last sync: 2023-Jan-27 18:40:07 UTC

Azure Policy definition

Adhere to retention periods defined

Name Adhere to retention periods defined
Azure Portal
Id 1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1
Version 1.1.0
details on versioning
Category Regulatory Compliance
Microsoft docs
Description CMA_0004 - Adhere to retention periods defined
Mode All
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default
Manual
Allowed
Manual, Disabled
RBAC
Role(s)
none
Rule
Aliases
Rule
ResourceTypes
IF (1)
Microsoft.Resources/subscriptions
Compliance The following 44 compliance controls are associated with this Policy definition 'Adhere to retention periods defined' (1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
CIS_Azure_1.1.0 4.18 CIS_Azure_1.1.0_4.18 CIS Microsoft Azure Foundations Benchmark recommendation 4.18 4 Database Services Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server Shared The customer is responsible for implementing this recommendation. Enable 'log_retention_days' on 'PostgreSQL Servers'. link 4
CIS_Azure_1.1.0 4.3 CIS_Azure_1.1.0_4.3 CIS Microsoft Azure Foundations Benchmark recommendation 4.3 4 Database Services Ensure that 'Auditing' Retention is 'greater than 90 days' Shared The customer is responsible for implementing this recommendation. SQL Server Audit Retention should be configured to be greater than 90 days. link 5
CIS_Azure_1.1.0 5.1.1 CIS_Azure_1.1.0_5.1.1 CIS Microsoft Azure Foundations Benchmark recommendation 5.1.1 5 Logging and Monitoring Ensure that a Log Profile exists Shared The customer is responsible for implementing this recommendation. Enable log profile for exporting activity logs. link 5
CIS_Azure_1.1.0 5.1.2 CIS_Azure_1.1.0_5.1.2 CIS Microsoft Azure Foundations Benchmark recommendation 5.1.2 5 Logging and Monitoring Ensure that Activity Log Retention is set 365 days or greater Shared The customer is responsible for implementing this recommendation. Ensure activity log retention is set for 365 days or greater. link 4
CIS_Azure_1.1.0 5.1.3 CIS_Azure_1.1.0_5.1.3 CIS Microsoft Azure Foundations Benchmark recommendation 5.1.3 5 Logging and Monitoring Ensure audit profile captures all the activities Shared The customer is responsible for implementing this recommendation. The log profile should be configured to export all activities from the control/management plane. link 5
CIS_Azure_1.1.0 5.1.4 CIS_Azure_1.1.0_5.1.4 CIS Microsoft Azure Foundations Benchmark recommendation 5.1.4 5 Logging and Monitoring Ensure the log profile captures activity logs for all regions including global Shared The customer is responsible for implementing this recommendation. Configure the log profile to export activities from all Azure supported regions/locations including global. link 5
CIS_Azure_1.1.0 6.4 CIS_Azure_1.1.0_6.4 CIS Microsoft Azure Foundations Benchmark recommendation 6.4 6 Networking Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' Shared The customer is responsible for implementing this recommendation. Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days. link 3
CIS_Azure_1.3.0 4.1.3 CIS_Azure_1.3.0_4.1.3 CIS Microsoft Azure Foundations Benchmark recommendation 4.1.3 4 Database Services Ensure that 'Auditing' Retention is 'greater than 90 days' Shared The customer is responsible for implementing this recommendation. SQL Server Audit Retention should be configured to be greater than 90 days. link 5
CIS_Azure_1.3.0 4.3.7 CIS_Azure_1.3.0_4.3.7 CIS Microsoft Azure Foundations Benchmark recommendation 4.3.7 4 Database Services Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server Shared The customer is responsible for implementing this recommendation. Enable 'log_retention_days' on 'PostgreSQL Servers'. link 4
CIS_Azure_1.3.0 5.3 CIS_Azure_1.3.0_5.3 CIS Microsoft Azure Foundations Benchmark recommendation 5.3 5 Logging and Monitoring Ensure that Diagnostic Logs are enabled for all services which support it. Shared The customer is responsible for implementing this recommendation. Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts. A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended. Note: The CIS Benchmark covers some specific Diagnostic Logs separately. ''' 3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' ''' link 21
CIS_Azure_1.3.0 6.4 CIS_Azure_1.3.0_6.4 CIS Microsoft Azure Foundations Benchmark recommendation 6.4 6 Networking Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' Shared The customer is responsible for implementing this recommendation. Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days. link 3
CIS_Azure_1.4.0 4.1.3 CIS_Azure_1.4.0_4.1.3 CIS Microsoft Azure Foundations Benchmark recommendation 4.1.3 4 Database Services Ensure that 'Auditing' Retention is 'greater than 90 days' Shared The customer is responsible for implementing this recommendation. SQL Server Audit Retention should be configured to be greater than 90 days. link 5
CIS_Azure_1.4.0 4.3.6 CIS_Azure_1.4.0_4.3.6 CIS Microsoft Azure Foundations Benchmark recommendation 4.3.6 4 Database Services Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server Shared The customer is responsible for implementing this recommendation. Enable 'log_retention_days' on 'PostgreSQL Servers'. link 4
CIS_Azure_1.4.0 5.3 CIS_Azure_1.4.0_5.3 CIS Microsoft Azure Foundations Benchmark recommendation 5.3 5 Logging and Monitoring Ensure that Diagnostic Logs Are Enabled for All Services that Support it. Shared The customer is responsible for implementing this recommendation. Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts. A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended. Note: The CIS Benchmark covers some specific Diagnostic Logs separately. ''' 3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' ''' link 21
CIS_Azure_1.4.0 6.4 CIS_Azure_1.4.0_6.4 CIS Microsoft Azure Foundations Benchmark recommendation 6.4 6 Networking Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' Shared The customer is responsible for implementing this recommendation. Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days. link 3
FedRAMP_High_R4 AU-11 FedRAMP_High_R4_AU-11 FedRAMP High AU-11 Audit And Accountability Audit Record Retention Shared n/a The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. Supplemental Guidance: Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention. Related controls: AU-4, AU-5, AU-9, MP-6. References: None. link 4
FedRAMP_Moderate_R4 AU-11 FedRAMP_Moderate_R4_AU-11 FedRAMP Moderate AU-11 Audit And Accountability Audit Record Retention Shared n/a The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. Supplemental Guidance: Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention. Related controls: AU-4, AU-5, AU-9, MP-6. References: None. link 4
hipaa 0670.10hCSPSystem.2-10.h hipaa-0670.10hCSPSystem.2-10.h 0670.10hCSPSystem.2-10.h 06 Configuration Management 0670.10hCSPSystem.2-10.h 10.04 Security of System Files Shared n/a Structured and unstructured data is available to the organization (customer) and provided to them upon request in an industry-standard format (e.g., .docx, .xlsx, pdf, logs, and flat files). 3
hipaa 1207.09aa2System.4-09.aa hipaa-1207.09aa2System.4-09.aa 1207.09aa2System.4-09.aa 12 Audit Logging & Monitoring 1207.09aa2System.4-09.aa 09.10 Monitoring Shared n/a Audit records are retained for 90 days and older audit records are archived for one year. 13
hipaa 1210.09aa3System.3-09.aa hipaa-1210.09aa3System.3-09.aa 1210.09aa3System.3-09.aa 12 Audit Logging & Monitoring 1210.09aa3System.3-09.aa 09.10 Monitoring Shared n/a All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender. 11
hipaa 1211.09aa3System.4-09.aa hipaa-1211.09aa3System.4-09.aa 1211.09aa3System.4-09.aa 12 Audit Logging & Monitoring 1211.09aa3System.4-09.aa 09.10 Monitoring Shared n/a The organization verifies every 90 days for each extract of covered information recorded that the data is erased or its use is still required. 9
hipaa 1826.09p1Organizational.1-09.p hipaa-1826.09p1Organizational.1-09.p 1826.09p1Organizational.1-09.p 18 Physical & Environmental Security 1826.09p1Organizational.1-09.p 09.07 Media Handling Shared n/a The organization securely disposes of media containing sensitive information. 3
hipaa 1904.06.d2Organizational.1-06.d hipaa-1904.06.d2Organizational.1-06.d 1904.06.d2Organizational.1-06.d 19 Data Protection & Privacy 1904.06.d2Organizational.1-06.d 06.01 Compliance with Legal Requirements Shared n/a Covered information is retained only for as long as required. 3
hipaa 1908.06.c1Organizational.4-06.c hipaa-1908.06.c1Organizational.4-06.c 1908.06.c1Organizational.4-06.c 19 Data Protection & Privacy 1908.06.c1Organizational.4-06.c 06.01 Compliance with Legal Requirements Shared n/a The organization documents and maintains (i) designated record sets that are subject to access by individuals, and (ii) titles of the persons or office responsible for receiving and processing requests for access by individuals as organizational records for a period of six years. 11
hipaa 19142.06c1Organizational.8-06.c hipaa-19142.06c1Organizational.8-06.c 19142.06c1Organizational.8-06.c 19 Data Protection & Privacy 19142.06c1Organizational.8-06.c 06.01 Compliance with Legal Requirements Shared n/a Guidelines are issued by the organization on the ownership, classification, retention, storage, handling and disposal of all records and information. 9
hipaa 19144.06c2Organizational.1-06.c hipaa-19144.06c2Organizational.1-06.c 19144.06c2Organizational.1-06.c 19 Data Protection & Privacy 19144.06c2Organizational.1-06.c 06.01 Compliance with Legal Requirements Shared n/a The organization has established a formal records document retention program. 7
hipaa 19145.06c2Organizational.2-06.c hipaa-19145.06c2Organizational.2-06.c 19145.06c2Organizational.2-06.c 19 Data Protection & Privacy 19145.06c2Organizational.2-06.c 06.01 Compliance with Legal Requirements Shared n/a Specific controls for record storage, access, retention, and destruction have been implemented. 8
ISO27001-2013 A.11.2.7 ISO27001-2013_A.11.2.7 ISO 27001:2013 A.11.2.7 Physical And Environmental Security Secure disposal or re-use of equipment Shared n/a All items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use. link 5
ISO27001-2013 A.12.3.1 ISO27001-2013_A.12.3.1 ISO 27001:2013 A.12.3.1 Operations Security Information backup Shared n/a Backup copies of information, software and system images shall be taken and tested regularly in accordance with an agreed backup policy. link 13
ISO27001-2013 A.12.4.1 ISO27001-2013_A.12.4.1 ISO 27001:2013 A.12.4.1 Operations Security Event Logging Shared n/a Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. link 53
ISO27001-2013 A.12.4.2 ISO27001-2013_A.12.4.2 ISO 27001:2013 A.12.4.2 Operations Security Protection of log information Shared n/a Logging facilities and log information shall be protected against tampering and unauthorized access. link 8
ISO27001-2013 A.14.3.1 ISO27001-2013_A.14.3.1 ISO 27001:2013 A.14.3.1 System Acquisition, Development And Maintenance Protection of test data Shared n/a Test data shall be selected carefully, protected and controlled. link 11
ISO27001-2013 A.16.1.7 ISO27001-2013_A.16.1.7 ISO 27001:2013 A.16.1.7 Information Security Incident Management Collection of evidence Shared n/a The organization shall define and apply procedures for the identification, collection, acquisition and preservation of information which can serve as evidence. link 7
ISO27001-2013 C.9.2.g ISO27001-2013_C.9.2.g ISO 27001:2013 C.9.2.g Performance Evaluation Internal audit Shared n/a The organization shall conduct internal audits at planned intervals to provide information on whether the information security management system: g) retain documented information as evidence of the audit programme(s) and the audit results. link 3
NIST_SP_800-171_R2_3 .3.1 NIST_SP_800-171_R2_3.3.1 NIST SP 800-171 R2 3.3.1 Audit and Accountability Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity Shared Microsoft and the customer share responsibilities for implementing this requirement. An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures. Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. [SP 800-92] provides guidance on security log management. link 55
NIST_SP_800-53_R4 AU-11 NIST_SP_800-53_R4_AU-11 NIST SP 800-53 Rev. 4 AU-11 Audit And Accountability Audit Record Retention Shared n/a The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. Supplemental Guidance: Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention. Related controls: AU-4, AU-5, AU-9, MP-6. References: None. link 4
NIST_SP_800-53_R5 AU-11 NIST_SP_800-53_R5_AU-11 NIST SP 800-53 Rev. 5 AU-11 Audit and Accountability Audit Record Retention Shared n/a Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. link 4
PCI_DSS_v4.0 10.5.1 PCI_DSS_v4.0_10.5.1 PCI DSS v4.0 10.5.1 Requirement 10: Log and Monitor All Access to System Components and Cardholder Data Audit log history is retained and available for analysis Shared n/a Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis. link 3
PCI_DSS_v4.0 3.2.1 PCI_DSS_v4.0_3.2.1 PCI DSS v4.0 3.2.1 Requirement 03: Protect Stored Account Data Storage of account data is kept to a minimum Shared n/a Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes that include at least the following: • Coverage for all locations of stored account data. • Coverage for any sensitive authentication data (SAD) stored prior to completion of authorization. This bullet is a best practice until its effective date; refer to Applicability Notes below for details. • Limiting data storage amount and retention time to that which is required for legal or regulatory, and/or business requirements. • Specific retention requirements for stored account data that defines length of retention period and includes a documented business justification. • Processes for secure deletion or rendering account data unrecoverable when no longer needed per the retention policy. • A process for verifying, at least once every three months, that stored account data exceeding the defined retention period has been securely deleted or rendered unrecoverable. link 8
PCI_DSS_v4.0 3.3.1 PCI_DSS_v4.0_3.3.1 PCI DSS v4.0 3.3.1 Requirement 03: Protect Stored Account Data Sensitive authentication data (SAD) is not stored after authorization Shared n/a SAD is not retained after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process. link 8
PCI_DSS_v4.0 3.3.1.1 PCI_DSS_v4.0_3.3.1.1 PCI DSS v4.0 3.3.1.1 Requirement 03: Protect Stored Account Data Sensitive authentication data (SAD) is not stored after authorization Shared n/a The full contents of any track are not retained upon completion of the authorization process. link 8
PCI_DSS_v4.0 3.3.1.3 PCI_DSS_v4.0_3.3.1.3 PCI DSS v4.0 3.3.1.3 Requirement 03: Protect Stored Account Data Sensitive authentication data (SAD) is not stored after authorization Shared n/a The personal identification number (PIN) and the PIN block are not retained upon completion of the authorization process. link 8
PCI_DSS_v4.0 5.3.4 PCI_DSS_v4.0_5.3.4 PCI DSS v4.0 5.3.4 Requirement 05: Protect All Systems and Networks from Malicious Software Anti-malware mechanisms and processes are active, maintained, and monitored Shared n/a Audit logs for the anti-malware solution are enabled and retained in accordance with Requirement 10.5.1. link 4
SOC_2 P4.2 SOC_2_P4.2 SOC 2 Type 2 P4.2 Additional Criteria For Privacy Personal information retention Shared The customer is responsible for implementing this recommendation. • Retains Personal Information — Personal information is retained for no longer than necessary to fulfill the stated purposes, unless a law or regulation specifically requires otherwise. • Protects Personal Information — Policies and procedures have been implemented to protect personal information from erasure or destruction during the specified retention period of the information. 2
History
Date/Time (UTC ymd) (i) Change type Change detail
2022-09-27 16:35:32 change Minor (1.0.0 > 1.1.0)
2022-08-26 16:33:38 add 1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1
Initiatives
usage
Initiative DisplayName Initiative Id Initiative Category State Type
CIS Microsoft Azure Foundations Benchmark v1.1.0 1a5bb27d-173f-493e-9568-eb56638dde4d Regulatory Compliance GA BuiltIn
CIS Microsoft Azure Foundations Benchmark v1.3.0 612b5213-9160-4969-8578-1518bd2a000c Regulatory Compliance GA BuiltIn
CIS Microsoft Azure Foundations Benchmark v1.4.0 c3f5c4d9-9a1d-4a99-85c0-7f93e384d5c5 Regulatory Compliance GA BuiltIn
FedRAMP High d5264498-16f4-418a-b659-fa7ef418175f Regulatory Compliance GA BuiltIn
FedRAMP Moderate e95f5a9f-57ad-4d03-bb0b-b1d16db93693 Regulatory Compliance GA BuiltIn
HITRUST/HIPAA a169a624-5599-4385-a696-c8d643089fab Regulatory Compliance GA BuiltIn
ISO 27001:2013 89c6cddc-1c73-4ac1-b19c-54d1a15a42f2 Regulatory Compliance GA BuiltIn
NIST SP 800-171 Rev. 2 03055927-78bd-4236-86c0-f36125a10dc9 Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 4 cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 5 179d1daa-458f-4e47-8086-2a68d0d6c38f Regulatory Compliance GA BuiltIn
PCI DSS v4 c676748e-3af9-4e22-bc28-50feed564afb Regulatory Compliance GA BuiltIn
SOC 2 Type 2 4054785f-702b-4a98-9215-009cbd58b141 Regulatory Compliance GA BuiltIn
JSON
changes

JSON