Azure Compliance FrameworksCommon Frameworks
NIST SP 800-171 Rev 2
Best for: The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components. They are intended for use by federal agencies in contractual vehicles or other agreements with nonfederal organizations.
| Mandatory? | Mandatory for federal contractors handling CUI |
| Who validates? | C3PAO (CMMC) or self-assessment for lower CMMC levels |
| Renewal | Annual self-assessment; C3PAO every 3 years (CMMC Level 2+) |
| Scope | Non-federal systems and organizations handling CUI |
Controls by Category
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems) (48 controls)
App Configuration should use private linkApp Service apps should have remote debugging disabledFunction apps should have remote debugging disabledFunction apps should use managed identityApp Service apps should use managed identityCognitive Services should use private linkCognitive Services accounts should have local authentication methods disabledDisk access resources should use private linkLinux machines should require passwords for all accountsLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsLinux machines should require SSH keys for authenticationVirtual machines should use Azure Resource Manager resourcesContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkAzure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedAzure subscriptions should limit owners to 3IoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkService Fabric clusters should use only Azure Active Directory for client authenticationAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionSQL servers should have an Azure Active Directory administrator configuredAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use Azure Resource Manager resourcesStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.1.12 Monitor and control remote access sessions (32 controls)
App Configuration should use private linkApp Service apps should have remote debugging disabledFunction apps should have remote debugging disabledCognitive Services should use private linkDisk access resources should use private linkLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions (26 controls)
App Configuration should use private linkCognitive Services should use private linkDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.1.14 Route remote access via managed access control points (26 controls)
App Configuration should use private linkCognitive Services should use private linkDisk access resources should use private linkContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute (15 controls)
App Service apps should have remote debugging disabledFunction apps should have remote debugging disabledFunction apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledVirtual machines should use Azure Resource Manager resourcesAzure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configuredStorage accounts should use Azure Resource Manager resources
3.1.3 Control the flow of CUI in accordance with approved authorizations (45 controls)
API Management services should use a virtual networkApp Configuration should use private linkApp Service apps should not allow CORS access from every resourceCognitive Services should use private linkCognitive Services accounts should have local authentication methods disabledDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion (1 control)
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts (2 controls)
3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified (14 controls)
Virtual machines should have a vulnerability assessment solution enabledSQL managed instances should have vulnerability assessment enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledSynapse workspaces should have vulnerability assessment enabled
3.11.3 Remediate vulnerabilities in accordance with risk assessments (14 controls)
Virtual machines should have a vulnerability assessment solution enabledSQL managed instances should have vulnerability assessment enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledSynapse workspaces should have vulnerability assessment enabled
3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems (46 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkCognitive Services accounts should have local authentication methods disabledDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems (24 controls)
Batch accounts should use customer-managed keys to encrypt dataCognitive Services accounts should use customer-managed keys to encrypt dataOS and data disks should use customer-managed keys for encryptionManaged disks should use both platform-managed and customer-managed keys for double encryptionContainer Instance container groups should use customer-managed keys for encryptionContainer registries should use customer-managed keys for encryptionAzure Cosmos DB accounts should use customer-managed keys to encrypt data at restData factories should use customer-managed keys for encryptionEvent Hub namespaces should use a customer-managed key for encryptionAzure HDInsight clusters should use customer-managed keys to encrypt data at restAzure HDInsight clusters should use encryption at host to encrypt data at restAzure API for FHIR should use a customer-managed key to encrypt data at restHPC Cache accounts should use customer-managed keys for encryptionAKS clusters should use customer-managed keys to encrypt both OS and data disksAzure Data Explorer clusters should use customer-managed keys for encryption at restAzure Machine Learning workspaces should use customer-managed keys for encryptionSQL managed instances should use customer-managed keys to encrypt data at restMySQL servers should use customer-managed keys to encrypt data at restPostgreSQL servers should use customer-managed keys to encrypt data at restService Bus Premium namespaces should use a customer-managed key for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts should use customer-managed key for encryptionStorage account encryption scopes should use customer-managed keys to encrypt data at restAzure Synapse workspaces should use customer-managed keys to encrypt data at rest
3.13.16 Protect the confidentiality of CUI at rest (12 controls)
App Service environments should have internal encryption enabledAutomation account variables should have encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have Transparent Data Encryption enabledStorage accounts should have infrastructure encryption enabled
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems (46 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkCognitive Services accounts should have local authentication methods disabledDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks (46 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkCognitive Services accounts should have local authentication methods disabledDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception) (20 controls)
Application gateways should have Web Application Firewall (WAF) enabledCognitive Services accounts should have local authentication methods disabledVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessAzure Cosmos DB accounts should have firewall rulesAzure Front Door services should have Web Application Firewall (WAF) enabledKey vaults should have a firewall enabledKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have public network access disabledMySQL servers should have public network access disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have public network access disabledAzure Cognitive Search services should have public network access disabledAzure SQL databases should have public network access disabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network access
3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards (11 controls)
App Service apps should use the latest TLS versionFunction apps should require FTPS onlyFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessApp Service web apps should require FTPSApp Service web apps should require HTTPS for all accessHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled
3.14.1 Identify, report, and correct system flaws in a timely manner (15 controls)
Function apps should use the latest 'HTTP Version' when used to run the appApp Service web apps should use the latest 'HTTP Version' when used to run the appVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledWindows virtual machines should have Windows Defender Exploit Guard enabledKubernetes clusters should use a non-vulnerable Kubernetes versionAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolved
3.14.2 Provide protection from malicious code at designated locations within organizational systems (11 controls)
Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for AzureWindows Server virtual machines should have the default Microsoft IaaSAntimalware extension installedWindows virtual machines should have Windows Defender Exploit Guard enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabled
3.14.3 Monitor system security alerts and advisories and take action in response (11 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabled
3.14.4 Update malicious code protection mechanisms when new releases are available (3 controls)
3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed (4 controls)
Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for AzureWindows Server virtual machines should have the default Microsoft IaaSAntimalware extension installedWindows virtual machines should have Windows Defender Exploit Guard enabledAzure subscriptions should have Microsoft Defender for Servers enabled
3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks (22 controls)
Linux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringAzure subscriptions should have Network Watcher enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
3.14.7 Identify unauthorized use of organizational systems (19 controls)
Linux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringAzure subscriptions should have Network Watcher enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity (33 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledSQL servers auditing to storage accounts should have retention set to 90 days or moreUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions (33 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledSQL servers auditing to storage accounts should have retention set to 90 days or moreUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
3.3.4 Alert in the event of an audit logging process failure (9 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity (9 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles (9 controls)
App Service apps should have remote debugging disabledFunction apps should have 'Client Certificates (Incoming client certificates)' enabledFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledApp Service apps should not allow CORS access from every resourceApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'Linux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfiedAKS clusters should have the Azure Policy Add-on installed and enabled
3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems (9 controls)
App Service apps should have remote debugging disabledFunction apps should have 'Client Certificates (Incoming client certificates)' enabledFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledApp Service apps should not allow CORS access from every resourceApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'Linux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfiedAKS clusters should have the Azure Policy Add-on installed and enabled
3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities (1 control)
3.5.1 Identify system users, processes acting on behalf of users, and devices (5 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
3.5.10 Store and transmit only cryptographically-protected passwords (5 controls)
Linux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should not store passwords using reversible encryption
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. (13 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should not store passwords using reversible encryptionLinux machines should require SSH keys for authenticationKey Vault keys should have an expiration dateKey Vault secrets should have an expiration dateService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
3.5.5 Prevent reuse of identifiers for a defined period (5 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
3.5.6 Disable identifiers after a defined period of inactivity (6 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledAzure subscriptions should not have blocked accounts with read and write permissionsService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created (5 controls)
Windows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should have minimum password length set to 14 charactersWindows machines should have the password complexity setting enabled
3.5.8 Prohibit password reuse for a specified number of generations (4 controls)
Windows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should prohibit reuse of the previous 24 passwords
3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization (3 controls)
3.8.9 Protect the confidentiality of backup CUI at storage locations (5 controls)
Related Frameworks
NIST SP 800-53 Rev 5 — 🟢 High overlap (97%)
FedRAMP High — 🟢 High overlap (93%)
CMMC 2.0 Level 2 — 🟢 High overlap (67%)