps should have App Service authentication configured App Service apps should have FTP deployments disabled Container registries should have public network access disabled Kubernetes clusters should have network policy enabled Azure Cognitive Search services should have public network access disabled

11.6.2.a ensure the strength of authentication is appropriate to the classification of the asset to be accessed; (4 controls)

11.6.2.c require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised; (2 controls)

Key vault keys should have automatic rotation enabled Storage accounts should each have 'Enable key rotation reminders' enabled

11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed. (4 controls)

12.1.2.c align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans. (2 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled

12.2.2.a cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (23 controls)

12.2.2.b provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (16 controls)

App Service apps should use the latest TLS version App Service web apps should use the latest TLS version Unattached managed disks should be encrypted with ADE or customer-managed keys OS and data disks should use customer-managed keys for encryption Unattached managed disks should use customer-managed keys (CMK) for encryption Key vaults should have deletion protection enabled Key vaults should have soft delete enabled Storage accounts containing operational log containers should use customer-managed keys for encryption SQL databases should have transparent data encryption enabled SQL servers should use customer-managed keys to encrypt data at rest SQL databases should have Transparent Data Encryption enabled Azure Blob Storage accounts should have soft delete enabled for containers Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption Storage accounts should use customer-managed key for encryption Storage accounts should have infrastructure encryption enabled Storage accounts should have secure transfer enabled

12.2.2.c provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred. (9 controls)

App Service apps should use the latest TLS version App Service web apps should use the latest TLS version SQL servers should have minimum TLS version set to 1.2 or higher MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher SQL databases should have transparent data encryption enabled SQL servers should use customer-managed keys to encrypt data at rest SQL databases should have Transparent Data Encryption enabled Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'Storage accounts should have secure transfer enabled

2.1.2.f evaluate the identified risks based on the risk criteria; (2 controls)

Non-RBAC key vaults should have 'Expiration Date' configured for all keys RBAC key vaults should have 'Expiration Date' configured for all keys

2.1.2.g identify and prioritise appropriate risk treatment options and measures; (25 controls)

App Service apps should use the latest TLS version App Service API apps should require HTTPS for all access App Service apps should have App Service authentication configured App Service function apps should have public access restrictions configured Function apps should use managed identity App Service apps should have 'HTTP logs' enabled App Service web apps should use the latest TLS version App Service apps should have 'Register with Azure Active Directory' enabled App Service web apps should require HTTPS for all access App Service apps should use managed identity Function apps should have function keys configured Function apps should have Application Insights enabled Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles Function apps should use the latest supported runtime version (~4)Function apps should have virtual network integration enabled Container registries should have the admin user disabled Container registries should have public network access disabled Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)Cosmos DB accounts should use private link Azure Cosmos DB accounts should have firewall rules Kubernetes clusters should have network policy enabled Kubernetes cluster nodes should prohibit public access Kubernetes clusters should have public access restrictions configured Kubernetes clusters should use Role-Based Access Control (RBAC)Azure Cognitive Search services should have public network access disabled

2.1.2.h continuously monitor the implementation of the risk treatment measures; (10 controls)

2.1.2.i identify who is responsible for implementing the risk treatment measures and when they should be implemented; (4 controls)

Function apps should use managed identity App Service apps should have 'Register with Azure Active Directory' enabled App Service apps should use managed identity Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles

2.2.1 The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the... (3 controls)

Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled SQL servers should have VA 'Periodic Recurring Scans' enabled SQL servers should have VA 'Send scan reports to' configured

2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur. (6 controls)

Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

2.3.1 The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies. (25 controls)

3.1.1 For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from,... (1 control)

SQL servers should have VA 'Send scan reports to' configured

3.1.2.c assignment of roles to detect and appropriately respond to incidents to competent employees; (3 controls)

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email Azure subscriptions should have email notifications for high severity alerts enabled Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

3.1.2.d documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates. (4 controls)

Running container images should have no unresolved vulnerabilities Virtual machines should have a vulnerability assessment solution enabled Azure subscriptions should have auto provisioning of the Log Analytics agent enabled Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled

3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks. (15 controls)

3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact. (8 controls)

App Service apps should have 'HTTP logs' enabled Key vaults should have resource logs enabled Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives. (6 controls)

3.2.3.a relevant outbound and inbound network traffic; (4 controls)

3.2.3.b creation, modification or deletion of users of the relevant entities network and information systems and extension of the permissions; (3 controls)

Microsoft Entra ID tenants should limit Global Administrators to fewer than 5 Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

3.2.3.c access to systems and applications; (8 controls)

App Service apps should have 'HTTP logs' enabled PostgreSQL flexible servers should have log_connections enabled PostgreSQL flexible servers should have log_disconnections enabled Key vaults should have resource logs enabled Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs MySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

Key vaults should have resource logs enabled MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabled

3.2.3.e all privileged access to systems and applications, and activities performed by administrative accounts; (5 controls)

3.2.3.f access or changes to critical configuration and backup files; (6 controls)

3.2.3.g event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls; (10 controls)

3.2.3.h use of system resources, as well as their performance; (2 controls)

Azure subscriptions should have at least one Application Insights resource configured Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs

3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically.... (5 controls)

3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes. (5 controls)

Flow log resources should have flow logging enabled PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days SQL servers should have auditing enabled SQL servers should have 'Auditing' retention set to greater than 90 days SQL servers auditing to storage accounts should have retention set to 90 days or more

3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity. (6 controls)

3.5.1 The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner. (2 controls)

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

3.5.4 The relevant entities shall log incident response activities in accordance with the procedures referred to in point 3.2.1., and record evidence. (5 controls)

3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures. (26 controls)

4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents. (2 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled

4.1.2.f recovery plans for specific operations, including recovery objectives; (2 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled

4.1.2.g required resources, including backups and redundancies; (7 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled Flow log resources should have flow logging enabled PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days SQL servers should have auditing enabled SQL servers should have 'Auditing' retention set to greater than 90 days SQL servers auditing to storage accounts should have retention set to 90 days or more

4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons... (7 controls)

4.2.2.b assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment; (2 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled

4.2.2.e restoring data from backup copies; (2 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled

4.2.2.f retention periods based on business and regulatory requirements. (5 controls)

Flow log resources should have flow logging enabled SQL servers should have auditing enabled SQL servers should have 'Auditing' retention set to greater than 90 days SQL servers auditing to storage accounts should have retention set to 90 days or more Azure Blob Storage accounts should have soft delete enabled for containers

4.3.2.a roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow; (2 controls)

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

4.3.2.c application of appropriate measures to ensure the maintenance of network and information system security in crisis situations. (5 controls)

5.1.2.a the cybersecurity practices of the suppliers and service providers, including their secure development procedures; (27 controls)

App Service apps should have Client Certificates (Incoming client certificates) enabled App Service API apps should require FTPS only App Service apps should use the latest TLS version App Service API apps should require HTTPS for all access App Service apps should have App Service authentication configured App Service apps should have FTP deployments disabled App Service function apps should have public access restrictions configured Function apps should use managed identity App Service apps should have 'Client Certificates (Incoming client certificates)' enabled App Service apps should have 'HTTP logs' enabled App Service web apps should require FTPS App Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'App Service web apps should use the latest 'HTTP Version' when used to run the app App Service web apps should use the latest 'Java version' when Java is part of the app App Service web apps should use the latest 'PHP version' when PHP is part of the app App Service web apps should use the latest 'Python version' when Python is part of the app App Service web apps should use the latest TLS version App Service apps should have 'Register with Azure Active Directory' enabled App Service web apps should require HTTPS for all access App Service apps should use managed identity Function apps should have function keys configured Function apps should have Application Insights enabled Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles Function apps should use the latest supported runtime version (~4)Function apps should have virtual network integration enabled Azure subscriptions should have at least one Application Insights resource configured Kubernetes clusters should have network policy enabled

5.1.4.f an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities; (4 controls)

Running container images should have no unresolved vulnerabilities Virtual machines should have a vulnerability assessment solution enabled Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled SQL servers should have vulnerability assessment enabled

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

6.1.2.b requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period; (7 controls)

Non-RBAC key vaults should have 'Expiration Date' configured for all keys Non-RBAC key vaults should have 'Expiration Date' configured for all secrets Flow log resources should have flow logging enabled PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days SQL servers should have auditing enabled SQL servers should have 'Auditing' retention set to greater than 90 days SQL servers auditing to storage accounts should have retention set to 90 days or more

6.2.1 Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of... (26 controls)

App Service apps should have Client Certificates (Incoming client certificates) enabled App Service API apps should require FTPS only App Service apps should use the latest TLS version App Service API apps should require HTTPS for all access App Service apps should have App Service authentication configured App Service apps should have FTP deployments disabled App Service function apps should have public access restrictions configured Function apps should use managed identity App Service apps should have 'Client Certificates (Incoming client certificates)' enabled App Service apps should have 'HTTP logs' enabled App Service web apps should require FTPS App Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'App Service web apps should use the latest 'HTTP Version' when used to run the app App Service web apps should use the latest 'Java version' when Java is part of the app App Service web apps should use the latest 'PHP version' when PHP is part of the app App Service web apps should use the latest 'Python version' when Python is part of the app App Service web apps should use the latest TLS version App Service apps should have 'Register with Azure Active Directory' enabled App Service web apps should require HTTPS for all access App Service apps should use managed identity Function apps should have function keys configured Function apps should have Application Insights enabled Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles Function apps should use the latest supported runtime version (~4)Function apps should have virtual network integration enabled Virtual machines should have system updates installed

6.2.2.b apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures; (25 controls)

6.2.2.c lay down security requirements regarding development environments; (25 controls)

6.4.1 The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management. (5 controls)

6.6.1.a security patches are applied within a reasonable time after they become available; (3 controls)

Running container images should have no unresolved vulnerabilities Virtual machines should have a vulnerability assessment solution enabled SQL servers should have vulnerability assessment enabled

6.7.2.b determine and apply controls to protect the relevant entities internal network domains from unauthorised access; (15 controls)

Network security groups should prohibit inbound HTTP (port 80) access from the internet Public IP addresses should not be listed in Shodan Container registries should have public network access disabled Azure Cosmos DB accounts should have firewall rules Kubernetes clusters should have network policy enabled Azure subscriptions should have at least one Azure Bastion host Network security groups should have RDP access restrictions configured Network security groups should have SSH access from the internet restricted Network security groups should have UDP services restricted from the internet Azure subscriptions should have Network Watcher enabled Flow log resources should have flow logging enabled Azure Cognitive Search services should have public network access disabled Storage accounts should have the default network access rule set to deny Storage accounts should have network access restrictions configured Storage accounts should use virtual network rules to restrict network access

6.7.2.e not use systems used for administration of the security policy implementation for other purposes; (8 controls)

Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'Function app managed identities should not have Owner, Contributor, User Access Administrator, or RBAC Administrator roles Microsoft Entra ID tenants should limit Global Administrators to fewer than 5 Azure subscriptions should have a custom role for administering resource locks Container registries should have the admin user disabled Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'SQL servers should have a Microsoft Entra ID admin configured SQL servers should have an Azure Active Directory administrator configured

6.7.2.g where appropriate, exclusively allow access to the relevant entities network and information systems by devices authorised by those entities; (5 controls)

Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'App Service apps should have App Service authentication configured App Service apps should have FTP deployments disabled Function apps should use managed identity Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'

6.7.2.i establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from... (12 controls)

App Service apps should use the latest TLS version App Service API apps should require HTTPS for all access App Service web apps should use the latest TLS version App Service web apps should require HTTPS for all access SQL servers should have minimum TLS version set to 1.2 or higher MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher Azure subscriptions should have Azure Defender for DNS enabled SQL databases should have transparent data encryption enabled SQL databases should have Transparent Data Encryption enabled Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'Storage accounts should have secure transfer enabled Storage accounts should use private link

6.7.2.l apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network. (20 controls)

App Service apps should use the latest TLS version App Service API apps should require HTTPS for all access App Service web apps should use the latest TLS version App Service web apps should require HTTPS for all access Network security groups should prohibit inbound HTTP (port 80) access from the internet Public IP addresses should not be listed in Shodan SQL servers should have minimum TLS version set to 1.2 or higher MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher Azure subscriptions should have at least one Azure Bastion host Network security groups should have RDP access restrictions configured Network security groups should have SSH access from the internet restricted Network security groups should have UDP services restricted from the internet Azure subscriptions should have Network Watcher enabled Flow log resources should have flow logging enabled Azure subscriptions should have Azure Defender for DNS enabled SQL databases should have transparent data encryption enabled SQL databases should have Transparent Data Encryption enabled Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'Storage accounts should have secure transfer enabled Storage accounts should use private link

6.8.2.a consider the functional, logical and physical relationship, including location, between trustworthy systems and services; (2 controls)

Microsoft Entra ID conditional access policies should have trusted locations configured Azure subscriptions should have Network Watcher enabled

6.9.2 For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response... (26 controls)

7.2.b the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results; (6 controls)

9.2.a in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit; (13 controls)

App Service apps should use the latest TLS version App Service web apps should use the latest TLS version Unattached managed disks should be encrypted with ADE or customer-managed keys OS and data disks should use customer-managed keys for encryption Unattached managed disks should use customer-managed keys (CMK) for encryption Storage accounts containing operational log containers should use customer-managed keys for encryption SQL databases should have transparent data encryption enabled SQL servers should use customer-managed keys to encrypt data at rest SQL databases should have Transparent Data Encryption enabled Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption Storage accounts should use customer-managed key for encryption Storage accounts should have infrastructure encryption enabled Storage accounts should have secure transfer enabled

9.2.c the relevant entities approach to key management, including, where appropriate, methods for the following: (15 controls)

9.2.c.i generating different keys for cryptographic systems and applications; (6 controls)

9.2.c.ii issuing and obtaining public key certificates; (3 controls)

App Service apps should have Client Certificates (Incoming client certificates) enabled App Service apps should have 'Client Certificates (Incoming client certificates)' enabled App Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'

9.2.c.iii distributing keys to intended entities, including how to activate keys when received; (3 controls)

Non-RBAC key vaults should have 'Expiration Date' configured for all keys RBAC key vaults should have 'Expiration Date' configured for all keys Storage accounts should each have 'Enable key rotation reminders' enabled

9.2.c.iv storing keys, including how authorised users obtain access to keys; (17 controls)

Function apps should have function keys configured Key vault keys should have automatic rotation enabled Key vaults should have resource logs enabled Key vaults should have deletion protection enabled Key vaults should have Role-Based Access Control (RBAC) enabled Key vaults should have soft delete enabled Azure Key Vaults should use private link Non-RBAC key vaults should have 'Expiration Date' configured for all keys Non-RBAC key vaults should have 'Expiration Date' configured for all secrets RBAC key vaults should have 'Expiration Date' configured for all keys RBAC key vaults should have 'Expiration Date' configured for all secrets Storage accounts containing operational log containers should use customer-managed keys for encryption Azure subscriptions should have Microsoft Defender for Key Vault enabled SQL servers should use customer-managed keys to encrypt data at rest Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption Storage accounts should use customer-managed key for encryption Storage accounts should each have 'Enable key rotation reminders' enabled

9.2.c.v changing or updating keys, including rules on when and how to change keys; (10 controls)

9.2.c.vi backing up or archiving keys; (4 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled Non-RBAC key vaults should have 'Expiration Date' configured for all keys RBAC key vaults should have 'Expiration Date' configured for all keys

Key vaults should have resource logs enabled SQL servers should have auditing enabled

9.2.c.xii setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management. (4 controls)

CIS Azure Benchmark v2.0.0 — 🟢 High overlap (83%)

CIS Azure Benchmark v2.1.0 — 🟢 High overlap (80%)

CIS Azure Benchmark v3.0.0 — 🟢 High overlap (80%)

NIS2 Directive (EU 2022/2555)

Controls by Category

1.1.1.a set out the relevant entities approach to managing the security of their network and information systems; (1 control)

1.1.1.c set out network and information security objectives; (3 controls)

1.2.4 Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles. (2 controls)

11.1.2.c ensure that access is only granted to users that have been adequately authenticated. (2 controls)

11.2.1 The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1. (3 controls)

11.2.2.a assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties; (9 controls)

11.2.2.d ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration; (13 controls)

11.2.2.f apply logging to the management of access rights. (10 controls)

11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1. (3 controls)

11.3.2.a establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts; (4 controls)

11.3.2.b set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance; (1 control)

11.3.2.c individualise and restrict system administration privileges to the highest extent possible, (9 controls)

11.3.2.d provide that system administration accounts are only used to connect to system administration systems. (4 controls)

11.4.2.b separate logically such systems from application software not used for system administrative purposes, (4 controls)

11.4.2.c protect access to system administration systems through authentication and encryption. (4 controls)

11.5.2.a set up unique identities for network and information systems and their users; (1 control)

11.5.2.d apply logging to the management of identities. (5 controls)

11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control. (5 controls)

11.6.2.a ensure the strength of authentication is appropriate to the classification of the asset to be accessed; (4 controls)

11.6.2.c require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised; (2 controls)

11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed. (4 controls)

12.1.2.c align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans. (2 controls)

12.2.2.a cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (23 controls)

12.2.2.b provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (16 controls)

12.2.2.c provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred. (9 controls)

2.1.2.f evaluate the identified risks based on the risk criteria; (2 controls)

2.1.2.g identify and prioritise appropriate risk treatment options and measures; (25 controls)

2.1.2.h continuously monitor the implementation of the risk treatment measures; (10 controls)

2.1.2.i identify who is responsible for implementing the risk treatment measures and when they should be implemented; (4 controls)

2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur. (6 controls)

2.3.1 The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies. (25 controls)

3.1.2.c assignment of roles to detect and appropriately respond to incidents to competent employees; (3 controls)

3.1.2.d documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates. (4 controls)

3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks. (15 controls)

3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact. (8 controls)

3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives. (6 controls)

3.2.3.a relevant outbound and inbound network traffic; (4 controls)

3.2.3.b creation, modification or deletion of users of the relevant entities network and information systems and extension of the permissions; (3 controls)

3.2.3.c access to systems and applications; (8 controls)

3.2.3.d authentication-related events; (3 controls)

3.2.3.e all privileged access to systems and applications, and activities performed by administrative accounts; (5 controls)

3.2.3.f access or changes to critical configuration and backup files; (6 controls)

3.2.3.g event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls; (10 controls)

3.2.3.h use of system resources, as well as their performance; (2 controls)

3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes. (5 controls)

3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity. (6 controls)

3.5.1 The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner. (2 controls)

3.5.3.a with the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to incident notification; (2 controls)

3.5.4 The relevant entities shall log incident response activities in accordance with the procedures referred to in point 3.2.1., and record evidence. (5 controls)

3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures. (26 controls)

4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents. (2 controls)

4.1.2.f recovery plans for specific operations, including recovery objectives; (2 controls)

4.1.2.g required resources, including backups and redundancies; (7 controls)

4.2.2.b assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment; (2 controls)

4.2.2.e restoring data from backup copies; (2 controls)

4.2.2.f retention periods based on business and regulatory requirements. (5 controls)

4.3.2.a roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow; (2 controls)

4.3.2.c application of appropriate measures to ensure the maintenance of network and information system security in crisis situations. (5 controls)

5.1.2.a the cybersecurity practices of the suppliers and service providers, including their secure development procedures; (27 controls)

5.1.4.f an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities; (4 controls)

5.1.7.b review incidents related to ICT products and ICT services from suppliers and service providers; (2 controls)

6.1.2.b requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period; (7 controls)

6.2.2.b apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures; (25 controls)

6.2.2.c lay down security requirements regarding development environments; (25 controls)

6.4.1 The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management. (5 controls)

6.6.1.a security patches are applied within a reasonable time after they become available; (3 controls)

6.7.2.b determine and apply controls to protect the relevant entities internal network domains from unauthorised access; (15 controls)

6.7.2.e not use systems used for administration of the security policy implementation for other purposes; (8 controls)

6.7.2.g where appropriate, exclusively allow access to the relevant entities network and information systems by devices authorised by those entities; (5 controls)

6.7.2.l apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network. (20 controls)

6.8.2.a consider the functional, logical and physical relationship, including location, between trustworthy systems and services; (2 controls)

7.2.b the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results; (6 controls)

9.2.a in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit; (13 controls)

9.2.c the relevant entities approach to key management, including, where appropriate, methods for the following: (15 controls)

9.2.c.i generating different keys for cryptographic systems and applications; (6 controls)

9.2.c.ii issuing and obtaining public key certificates; (3 controls)

9.2.c.iii distributing keys to intended entities, including how to activate keys when received; (3 controls)

9.2.c.iv storing keys, including how authorised users obtain access to keys; (17 controls)