Azure Compliance FrameworksCore Frameworks
PCI DSS v4.0
The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 is an information security standard for organizations that handle branded credit cards from major card schemes. Released in March 2022 by the PCI Security Standards Council, this version modernizes requirements with enhanced flexibility through customized implementation and expanded multi-factor authentication requirements. It applies globally to all entities that store, process, or transmit cardholder data and became mandatory for compliance assessments after March 31, 2024.
| Mandatory? | Mandatory for any entity processing card data |
| Who validates? | QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4) |
| Renewal | Annual |
| Scope | Cardholder data environment (CDE) and connected systems |
Controls by Category
1.2.5: Network security controls (NSCs) are configured and maintained. (8 controls)
App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service apps should have FTP deployments disabledApp Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessNetwork security groups should prohibit inbound HTTP (port 80) access from the internetNetwork security groups should have SSH access from the internet restrictedStorage accounts should have secure transfer enabled
1.2.8: Network security controls (NSCs) are configured and maintained. (12 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service function apps should have public access restrictions configuredApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'Function apps should have virtual network integration enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure Key Vaults should use private linkKubernetes clusters should have public access restrictions configuredNetwork security groups should have SSH access from the internet restrictedAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
1.3.1: Network access to and from the cardholder data environment is restricted. (12 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service function apps should have public access restrictions configuredApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'Function apps should have virtual network integration enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure Key Vaults should use private linkKubernetes clusters should have public access restrictions configuredNetwork security groups should have SSH access from the internet restrictedAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
1.3.2: Network access to and from the cardholder data environment is restricted. (12 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service function apps should have public access restrictions configuredApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'Function apps should have virtual network integration enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure Key Vaults should use private linkKubernetes clusters should have public access restrictions configuredNetwork security groups should have SSH access from the internet restrictedAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
1.4.1: Network connections between trusted and untrusted networks are controlled. (2 controls)
1.4.2: Network connections between trusted and untrusted networks are controlled. (12 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service function apps should have public access restrictions configuredApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'Function apps should have virtual network integration enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure Key Vaults should use private linkKubernetes clusters should have public access restrictions configuredNetwork security groups should have SSH access from the internet restrictedAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
1.4.4: Network connections between trusted and untrusted networks are controlled. (2 controls)
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. (8 controls)
App Service function apps should have public access restrictions configuredFunction apps should have virtual network integration enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure Key Vaults should use private linkKubernetes clusters should have public access restrictions configuredNetwork security groups should have SSH access from the internet restrictedAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (8 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredMicrosoft Defender for Cloud policy assignments should have enforcement mode set to DefaultAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (6 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
10.3.1: Audit logs are protected from destruction and unauthorized modifications. (2 controls)
10.3.2: Audit logs are protected from destruction and unauthorized modifications. (5 controls)
App Service function apps should have public access restrictions configuredKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Azure Blob Storage accounts should have soft delete enabled for containers
10.3.3: Audit logs are protected from destruction and unauthorized modifications. (2 controls)
10.3.4: Audit logs are protected from destruction and unauthorized modifications. (2 controls)
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. (3 controls)
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. (3 controls)
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. (4 controls)
Azure subscriptions should have at least one Application Insights resource configuredMicrosoft Defender for Cloud policy assignments should have enforcement mode set to DefaultAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity. (1 control)
10.5.1: Audit log history is retained and available for analysis. (1 control)
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. (3 controls)
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. (4 controls)
Azure subscriptions should have at least one Application Insights resource configuredMicrosoft Defender for Cloud policy assignments should have enforcement mode set to DefaultAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. (4 controls)
Azure subscriptions should have at least one Application Insights resource configuredMicrosoft Defender for Cloud policy assignments should have enforcement mode set to DefaultAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed. (1 control)
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. (1 control)
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. (1 control)
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. (1 control)
11.5.1: Network intrusions and unexpected file changes are detected and responded to. (1 control)
11.5.2: Network intrusions and unexpected file changes are detected and responded to. (2 controls)
11.6.1: Unauthorized changes on payment pages are detected and responded to. (1 control)
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. (2 controls)
2.2.5: System components are configured and managed securely. (8 controls)
App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service apps should have FTP deployments disabledApp Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessNetwork security groups should prohibit inbound HTTP (port 80) access from the internetNetwork security groups should have SSH access from the internet restrictedStorage accounts should have secure transfer enabled
2.2.7: System components are configured and managed securely. (9 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'App Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessNetwork security groups should prohibit inbound HTTP (port 80) access from the internetStorage accounts should have secure transfer enabled
3.5.1.1: Primary account number (PAN) is secured wherever it is stored. (2 controls)
3.5.1.3: Primary account number (PAN) is secured wherever it is stored. (6 controls)
App Service function apps should have public access restrictions configuredKey vaults should have Role-Based Access Control (RBAC) enabledNon-RBAC key vaults should have 'Expiration Date' configured for all keysSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Azure Blob Storage accounts should have soft delete enabled for containers
3.5.1: Primary account number (PAN) is secured wherever it is stored. (11 controls)
Unattached managed disks should be encrypted with ADE or customer-managed keysUnattached managed disks should use customer-managed keys (CMK) for encryptionVirtual machines should use managed disks for OS and data disksVirtual machines should use managed disksKey vaults should have resource logs enabledStorage accounts containing operational log containers should use customer-managed keys for encryptionSQL databases should have transparent data encryption enabledSQL databases should have Transparent Data Encryption enabledStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabled
3.6.1.2: Cryptographic keys used to protect stored account data are secured. (2 controls)
3.6.1.3: Cryptographic keys used to protect stored account data are secured. (2 controls)
3.6.1.4: Cryptographic keys used to protect stored account data are secured. (2 controls)
3.6.1: Cryptographic keys used to protect stored account data are secured. (2 controls)
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (2 controls)
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (2 controls)
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (3 controls)
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (2 controls)
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (2 controls)
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (2 controls)
4.2.1.1: PAN is protected with strong cryptography during transmission. (8 controls)
App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'App Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessNetwork security groups should prohibit inbound HTTP (port 80) access from the internetStorage accounts should have secure transfer enabled
4.2.1: PAN is protected with strong cryptography during transmission. (8 controls)
App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'App Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessNetwork security groups should prohibit inbound HTTP (port 80) access from the internetStorage accounts should have secure transfer enabled
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. (1 control)
6.3.3: Security vulnerabilities are identified and addressed. (1 control)
7.2.1: Access to system components and data is appropriately defined and assigned. (7 controls)
Function apps should use managed identityKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
7.2.2: Access to system components and data is appropriately defined and assigned. (7 controls)
Function apps should use managed identityKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
7.2.3: Access to system components and data is appropriately defined and assigned. (2 controls)
7.2.5: Access to system components and data is appropriately defined and assigned. (7 controls)
Function apps should use managed identityKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
7.2.6: Access to system components and data is appropriately defined and assigned. (3 controls)
7.3.1: Access to system components and data is managed via an access control system(s). (7 controls)
Function apps should use managed identityKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
7.3.2: Access to system components and data is managed via an access control system(s). (7 controls)
Function apps should use managed identityKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
7.3.3: Access to system components and data is managed via an access control system(s). (7 controls)
Function apps should use managed identityKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (1 control)
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (1 control)
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (3 controls)
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (3 controls)
8.3.10.1: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.2: Strong authentication for users and administrators is established and managed. (7 controls)
App Service apps should have Client Certificates (Incoming client certificates) enabledApp Service apps should have 'Client Certificates (Incoming client certificates)' enabledApp Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'App Service web apps should use the latest TLS versionNetwork security groups should prohibit inbound HTTP (port 80) access from the internetKey vaults should have resource logs enabledStorage accounts containing operational log containers should use customer-managed keys for encryption
8.3.4: Strong authentication for users and administrators is established and managed. (3 controls)
8.3.5: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.7: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.9: Strong authentication for users and administrators is established and managed. (2 controls)
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. (3 controls)
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. (3 controls)
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. (3 controls)
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. (2 controls)
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. (5 controls)
App Service function apps should have public access restrictions configuredKubernetes clusters should use Role-Based Access Control (RBAC)SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Azure Blob Storage accounts should have soft delete enabled for containers
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. (7 controls)
App Service function apps should have public access restrictions configuredFunction apps should have virtual network integration enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure Key Vaults should use private linkNetwork security groups should have SSH access from the internet restrictedSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. (7 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsMySQL flexible servers should have 'audit_log_enabled' set to 'ON'Flow log resources should have flow logging enabledSQL servers should have auditing enabled
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers. (1 control)
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. (3 controls)
A3.4.1: Logical access to the cardholder data environment is controlled and managed. (6 controls)
App Service function apps should have public access restrictions configuredNon-RBAC key vaults should have 'Expiration Date' configured for all secretsKubernetes clusters should use Role-Based Access Control (RBAC)SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Azure Blob Storage accounts should have soft delete enabled for containers
A3.5.1: Suspicious events are identified and responded to. (4 controls)
Azure subscriptions should have at least one Application Insights resource configuredMicrosoft Defender for Cloud policy assignments should have enforcement mode set to DefaultAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
Related Frameworks
NIS2 Directive (EU 2022/2555) — 🟢 High overlap (93%)
CIS Azure Benchmark v2.0.0 — 🟢 High overlap (85%)
CIS Azure Benchmark v2.1.0 — 🟢 High overlap (80%)