| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
1.6 |
CIS_Azure_1.1.0_1.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.6 |
1 Identity and Access Management |
Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. |
link |
4 |
| CIS_Azure_1.1.0 |
1.7 |
CIS_Azure_1.1.0_1.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.7 |
1 Identity and Access Management |
Ensure that 'Notify users on password resets?' is set to 'Yes' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that users are notified on their primary and secondary emails on password resets. |
link |
5 |
| CIS_Azure_1.1.0 |
1.8 |
CIS_Azure_1.1.0_1.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.8 |
1 Identity and Access Management |
Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that all administrators are notified if any other administrator resets their password. |
link |
10 |
| CIS_Azure_1.1.0 |
4.19 |
CIS_Azure_1.1.0_4.19 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.19 |
4 Database Services |
Ensure that Azure Active Directory Admin is configured |
Shared |
The customer is responsible for implementing this recommendation. |
Use Azure Active Directory Authentication for authentication with SQL Database. |
link |
4 |
| CIS_Azure_1.1.0 |
4.8 |
CIS_Azure_1.1.0_4.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.8 |
4 Database Services |
Ensure that Azure Active Directory Admin is configured |
Shared |
The customer is responsible for implementing this recommendation. |
Use Azure Active Directory Authentication for authentication with SQL Database. |
link |
5 |
| CIS_Azure_1.1.0 |
9.5 |
CIS_Azure_1.1.0_9.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 9.5 |
9 AppService |
Ensure that Register with Azure Active Directory is enabled on App Service |
Shared |
The customer is responsible for implementing this recommendation. |
Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords. |
link |
6 |
| CIS_Azure_1.3.0 |
1.6 |
CIS_Azure_1.3.0_1.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.6 |
1 Identity and Access Management |
Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0" |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. |
link |
4 |
| CIS_Azure_1.3.0 |
1.7 |
CIS_Azure_1.3.0_1.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.7 |
1 Identity and Access Management |
Ensure that 'Notify users on password resets?' is set to 'Yes' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that users are notified on their primary and secondary emails on password resets. |
link |
5 |
| CIS_Azure_1.3.0 |
1.8 |
CIS_Azure_1.3.0_1.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.8 |
1 Identity and Access Management |
Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that all administrators are notified if any other administrator resets their password. |
link |
10 |
| CIS_Azure_1.3.0 |
4.4 |
CIS_Azure_1.3.0_4.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.4 |
4 Database Services |
Ensure that Azure Active Directory Admin is configured |
Shared |
The customer is responsible for implementing this recommendation. |
Use Azure Active Directory Authentication for authentication with SQL Database. |
link |
5 |
| CIS_Azure_1.3.0 |
9.5 |
CIS_Azure_1.3.0_9.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 9.5 |
9 AppService |
Ensure that Register with Azure Active Directory is enabled on App Service |
Shared |
The customer is responsible for implementing this recommendation. |
Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords. |
link |
6 |
| CIS_Azure_1.4.0 |
1.6 |
CIS_Azure_1.4.0_1.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.6 |
1 Identity and Access Management |
Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. |
link |
4 |
| CIS_Azure_1.4.0 |
1.7 |
CIS_Azure_1.4.0_1.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.7 |
1 Identity and Access Management |
Ensure that 'Notify users on password resets?' is set to 'Yes' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that users are notified on their primary and secondary emails on password resets. |
link |
5 |
| CIS_Azure_1.4.0 |
1.8 |
CIS_Azure_1.4.0_1.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.8 |
1 Identity and Access Management |
Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes' |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure that all administrators are notified if any other administrator resets their password. |
link |
10 |
| CIS_Azure_1.4.0 |
4.5 |
CIS_Azure_1.4.0_4.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.5 |
4 Database Services |
Ensure that Azure Active Directory Admin is configured |
Shared |
The customer is responsible for implementing this recommendation. |
Use Azure Active Directory Authentication for authentication with SQL Database to manage credentials in a single place. |
link |
5 |
| CIS_Azure_1.4.0 |
9.5 |
CIS_Azure_1.4.0_9.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 9.5 |
9 AppService |
Ensure that Register with Azure Active Directory is enabled on App Service |
Shared |
The customer is responsible for implementing this recommendation. |
Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords. |
link |
6 |
| FedRAMP_High_R4 |
AC-2(1) |
FedRAMP_High_R4_AC-2(1) |
FedRAMP High AC-2 (1) |
Access Control |
Automated System Account Management |
Shared |
n/a |
The organization employs automated mechanisms to support the management of information system accounts.
Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage. |
link |
7 |
| FedRAMP_High_R4 |
AC-2(4) |
FedRAMP_High_R4_AC-2(4) |
FedRAMP High AC-2 (4) |
Access Control |
Automated Audit Actions |
Shared |
n/a |
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Related controls: AU-2, AU-12. |
link |
5 |
| FedRAMP_Moderate_R4 |
AC-2(1) |
FedRAMP_Moderate_R4_AC-2(1) |
FedRAMP Moderate AC-2 (1) |
Access Control |
Automated System Account Management |
Shared |
n/a |
The organization employs automated mechanisms to support the management of information system accounts.
Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage. |
link |
7 |
| FedRAMP_Moderate_R4 |
AC-2(4) |
FedRAMP_Moderate_R4_AC-2(4) |
FedRAMP Moderate AC-2 (4) |
Access Control |
Automated Audit Actions |
Shared |
n/a |
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Related controls: AU-2, AU-12. |
link |
5 |
| hipaa |
11155.02i2Organizational.2-02.i |
hipaa-11155.02i2Organizational.2-02.i |
11155.02i2Organizational.2-02.i |
11 Access Control |
11155.02i2Organizational.2-02.i 02.04 Termination or Change of Employment |
Shared |
n/a |
The organization employs automated mechanisms to notify specific personnel or roles (formally defined by the organization) upon termination of an individual. |
|
10 |
| hipaa |
1208.09aa3System.1-09.aa |
hipaa-1208.09aa3System.1-09.aa |
1208.09aa3System.1-09.aa |
12 Audit Logging & Monitoring |
1208.09aa3System.1-09.aa 09.10 Monitoring |
Shared |
n/a |
Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes. |
|
18 |
| ISO27001-2013 |
A.12.4.1 |
ISO27001-2013_A.12.4.1 |
ISO 27001:2013 A.12.4.1 |
Operations Security |
Event Logging |
Shared |
n/a |
Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. |
link |
53 |
| ISO27001-2013 |
A.12.4.3 |
ISO27001-2013_A.12.4.3 |
ISO 27001:2013 A.12.4.3 |
Operations Security |
Administrator and operator logs |
Shared |
n/a |
System administrator and system operator activities shall be logged and the logs protected and regularly reviewed. |
link |
29 |
| ISO27001-2013 |
A.9.1.2 |
ISO27001-2013_A.9.1.2 |
ISO 27001:2013 A.9.1.2 |
Access Control |
Access to networks and network services |
Shared |
n/a |
Users shall only be provided with access to the network and network services that they have been specifically authorized to use. |
link |
29 |
| ISO27001-2013 |
A.9.2.2 |
ISO27001-2013_A.9.2.2 |
ISO 27001:2013 A.9.2.2 |
Access Control |
User access provisioning |
Shared |
n/a |
A formal user access provisioning process shall be implemented to assign or revoke access rights for all user types to all systems and services. |
link |
19 |
| ISO27001-2013 |
A.9.2.3 |
ISO27001-2013_A.9.2.3 |
ISO 27001:2013 A.9.2.3 |
Access Control |
Management of privileged access rights |
Shared |
n/a |
The allocation and use of privileged access rights shall be restricted and controlled. |
link |
33 |
| ISO27001-2013 |
A.9.4.1 |
ISO27001-2013_A.9.4.1 |
ISO 27001:2013 A.9.4.1 |
Access Control |
Information access restriction |
Shared |
n/a |
Access to information and application system functions shall be restricted in accordance with the access control policy. |
link |
11 |
| NIST_SP_800-53_R4 |
AC-2(1) |
NIST_SP_800-53_R4_AC-2(1) |
NIST SP 800-53 Rev. 4 AC-2 (1) |
Access Control |
Automated System Account Management |
Shared |
n/a |
The organization employs automated mechanisms to support the management of information system accounts.
Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage. |
link |
7 |
| NIST_SP_800-53_R4 |
AC-2(4) |
NIST_SP_800-53_R4_AC-2(4) |
NIST SP 800-53 Rev. 4 AC-2 (4) |
Access Control |
Automated Audit Actions |
Shared |
n/a |
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Related controls: AU-2, AU-12. |
link |
5 |
| NIST_SP_800-53_R5 |
AC-2(1) |
NIST_SP_800-53_R5_AC-2(1) |
NIST SP 800-53 Rev. 5 AC-2 (1) |
Access Control |
Automated System Account Management |
Shared |
n/a |
Support the management of system accounts using [Assignment: organization-defined automated mechanisms]. |
link |
7 |
| NIST_SP_800-53_R5 |
AC-2(4) |
NIST_SP_800-53_R5_AC-2(4) |
NIST SP 800-53 Rev. 5 AC-2 (4) |
Access Control |
Automated Audit Actions |
Shared |
n/a |
Automatically audit account creation, modification, enabling, disabling, and removal actions. |
link |
5 |
| PCI_DSS_v4.0 |
10.2.1.5 |
PCI_DSS_v4.0_10.2.1.5 |
PCI DSS v4.0 10.2.1.5 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture all changes to identification and authentication credentials including, but not limited to:
• Creation of new accounts.
• Elevation of privileges.
• All changes, additions, or deletions to accounts with administrative access. |
link |
13 |
| PCI_DSS_v4.0 |
7.3.1 |
PCI_DSS_v4.0_7.3.1 |
PCI DSS v4.0 7.3.1 |
Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know |
Access to system components and data is managed via an access control system(s) |
Shared |
n/a |
An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components. |
link |
17 |
| PCI_DSS_v4.0 |
7.3.2 |
PCI_DSS_v4.0_7.3.2 |
PCI DSS v4.0 7.3.2 |
Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know |
Access to system components and data is managed via an access control system(s) |
Shared |
n/a |
The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function. |
link |
10 |
| SWIFT_CSCF_v2022 |
5.1 |
SWIFT_CSCF_v2022_5.1 |
SWIFT CSCF v2022 5.1 |
5. Manage Identities and Segregate Privileges |
Enforce the security principles of need-to-know access, least privilege, and separation of duties for operator accounts. |
Shared |
n/a |
Accounts are defined according to the security principles of need-to-know access, least privilege, and separation of duties. |
link |
35 |