Azure Compliance FrameworksCore Frameworks
NIST SP 800-53 Rev 5
The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5 provides a comprehensive catalog of security and privacy controls for information systems and organizations. Published by the U.S. Department of Commerce in September 2020, this framework supports risk management processes and compliance with federal legislation including FISMA. It is used by U.S. federal agencies and organizations globally seeking a risk-based approach to security and privacy controls.
| Mandatory? | Mandatory for U.S. federal agencies; voluntary for private sector |
| Who validates? | Authorizing Official; 3PAO for FedRAMP overlays · No self-assessment |
| Renewal | ATO reauthorization every 3 years (federal) |
| Scope | Federal information systems; also used as private-sector baseline |
🏛 The page lists the Joint Task Force as the author. · NIST SP 800-53 Rev 5 (Sep 2020) Official source →
Controls by Category
AC-16 Security and Privacy Attributes (2 controls)
AC-17 Remote Access (33 controls)
App Configuration should use private linkApp Service apps should have remote debugging disabledFunction apps should have remote debugging disabledCognitive Services should use private linkDisk access resources should use private linkLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
AC-17(1) Monitoring and Control (33 controls)
App Configuration should use private linkApp Service apps should have remote debugging disabledFunction apps should have remote debugging disabledCognitive Services should use private linkDisk access resources should use private linkLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should prohibit remote connections from accounts without passwordsContainer registries should use private linkCosmos DB accounts should use private linkData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkAzure Key Vaults should use private linkMariaDB servers should have private endpoints enabledMySQL servers should have private endpoints enabledPostgreSQL servers should have private endpoints enabledAzure Cache for Redis should use private linkAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure Spring Cloud should use network injectionAzure SQL databases should have private endpoint connections enabledStorage accounts should have network access restrictions configuredStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
AC-2 Account Management (12 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledAzure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedAzure subscriptions should limit owners to 3Service Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
AC-2(1) Automated System Account Management (3 controls)
AC-2(12) Account Monitoring for Atypical Usage (10 controls)
Virtual machines should use just-in-time network access control for management portsAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabled
AC-2(7) Privileged User Accounts (4 controls)
AC-3 Access Enforcement (12 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledLinux machines should require passwords for all accountsLinux virtual machines should have the Linux Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsLinux machines should require SSH keys for authenticationVirtual machines should use Azure Resource Manager resourcesService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configuredStorage accounts should use Azure Resource Manager resources
AC-3(7) Role-based Access Control (1 control)
AC-4 Information Flow Enforcement (46 controls)
API Management services should use a virtual networkApp Configuration should use private linkApp Service apps should not allow CORS access from every resourceCognitive Services should use private linkCognitive Services accounts should have public network access disabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
AC-4(3) Dynamic Information Flow Control (1 control)
AC-5 Separation of Duties (1 control)
AC-6 Least Privilege (2 controls)
AC-6(7) Review of User Privileges (2 controls)
AU-11 Audit Record Retention (1 control)
AU-12 Audit Record Generation (32 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
AU-12(1) System-wide and Time-correlated Audit Trail (32 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
AU-6 Audit Record Review, Analysis, and Reporting (12 controls)
Linux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedAzure subscriptions should have Network Watcher enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
AU-6(4) Central Review and Analysis (32 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
AU-6(5) Integrated Analysis of Audit Records (32 controls)
App Service apps should have resource logs enabledLinux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedBatch accounts should have resource logs enabledVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringData Lake Analytics accounts should have resource logs enabledData Lake Store accounts should have resource logs enabledEvent Hub namespaces should have resource logs enabledIoT hubs should have resource logs enabledKey vaults should have resource logs enabledLogic App workflows should have resource logs enabledAzure subscriptions should have Network Watcher enabledSearch services should have resource logs enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledService Bus namespaces should have resource logs enabledSQL servers should have auditing enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledStream Analytics jobs should have resource logs enabled
CM-6 Configuration Settings (9 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service apps should not allow CORS access from every resourceApp Service apps should have remote debugging disabledFunction apps should have 'Client Certificates (Incoming client certificates)' enabledFunction apps should not allow CORS access from every resourceFunction apps should have remote debugging disabledLinux machines should have the Azure compute security baseline requirements satisfiedWindows machines should have the Azure compute security baseline requirements satisfiedAKS clusters should have the Azure Policy Add-on installed and enabled
CM-7 Least Functionality (1 control)
CP-6 Alternate Storage Site (5 controls)
CP-6(1) Separation from Primary Site (5 controls)
CP-7 Alternate Processing Site (1 control)
CP-9 System Backup (5 controls)
IA-2 Identification and Authentication (organizational Users) (5 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
IA-4 Identifier Management (5 controls)
Function apps should use managed identityApp Service apps should use managed identityCognitive Services accounts should have local authentication methods disabledService Fabric clusters should use only Azure Active Directory for client authenticationSQL servers should have an Azure Active Directory administrator configured
IA-5 Authenticator Management (8 controls)
Linux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should not store passwords using reversible encryptionLinux machines should require SSH keys for authenticationKey Vault keys should have an expiration dateKey Vault secrets should have an expiration date
IA-5(1) Password-based Authentication (10 controls)
Linux virtual machines should have the Linux Guest Configuration extension installed for assignmentsWindows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should have maximum password age set to 70 daysWindows machines should have minimum password age set to 1 dayWindows machines should have minimum password length set to 14 charactersWindows machines should have the password complexity setting enabledWindows machines should not store passwords using reversible encryptionWindows machines should prohibit reuse of the previous 24 passwords
IR-4 Incident Handling (13 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
IR-5 Incident Monitoring (13 controls)
Azure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSubscriptions should have a contact email address for security issuesAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
IR-6(2) Vulnerabilities Related to Incidents (3 controls)
RA-5 Vulnerability Monitoring and Scanning (15 controls)
Virtual machines should have a vulnerability assessment solution enabledSQL managed instances should have vulnerability assessment enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabledSynapse workspaces should have vulnerability assessment enabled
SC-12 Cryptographic Key Establishment and Management (24 controls)
Batch accounts should use customer-managed keys to encrypt dataCognitive Services accounts should use customer-managed keys to encrypt dataOS and data disks should use customer-managed keys for encryptionManaged disks should use both platform-managed and customer-managed keys for double encryptionContainer Instance container groups should use customer-managed keys for encryptionContainer registries should use customer-managed keys for encryptionAzure Cosmos DB accounts should use customer-managed keys to encrypt data at restData factories should use customer-managed keys for encryptionEvent Hub namespaces should use a customer-managed key for encryptionAzure HDInsight clusters should use customer-managed keys to encrypt data at restAzure HDInsight clusters should use encryption at host to encrypt data at restAzure API for FHIR should use a customer-managed key to encrypt data at restHPC Cache accounts should use customer-managed keys for encryptionAKS clusters should use customer-managed keys to encrypt both OS and data disksAzure Data Explorer clusters should use customer-managed keys for encryption at restAzure Machine Learning workspaces should use customer-managed keys for encryptionSQL managed instances should use customer-managed keys to encrypt data at restMySQL servers should use customer-managed keys to encrypt data at restPostgreSQL servers should use customer-managed keys to encrypt data at restService Bus Premium namespaces should use a customer-managed key for encryptionSQL servers should use customer-managed keys to encrypt data at restStorage accounts should use customer-managed key for encryptionStorage account encryption scopes should use customer-managed keys to encrypt data at restAzure Synapse workspaces should use customer-managed keys to encrypt data at rest
SC-28 Protection of Information at Rest (11 controls)
App Service environments should have internal encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have Transparent Data Encryption enabledStorage accounts should have infrastructure encryption enabled
SC-28(1) Cryptographic Protection (11 controls)
App Service environments should have internal encryption enabledVirtual machines and virtual machine scale sets should have encryption at host enabledAzure Stack Edge devices should have double encryption enabledAKS clusters should have encryption at host enabled for temporary disks and agent node pool cachesAzure Data Explorer clusters should have disk encryption enabledAzure Data Explorer clusters should have double encryption enabledMySQL servers should have infrastructure encryption enabledPostgreSQL servers should have infrastructure encryption enabledService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have Transparent Data Encryption enabledStorage accounts should have infrastructure encryption enabled
SC-3 Security Function Isolation (2 controls)
SC-5 Denial-of-service Protection (4 controls)
SC-7 Boundary Protection (47 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkCognitive Services accounts should have public network access disabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
SC-7(3) Access Points (47 controls)
API Management services should use a virtual networkApp Configuration should use private linkApplication gateways should have Web Application Firewall (WAF) enabledCognitive Services should use private linkCognitive Services accounts should have public network access disabledCognitive Services accounts should have network access restrictions configuredDisk access resources should use private linkVirtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groupsInternet-facing virtual machines should use network security groups for protectionContainer registries should not allow unrestricted network accessContainer registries should use private linkCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesData factories should use private linkAzure Event Grid domains should use private linkAzure Event Grid topics should use private linkEvent Hub namespaces should use private linkAzure Front Door services should have Web Application Firewall (WAF) enabledAzure API for FHIR should use private linkIoT Hub device provisioning service instances should use private linkKey vaults should have a firewall enabledAzure Key Vaults should use private linkKubernetes clusters should have authorized IP ranges configuredMariaDB servers should have private endpoints enabledMariaDB servers should have public network access disabledMySQL servers should have private endpoints enabledMySQL servers should have public network access disabledVirtual machine network interfaces should have IP forwarding disabledVirtual machines should have management ports closedSubnets should have a network security group configuredPostgreSQL servers should have private endpoints enabledPostgreSQL servers should have public network access disabledAzure Cache for Redis should use private linkAzure Cognitive Search services should have public network access disabledAzure Cognitive Search services should use private linkAzure Cognitive Search services should use a SKU that supports private linkAzure Service Bus namespaces should use private linkAzure SignalR Service should use private linkAzure SQL databases should have public network access disabledAzure SQL databases should have private endpoint connections enabledStorage accounts should prohibit public accessStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private linkAzure File Sync should use private linkAzure Synapse workspaces should use private link
SC-8 Transmission Confidentiality and Integrity (12 controls)
App Service API apps should require FTPS onlyApp Service apps should use the latest TLS versionFunction apps should require FTPS onlyFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessApp Service web apps should require HTTPS for all accessWindows web servers should use secure communication protocolsHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled
SC-8(1) Cryptographic Protection (12 controls)
App Service API apps should require FTPS onlyApp Service apps should use the latest TLS versionFunction apps should require FTPS onlyFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessApp Service web apps should require HTTPS for all accessWindows web servers should use secure communication protocolsHDInsight clusters should have encryption in transit enabled for communication between cluster nodesMySQL servers should have 'Enforce SSL connection' enabledPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled
SI-16 Memory Protection (2 controls)
SI-2 Flaw Remediation (15 controls)
Function apps should use the latest 'HTTP Version' when used to run the appApp Service web apps should use the latest 'HTTP Version' when used to run the appVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledKubernetes clusters should use a non-vulnerable Kubernetes versionAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledSQL databases should have vulnerability findings resolved
SI-2(6) Removal of Previous Versions of Software and Firmware (3 controls)
SI-3 Malicious Code Protection (2 controls)
SI-4 System Monitoring (19 controls)
Linux Azure Arc machines should have the Log Analytics extension installedWindows Azure Arc machines should have the Log Analytics extension installedVirtual machines should have the Guest Configuration extension installedVirtual machines should use system-assigned managed identity with the Guest Configuration extensionVirtual machines should have the Log Analytics agent installed for Azure Security Center monitoringLinux virtual machines should have the network traffic data collection agent installedWindows virtual machines should have the network traffic data collection agent installedVirtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoringAzure subscriptions should have Network Watcher enabledAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledAzure subscriptions should have Microsoft Defender for Storage enabledUnprotected Azure SQL servers should have Azure Defender for SQL enabled
SI-4(12) Automated Organization-generated Alerts (3 controls)
Related Frameworks
NIST SP 800-171 Rev 2 — 🟢 High overlap (93%)
FedRAMP High — 🟢 High overlap (92%)
FedRAMP Moderate Baseline Rev 4 — 🟢 High overlap (67%)