Azure Compliance FrameworksCore Frameworks
SOC 2
Service Organization Control 2 (SOC 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA) for evaluating service organizations' security, availability, processing integrity, confidentiality, and privacy controls. Based on the Trust Services Criteria, SOC 2 reports provide assurance to customers about a service provider's internal controls. It is primarily used by technology and cloud service providers globally to demonstrate security practices to customers and stakeholders.
| Mandatory? | Voluntary — required by enterprise procurement |
| Who validates? | Licensed CPA firm (SSAE 18) · No self-assessment |
| Renewal | Typically annual |
| Observation period | Type II: 3–12 months |
Controls by Category
A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives (2 controls)
C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality (1 control)
CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control (5 controls)
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed (5 controls)
Running container images should have no unresolved vulnerabilitiesVirtual machines should have a vulnerability assessment solution enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabled
CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate (6 controls)
Virtual machines should have system updates installedMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have email notifications for high severity alerts enabled
CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives (5 controls)
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives (5 controls)
App Service function apps should have public access restrictions configuredPublic IP addresses should not be listed in ShodanContainer registries should have public network access disabledKubernetes clusters should have public access restrictions configuredStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives (1 control)
CC6.6 The entity implements logical access security measures to protect against threats from sources outside its system boundaries (11 controls)
App Service apps should use the latest TLS versionApp Service web apps should use the latest TLS versionNetwork security groups should prohibit inbound HTTP (port 80) access from the internetSQL servers should have minimum TLS version set to 1.2 or higherMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherMySQL flexible servers should have 'require_secure_transport' set to 'ON'Network security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetPostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'
CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives (6 controls)
App Service apps should use the latest TLS versionApp Service web apps should use the latest TLS versionUnattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionStorage accounts should have secure transfer enabled
CC6.8 The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives (23 controls)
Virtual machines should have endpoint protection installedRunning container images should have no unresolved vulnerabilitiesAzure subscriptions should have Microsoft Defender for IoT Hub enabledVirtual machines should have system updates installedAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Azure Cosmos DB enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledMicrosoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selectedAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledSecurity Center should have Windows Defender ATP (WDATP) integration selectedCritical SQL servers should have Microsoft Defender for SQL set to 'On'Unprotected Azure SQL servers should have Azure Defender for SQL enabled
CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities (26 controls)
Virtual machines should have endpoint protection installedRunning container images should have no unresolved vulnerabilitiesAzure subscriptions should have Microsoft Defender for IoT Hub enabledVirtual machines should have system updates installedVirtual machines should have a vulnerability assessment solution enabledMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have Microsoft Defender for App Service enabledAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Azure Cosmos DB enabledAzure subscriptions should have Microsoft Defender for Databases enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Key Vault enabledAzure subscriptions should have Microsoft Defender for open-source relational databases enabledAzure subscriptions should have Azure Defender for Resource Manager enabledAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Azure SQL Database servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabledAzure subscriptions should have Microsoft Defender for Storage enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledMicrosoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selectedAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledSecurity Center should have Windows Defender ATP (WDATP) integration selectedCritical SQL servers should have Microsoft Defender for SQL set to 'On'Unprotected Azure SQL servers should have Azure Defender for SQL enabled
CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events (10 controls)
App Service apps should have 'HTTP logs' enabledPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabled
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures (14 controls)
App Service apps should have 'HTTP logs' enabledKey vaults should have resource logs enabledAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address ruleAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Flow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 daysAzure subscriptions should have auto provisioning of the Log Analytics agent enabledAzure subscriptions should have email notifications for high severity alerts enabled
CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate (1 control)
CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives (1 control)
PI1.2 System inputs are measured and recorded completely, accurately, and timely to meet the entity's processing integrity commitments and system requirements (1 control)
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements (3 controls)
PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements (11 controls)
Unattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionKey vault keys should have automatic rotation enabledKey vaults should have deletion protection enabledKey vaults should have soft delete enabledStorage accounts containing operational log containers should use customer-managed keys for encryptionAzure Blob Storage accounts should have soft delete enabled for containersStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabled
Related Frameworks
NIS2 Directive (EU 2022/2555) — 🟢 High overlap (97%)
BSI C5:2025 — 🟢 High overlap (96%)
CIS Azure Benchmark v2.0.0 — 🟢 High overlap (88%)