compliance controls are associated with this Policy definition 'Determine auditable events' (2f67e567-03db-9d1f-67dc-b6ffb91312f4)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
2.14 |
CIS_Azure_1.1.0_2.14 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.14 |
2 Security Center |
Ensure ASC Default policy setting "Monitor SQL Auditing" is not "Disabled" |
Shared |
The customer is responsible for implementing this recommendation. |
Enable SQL auditing recommendations. |
link |
5 |
| CIS_Azure_1.1.0 |
3.3 |
CIS_Azure_1.1.0_3.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.3 |
3 Storage Accounts |
Ensure Storage logging is enabled for Queue service for read, write, and delete requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.1.0 |
4.1 |
CIS_Azure_1.1.0_4.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1 |
4 Database Services |
Ensure that 'Auditing' is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable auditing on SQL Servers. |
link |
5 |
| CIS_Azure_1.1.0 |
4.12 |
CIS_Azure_1.1.0_4.12 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.12 |
4 Database Services |
Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_checkpoints' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.1.0 |
4.14 |
CIS_Azure_1.1.0_4.14 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.14 |
4 Database Services |
Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_connections' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.1.0 |
4.15 |
CIS_Azure_1.1.0_4.15 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.15 |
4 Database Services |
Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_disconnections' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.1.0 |
4.16 |
CIS_Azure_1.1.0_4.16 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.16 |
4 Database Services |
Ensure server parameter 'log_duration' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_duration' on 'PostgreSQL Servers'. |
link |
4 |
| CIS_Azure_1.1.0 |
4.17 |
CIS_Azure_1.1.0_4.17 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.17 |
4 Database Services |
Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'connection_throttling' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.1.0 |
4.2 |
CIS_Azure_1.1.0_4.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.2 |
4 Database Services |
Ensure that 'AuditActionGroups' in 'auditing' policy for a SQL server is set properly |
Shared |
The customer is responsible for implementing this recommendation. |
Configure the 'AuditActionGroups' property to appropriate groups to capture all the critical activities on the SQL Server and all the SQL databases hosted on the SQL server. |
link |
5 |
| CIS_Azure_1.1.0 |
5.1.7 |
CIS_Azure_1.1.0_5.1.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.7 |
5 Logging and Monitoring |
Ensure that logging for Azure KeyVault is 'Enabled' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available. |
link |
6 |
| CIS_Azure_1.3.0 |
3.10 |
CIS_Azure_1.3.0_3.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.10 |
3 Storage Accounts |
Ensure Storage logging is enabled for Blob service for read, write, and delete requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Blob service provides scalable, cost-efficient objective storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.3.0 |
3.11 |
CIS_Azure_1.3.0_3.11 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.11 |
3 Storage Accounts |
Ensure Storage logging is enabled for Table service for read, write, and delete requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Table storage is a service that stores structure NoSQL data in the cloud, providing a key/attribute store with a schema less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.3.0 |
3.3 |
CIS_Azure_1.3.0_3.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.3 |
3 Storage Accounts |
Ensure Storage logging is enabled for Queue service for read, write, and delete requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.3.0 |
4.1.1 |
CIS_Azure_1.3.0_4.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1.1 |
4 Database Services |
Ensure that 'Auditing' is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable auditing on SQL Servers. |
link |
5 |
| CIS_Azure_1.3.0 |
4.3.3 |
CIS_Azure_1.3.0_4.3.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.3 |
4 Database Services |
Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_checkpoints' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.3.0 |
4.3.4 |
CIS_Azure_1.3.0_4.3.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.4 |
4 Database Services |
Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_connections' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.3.0 |
4.3.5 |
CIS_Azure_1.3.0_4.3.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.5 |
4 Database Services |
Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_disconnections' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.3.0 |
4.3.6 |
CIS_Azure_1.3.0_4.3.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.6 |
4 Database Services |
Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'connection_throttling' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.3.0 |
5.1.1 |
CIS_Azure_1.3.0_5.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.1 |
5 Logging and Monitoring |
Ensure that a 'Diagnostics Setting' exists |
Shared |
The customer is responsible for implementing this recommendation. |
Enable Diagnostic settings for exporting activity logs.
Diagnostic setting are available for each individual resources within a subscription. Settings should be configured for all appropriate resources for your environment. |
link |
1 |
| CIS_Azure_1.3.0 |
5.1.2 |
CIS_Azure_1.3.0_5.1.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.2 |
5 Logging and Monitoring |
Ensure Diagnostic Setting captures appropriate categories |
Shared |
The customer is responsible for implementing this recommendation. |
The diagnostic setting should be configured to log the appropriate activities from the control/management plane. |
link |
5 |
| CIS_Azure_1.3.0 |
5.1.5 |
CIS_Azure_1.3.0_5.1.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.5 |
5 Logging and Monitoring |
Ensure that logging for Azure KeyVault is 'Enabled' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available. |
link |
5 |
| CIS_Azure_1.3.0 |
5.3 |
CIS_Azure_1.3.0_5.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.3 |
5 Logging and Monitoring |
Ensure that Diagnostic Logs are enabled for all services which support it. |
Shared |
The customer is responsible for implementing this recommendation. |
Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs
for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.
A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
Note: The CIS Benchmark covers some specific Diagnostic Logs
separately.
'''
3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests
6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
''' |
link |
20 |
| CIS_Azure_1.4.0 |
3.10 |
CIS_Azure_1.4.0_3.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.10 |
3 Storage Accounts |
Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Blob service provides scalable, cost-efficient objective storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.4.0 |
3.11 |
CIS_Azure_1.4.0_3.11 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.11 |
3 Storage Accounts |
Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Table storage is a service that stores structure NoSQL data in the cloud, providing a key/attribute store with a schema less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.4.0 |
3.3 |
CIS_Azure_1.4.0_3.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.3 |
3 Storage Accounts |
Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests |
Shared |
The customer is responsible for implementing this recommendation. |
The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages. |
link |
5 |
| CIS_Azure_1.4.0 |
4.1.1 |
CIS_Azure_1.4.0_4.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1.1 |
4 Database Services |
Ensure that 'Auditing' is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable auditing on SQL Servers. |
link |
5 |
| CIS_Azure_1.4.0 |
4.3.2 |
CIS_Azure_1.4.0_4.3.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.2 |
4 Database Services |
Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_checkpoints' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.4.0 |
4.3.3 |
CIS_Azure_1.4.0_4.3.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.3 |
4 Database Services |
Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_connections' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.4.0 |
4.3.4 |
CIS_Azure_1.4.0_4.3.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.4 |
4 Database Services |
Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_disconnections' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.4.0 |
4.3.5 |
CIS_Azure_1.4.0_4.3.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.5 |
4 Database Services |
Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'connection_throttling' on 'PostgreSQL Servers'. |
link |
5 |
| CIS_Azure_1.4.0 |
5.1.1 |
CIS_Azure_1.4.0_5.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.1 |
5 Logging and Monitoring |
Ensure that a 'Diagnostics Setting' exists |
Shared |
The customer is responsible for implementing this recommendation. |
Enable Diagnostic settings for exporting activity logs.
Diagnostic setting are available for each individual resources within a subscription. Settings should be configured for all appropriate resources for your environment. |
link |
1 |
| CIS_Azure_1.4.0 |
5.1.2 |
CIS_Azure_1.4.0_5.1.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.2 |
5 Logging and Monitoring |
Ensure Diagnostic Setting captures appropriate categories |
Shared |
The customer is responsible for implementing this recommendation. |
The diagnostic setting should be configured to log the appropriate activities from the control/management plane. |
link |
5 |
| CIS_Azure_1.4.0 |
5.1.5 |
CIS_Azure_1.4.0_5.1.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.5 |
5 Logging and Monitoring |
Ensure that logging for Azure KeyVault is 'Enabled' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available. |
link |
5 |
| CIS_Azure_1.4.0 |
5.3 |
CIS_Azure_1.4.0_5.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.3 |
5 Logging and Monitoring |
Ensure that Diagnostic Logs Are Enabled for All Services that Support it. |
Shared |
The customer is responsible for implementing this recommendation. |
Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs
for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.
A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
Note: The CIS Benchmark covers some specific Diagnostic Logs
separately.
'''
3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests
6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
''' |
link |
20 |
| CIS_Azure_2.0.0 |
3.13 |
CIS_Azure_2.0.0_3.13 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.13 |
3 |
Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests |
Shared |
Being a level 2, enabling this setting can have a high impact on the cost of data storage used for logging more data per each request. Do not enable this without determining your need for this level of logging or forget to check in on data usage and projected cost. |
The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.
Storage Analytics logs contain detailed information about successful and failed requests to a storage service. This information can be used to monitor each individual request to a storage service for increased security or diagnostics. Requests are logged on a best-effort basis.
Storage Analytics logging is not enabled by default for your storage account. |
link |
5 |
| CIS_Azure_2.0.0 |
3.14 |
CIS_Azure_2.0.0_3.14 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.14 |
3 |
Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests |
Shared |
Being a level 2, enabling this setting can have a high impact on the cost of data storage used for logging more data per each request. Do not enable this without determining your need for this level of logging or forget to check in on data usage and projected cost. |
Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.
Storage Analytics logs contain detailed information about successful and failed requests to a storage service. This information can be used to monitor each individual request to a storage service for increased security or diagnostics. Requests are logged on a best-effort basis.
Storage Analytics logging is not enabled by default for your storage account. |
link |
5 |
| CIS_Azure_2.0.0 |
3.5 |
CIS_Azure_2.0.0_3.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 3.5 |
3 |
Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests |
Shared |
Enabling this setting can have a high impact on the cost of the log analytics service and data storage used by logging more data per each request. Do not enable this without determining your need for this level of logging, and do not forget to check in on data usage and projected cost. Some users have seen their logging costs increase from $10 per month to $10,000 per month. |
The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.
Storage Analytics logs contain detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.
Storage Analytics logging is not enabled by default for your storage account. |
link |
5 |
| CIS_Azure_2.0.0 |
4.1.1 |
CIS_Azure_2.0.0_4.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1.1 |
4.1 |
Ensure that 'Auditing' is set to 'On' |
Shared |
n/a |
Enable auditing on SQL Servers.
The Azure platform allows a SQL server to be created as a service. Enabling auditing at the server level ensures that all existing and newly created databases on the SQL server instance are audited.
Auditing policy applied on the SQL database does not override auditing policy and settings applied on the particular SQL server where the database is hosted.
Auditing tracks database events and writes them to an audit log in the Azure storage account. It also helps to maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations. |
link |
5 |
| CIS_Azure_2.0.0 |
4.3.2 |
CIS_Azure_2.0.0_4.3.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.2 |
4.3 |
Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server |
Shared |
n/a |
Enable `log_checkpoints` on `PostgreSQL Servers`.
Enabling `log_checkpoints` helps the PostgreSQL Database to `Log each checkpoint` in turn generates query and error logs. However, access to transaction logs is not supported. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. |
link |
5 |
| CIS_Azure_2.0.0 |
4.3.3 |
CIS_Azure_2.0.0_4.3.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.3 |
4.3 |
Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server |
Shared |
n/a |
Enable `log_connections` on `PostgreSQL Servers`.
Enabling `log_connections` helps PostgreSQL Database to log attempted connection to the server, as well as successful completion of client authentication. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance. |
link |
5 |
| CIS_Azure_2.0.0 |
4.3.4 |
CIS_Azure_2.0.0_4.3.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.4 |
4.3 |
Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server |
Shared |
Enabling this setting will enable a log of all disconnections. If this is enabled for a high traffic server, the log may grow exponentially. |
Enable `log_disconnections` on `PostgreSQL Servers`.
Enabling `log_disconnections` helps PostgreSQL Database to `Logs end of a session`, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. |
link |
5 |
| CIS_Azure_2.0.0 |
4.3.5 |
CIS_Azure_2.0.0_4.3.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.5 |
4.3 |
Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server |
Shared |
n/a |
Enable `connection_throttling` on `PostgreSQL Servers`.
Enabling `connection_throttling` helps the PostgreSQL Database to `Set the verbosity of logged messages`. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. |
link |
5 |
| CIS_Azure_2.0.0 |
5.1.1 |
CIS_Azure_2.0.0_5.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.1 |
5.1 |
Ensure that a 'Diagnostic Setting' exists |
Shared |
n/a |
Enable Diagnostic settings for exporting activity logs.
Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment.
A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration in order to analyze security activities within an Azure subscription. |
link |
1 |
| CIS_Azure_2.0.0 |
5.1.2 |
CIS_Azure_2.0.0_5.1.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.2 |
5.1 |
Ensure Diagnostic Setting captures appropriate categories |
Shared |
n/a |
**Prerequisite**: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: "Ensure that a 'Diagnostic Setting' exists."
The diagnostic setting should be configured to log the appropriate activities from the control/management plane.
A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting. |
link |
8 |
| CIS_Azure_2.0.0 |
5.1.5 |
CIS_Azure_2.0.0_5.1.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.5 |
5.1 |
Ensure that logging for Azure Key Vault is 'Enabled' |
Shared |
n/a |
Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.
Monitoring how and when key vaults are accessed, and by whom, enables an audit trail of interactions with confidential information, keys, and certificates managed by Azure Keyvault. Enabling logging for Key Vault saves information in an Azure storage account which the user provides. This creates a new container named insights-logs-auditevent automatically for the specified storage account. This same storage account can be used for collecting logs for multiple key vaults. |
link |
5 |
| CIS_Azure_2.0.0 |
5.4 |
CIS_Azure_2.0.0_5.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.4 |
5 |
Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it |
Shared |
Costs for monitoring varies with Log Volume. Not every resource needs to have logging enabled. It is important to determine the security classification of the data being processed by the given resource and adjust the logging based on which events need to be tracked. This is typically determined by governance and compliance requirements. |
Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.
A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
A lack of monitoring reduces the visibility into the data plane, and therefore an organization's ability to detect reconnaissance, authorization attempts or other malicious activity. Unlike Activity Logs, Resource Logs are not enabled by default. Specifically, without monitoring it would be impossible to tell which entities had accessed a data store that was breached. In addition, alerts for failed attempts to access APIs for Web Services or Databases are only possible when logging is enabled. |
link |
20 |
| FedRAMP_High_R4 |
AU-12 |
FedRAMP_High_R4_AU-12 |
FedRAMP High AU-12 |
Audit And Accountability |
Audit Generation |
Shared |
n/a |
The information system:
a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and
c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related controls: AC-3, AU-2, AU-3, AU-6, AU-7.
References: None. |
link |
37 |
| FedRAMP_High_R4 |
AU-2 |
FedRAMP_High_R4_AU-2 |
FedRAMP High AU-2 |
Audit And Accountability |
Audit Events |
Shared |
n/a |
The organization:
a. Determines that the information system is capable of auditing the following events: [Assignment: organization-defined auditable events];
b. Coordinates the security audit function with other organizational entities requiring audit- related information to enhance mutual support and to help guide the selection of auditable events;
c. Provides a rationale for why the auditable events are deemed to be adequate to support after- the-fact investigations of security incidents; and
d. Determines that the following events are to be audited within the information system: [Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
Supplemental Guidance: An event is any observable occurrence in an organizational information system. Organizations identify audit events as those events which are significant and relevant to the security of information systems and the environments in which those systems operate in order to meet specific and ongoing audit needs. Audit events can include, for example, password changes, failed logons, or failed accesses related to information systems, administrative privilege usage, PIV credential usage, or third-party credential usage. In determining the set of auditable events, organizations consider the auditing appropriate for each of the security controls to be implemented. To balance auditing requirements with other information system needs, this control also requires identifying that subset of auditable events that are audited at a given point in time. For example, organizations may determine that information systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Auditing requirements, including the need for auditable events, may be referenced in other security controls and control enhancements. Organizations also include auditable events that are required by applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of auditable events, the auditing necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented architectures. Related controls: AC-6, AC-17, AU-3, AU-12, MA-4, MP-2, MP-4, SI-4.
References: NIST Special Publication 800-92; Web: http://idmanagement.gov. |
link |
1 |
| FedRAMP_High_R4 |
AU-3 |
FedRAMP_High_R4_AU-3 |
FedRAMP High AU-3 |
Audit And Accountability |
Content Of Audit Records |
Shared |
n/a |
The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
Supplemental Guidance: Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). Related controls: AU-2, AU-8, AU-12, SI-11.
References: None. |
link |
1 |
| FedRAMP_High_R4 |
RA-5(8) |
FedRAMP_High_R4_RA-5(8) |
FedRAMP High RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
Supplemental Guidance: Related control: AU-6. |
link |
15 |
| FedRAMP_Moderate_R4 |
AU-12 |
FedRAMP_Moderate_R4_AU-12 |
FedRAMP Moderate AU-12 |
Audit And Accountability |
Audit Generation |
Shared |
n/a |
The information system:
a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and
c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related controls: AC-3, AU-2, AU-3, AU-6, AU-7.
References: None. |
link |
37 |
| FedRAMP_Moderate_R4 |
AU-2 |
FedRAMP_Moderate_R4_AU-2 |
FedRAMP Moderate AU-2 |
Audit And Accountability |
Audit Events |
Shared |
n/a |
The organization:
a. Determines that the information system is capable of auditing the following events: [Assignment: organization-defined auditable events];
b. Coordinates the security audit function with other organizational entities requiring audit- related information to enhance mutual support and to help guide the selection of auditable events;
c. Provides a rationale for why the auditable events are deemed to be adequate to support after- the-fact investigations of security incidents; and
d. Determines that the following events are to be audited within the information system: [Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
Supplemental Guidance: An event is any observable occurrence in an organizational information system. Organizations identify audit events as those events which are significant and relevant to the security of information systems and the environments in which those systems operate in order to meet specific and ongoing audit needs. Audit events can include, for example, password changes, failed logons, or failed accesses related to information systems, administrative privilege usage, PIV credential usage, or third-party credential usage. In determining the set of auditable events, organizations consider the auditing appropriate for each of the security controls to be implemented. To balance auditing requirements with other information system needs, this control also requires identifying that subset of auditable events that are audited at a given point in time. For example, organizations may determine that information systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Auditing requirements, including the need for auditable events, may be referenced in other security controls and control enhancements. Organizations also include auditable events that are required by applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of auditable events, the auditing necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented architectures. Related controls: AC-6, AC-17, AU-3, AU-12, MA-4, MP-2, MP-4, SI-4.
References: NIST Special Publication 800-92; Web: http://idmanagement.gov. |
link |
1 |
| FedRAMP_Moderate_R4 |
AU-3 |
FedRAMP_Moderate_R4_AU-3 |
FedRAMP Moderate AU-3 |
Audit And Accountability |
Content Of Audit Records |
Shared |
n/a |
The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
Supplemental Guidance: Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). Related controls: AU-2, AU-8, AU-12, SI-11.
References: None. |
link |
1 |
| FedRAMP_Moderate_R4 |
RA-5(8) |
FedRAMP_Moderate_R4_RA-5(8) |
FedRAMP Moderate RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
Supplemental Guidance: Related control: AU-6. |
link |
15 |
| hipaa |
0217.09j2Organizational.10-09.j |
hipaa-0217.09j2Organizational.10-09.j |
0217.09j2Organizational.10-09.j |
02 Endpoint Protection |
0217.09j2Organizational.10-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
The organization configures malicious code and spam protection mechanisms to (i) perform periodic scans of the information system according to organization guidelines; (ii) perform real-time scans of files from external sources at endpoints and network entry/exit points as the files are downloaded, opened, or executed in accordance with organizational security policy; and, (iii) block malicious code, quarantine malicious code, or send an alert to the administrator in response to malicious code detection. |
|
25 |
| hipaa |
0663.10h1System.7-10.h |
hipaa-0663.10h1System.7-10.h |
0663.10h1System.7-10.h |
06 Configuration Management |
0663.10h1System.7-10.h 10.04 Security of System Files |
Shared |
n/a |
The operating system has in place supporting technical controls such as antivirus, file integrity monitoring, host-based (personal) firewalls or port filtering tools, and logging as part of its baseline. |
|
16 |
| hipaa |
0714.10m2Organizational.7-10.m |
hipaa-0714.10m2Organizational.7-10.m |
0714.10m2Organizational.7-10.m |
07 Vulnerability Management |
0714.10m2Organizational.7-10.m 10.06 Technical Vulnerability Management |
Shared |
n/a |
The technical vulnerability management program is evaluated on a quarterly basis. |
|
20 |
| hipaa |
0790.10m3Organizational.22-10.m |
hipaa-0790.10m3Organizational.22-10.m |
0790.10m3Organizational.22-10.m |
07 Vulnerability Management |
0790.10m3Organizational.22-10.m 10.06 Technical Vulnerability Management |
Shared |
n/a |
The organization reviews historic audit logs to determine if high vulnerability scan findings identified in the information system have been previously exploited. |
|
17 |
| hipaa |
1202.09aa1System.1-09.aa |
hipaa-1202.09aa1System.1-09.aa |
1202.09aa1System.1-09.aa |
12 Audit Logging & Monitoring |
1202.09aa1System.1-09.aa 09.10 Monitoring |
Shared |
n/a |
A secure audit record is created for all activities on the system (create, read, update, delete) involving covered information. |
|
5 |
| hipaa |
1203.09aa1System.2-09.aa |
hipaa-1203.09aa1System.2-09.aa |
1203.09aa1System.2-09.aa |
12 Audit Logging & Monitoring |
1203.09aa1System.2-09.aa 09.10 Monitoring |
Shared |
n/a |
Audit records include the unique user ID, unique data subject ID, function performed, and date/time the event was performed. |
|
3 |
| hipaa |
1204.09aa1System.3-09.aa |
hipaa-1204.09aa1System.3-09.aa |
1204.09aa1System.3-09.aa |
12 Audit Logging & Monitoring |
1204.09aa1System.3-09.aa 09.10 Monitoring |
Shared |
n/a |
The activities of privileged users (administrators, operators, etc.) include the success/failure of the event, time the event occurred, the account involved, the processes involved, and additional information about the event. |
|
4 |
| hipaa |
1205.09aa2System.1-09.aa |
hipaa-1205.09aa2System.1-09.aa |
1205.09aa2System.1-09.aa |
12 Audit Logging & Monitoring |
1205.09aa2System.1-09.aa 09.10 Monitoring |
Shared |
n/a |
Logs of messages sent and received are maintained including the date, time, origin and destination of the message, but not its contents. |
|
6 |
| hipaa |
1206.09aa2System.23-09.aa |
hipaa-1206.09aa2System.23-09.aa |
1206.09aa2System.23-09.aa |
12 Audit Logging & Monitoring |
1206.09aa2System.23-09.aa 09.10 Monitoring |
Shared |
n/a |
Auditing is always available while the system is active and tracks key events, success/failed data access, system security configuration changes, privileged or utility use, any alarms raised, activation and de-activation of protection systems (e.g., A/V and IDS), activation and deactivation of identification and authentication mechanisms, and creation and deletion of system-level objects. |
|
6 |
| hipaa |
1207.09aa2System.4-09.aa |
hipaa-1207.09aa2System.4-09.aa |
1207.09aa2System.4-09.aa |
12 Audit Logging & Monitoring |
1207.09aa2System.4-09.aa 09.10 Monitoring |
Shared |
n/a |
Audit records are retained for 90 days and older audit records are archived for one year. |
|
13 |
| hipaa |
1208.09aa3System.1-09.aa |
hipaa-1208.09aa3System.1-09.aa |
1208.09aa3System.1-09.aa |
12 Audit Logging & Monitoring |
1208.09aa3System.1-09.aa 09.10 Monitoring |
Shared |
n/a |
Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes. |
|
18 |
| hipaa |
1209.09aa3System.2-09.aa |
hipaa-1209.09aa3System.2-09.aa |
1209.09aa3System.2-09.aa |
12 Audit Logging & Monitoring |
1209.09aa3System.2-09.aa 09.10 Monitoring |
Shared |
n/a |
The information system generates audit records containing the following detailed information: (i) filename accessed; (ii) program or command used to initiate the event; and, (iii) source and destination addresses. |
|
3 |
| hipaa |
1210.09aa3System.3-09.aa |
hipaa-1210.09aa3System.3-09.aa |
1210.09aa3System.3-09.aa |
12 Audit Logging & Monitoring |
1210.09aa3System.3-09.aa 09.10 Monitoring |
Shared |
n/a |
All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender. |
|
11 |
| hipaa |
1214.09ab2System.3456-09.ab |
hipaa-1214.09ab2System.3456-09.ab |
1214.09ab2System.3456-09.ab |
12 Audit Logging & Monitoring |
1214.09ab2System.3456-09.ab 09.10 Monitoring |
Shared |
n/a |
Monitoring includes privileged operations, authorized access or unauthorized access attempts, including attempts to access deactivated accounts, and system alerts or failures. |
|
9 |
| hipaa |
1216.09ab3System.12-09.ab |
hipaa-1216.09ab3System.12-09.ab |
1216.09ab3System.12-09.ab |
12 Audit Logging & Monitoring |
1216.09ab3System.12-09.ab 09.10 Monitoring |
Shared |
n/a |
Automated systems are used to review monitoring activities of security systems (e.g., IPS/IDS) and system records on a daily basis, and identify and document anomalies. |
|
20 |
| hipaa |
1230.09c2Organizational.1-09.c |
hipaa-1230.09c2Organizational.1-09.c |
1230.09c2Organizational.1-09.c |
12 Audit Logging & Monitoring |
1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures |
Shared |
n/a |
No single person is able to access, modify, or use information systems without authorization or detection. |
|
13 |
| ISO27001-2013 |
A.12.4.1 |
ISO27001-2013_A.12.4.1 |
ISO 27001:2013 A.12.4.1 |
Operations Security |
Event Logging |
Shared |
n/a |
Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. |
link |
53 |
| ISO27001-2013 |
A.12.4.3 |
ISO27001-2013_A.12.4.3 |
ISO 27001:2013 A.12.4.3 |
Operations Security |
Administrator and operator logs |
Shared |
n/a |
System administrator and system operator activities shall be logged and the logs protected and regularly reviewed. |
link |
29 |
| ISO27001-2013 |
A.16.1.7 |
ISO27001-2013_A.16.1.7 |
ISO 27001:2013 A.16.1.7 |
Information Security Incident Management |
Collection of evidence |
Shared |
n/a |
The organization shall define and apply procedures for the identification, collection, acquisition and preservation of information which can serve as evidence. |
link |
7 |
| NIST_SP_800-171_R2_3 |
.3.1 |
NIST_SP_800-171_R2_3.3.1 |
NIST SP 800-171 R2 3.3.1 |
Audit and Accountability |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures. Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. [SP 800-92] provides guidance on security log management. |
link |
53 |
| NIST_SP_800-171_R2_3 |
.3.2 |
NIST_SP_800-171_R2_3.3.2 |
NIST SP 800-171 R2 3.3.2 |
Audit and Accountability |
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of Voice over Internet Protocol (VoIP). |
link |
39 |
| NIST_SP_800-171_R2_3 |
.3.6 |
NIST_SP_800-171_R2_3.3.6 |
NIST SP 800-171 R2 3.3.6 |
Audit and Accountability |
Provide audit record reduction and report generation to support on-demand analysis and reporting. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Audit record reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always emanate from the same system or organizational entities conducting auditing activities. Audit record reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the system can help generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the time stamp in the record is insufficient. |
link |
7 |
| NIST_SP_800-53_R4 |
AU-12 |
NIST_SP_800-53_R4_AU-12 |
NIST SP 800-53 Rev. 4 AU-12 |
Audit And Accountability |
Audit Generation |
Shared |
n/a |
The information system:
a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and
c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related controls: AC-3, AU-2, AU-3, AU-6, AU-7.
References: None. |
link |
37 |
| NIST_SP_800-53_R4 |
AU-2 |
NIST_SP_800-53_R4_AU-2 |
NIST SP 800-53 Rev. 4 AU-2 |
Audit And Accountability |
Audit Events |
Shared |
n/a |
The organization:
a. Determines that the information system is capable of auditing the following events: [Assignment: organization-defined auditable events];
b. Coordinates the security audit function with other organizational entities requiring audit- related information to enhance mutual support and to help guide the selection of auditable events;
c. Provides a rationale for why the auditable events are deemed to be adequate to support after- the-fact investigations of security incidents; and
d. Determines that the following events are to be audited within the information system: [Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
Supplemental Guidance: An event is any observable occurrence in an organizational information system. Organizations identify audit events as those events which are significant and relevant to the security of information systems and the environments in which those systems operate in order to meet specific and ongoing audit needs. Audit events can include, for example, password changes, failed logons, or failed accesses related to information systems, administrative privilege usage, PIV credential usage, or third-party credential usage. In determining the set of auditable events, organizations consider the auditing appropriate for each of the security controls to be implemented. To balance auditing requirements with other information system needs, this control also requires identifying that subset of auditable events that are audited at a given point in time. For example, organizations may determine that information systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Auditing requirements, including the need for auditable events, may be referenced in other security controls and control enhancements. Organizations also include auditable events that are required by applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of auditable events, the auditing necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented architectures. Related controls: AC-6, AC-17, AU-3, AU-12, MA-4, MP-2, MP-4, SI-4.
References: NIST Special Publication 800-92; Web: http://idmanagement.gov. |
link |
1 |
| NIST_SP_800-53_R4 |
AU-3 |
NIST_SP_800-53_R4_AU-3 |
NIST SP 800-53 Rev. 4 AU-3 |
Audit And Accountability |
Content Of Audit Records |
Shared |
n/a |
The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
Supplemental Guidance: Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). Related controls: AU-2, AU-8, AU-12, SI-11.
References: None. |
link |
1 |
| NIST_SP_800-53_R4 |
RA-5(8) |
NIST_SP_800-53_R4_RA-5(8) |
NIST SP 800-53 Rev. 4 RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
Supplemental Guidance: Related control: AU-6. |
link |
15 |
| NIST_SP_800-53_R5 |
AU-12 |
NIST_SP_800-53_R5_AU-12 |
NIST SP 800-53 Rev. 5 AU-12 |
Audit and Accountability |
Audit Record Generation |
Shared |
n/a |
a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components];
b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3). |
link |
37 |
| NIST_SP_800-53_R5 |
AU-2 |
NIST_SP_800-53_R5_AU-2 |
NIST SP 800-53 Rev. 5 AU-2 |
Audit and Accountability |
Event Logging |
Shared |
n/a |
a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging];
b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
c. Specify the following event types for logging within the system: [Assignment: organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type];
d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
e. Review and update the event types selected for logging [Assignment: organization-defined frequency]. |
link |
1 |
| NIST_SP_800-53_R5 |
AU-3 |
NIST_SP_800-53_R5_AU-3 |
NIST SP 800-53 Rev. 5 AU-3 |
Audit and Accountability |
Content of Audit Records |
Shared |
n/a |
Ensure that audit records contain information that establishes the following:
a. What type of event occurred;
b. When the event occurred;
c. Where the event occurred;
d. Source of the event;
e. Outcome of the event; and
f. Identity of any individuals, subjects, or objects/entities associated with the event. |
link |
1 |
| NIST_SP_800-53_R5 |
RA-5(8) |
NIST_SP_800-53_R5_RA-5(8) |
NIST SP 800-53 Rev. 5 RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time period]. |
link |
15 |
| PCI_DSS_v4.0 |
10.2.1 |
PCI_DSS_v4.0_10.2.1 |
PCI DSS v4.0 10.2.1 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs are enabled and active for all system components and cardholder data. |
link |
4 |
| PCI_DSS_v4.0 |
10.2.1.1 |
PCI_DSS_v4.0_10.2.1.1 |
PCI DSS v4.0 10.2.1.1 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture all individual user access to cardholder data. |
link |
1 |
| PCI_DSS_v4.0 |
10.2.1.3 |
PCI_DSS_v4.0_10.2.1.3 |
PCI DSS v4.0 10.2.1.3 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture all access to audit logs. |
link |
8 |
| PCI_DSS_v4.0 |
10.2.1.4 |
PCI_DSS_v4.0_10.2.1.4 |
PCI DSS v4.0 10.2.1.4 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture all invalid logical access attempts. |
link |
1 |
| PCI_DSS_v4.0 |
10.2.1.5 |
PCI_DSS_v4.0_10.2.1.5 |
PCI DSS v4.0 10.2.1.5 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture all changes to identification and authentication credentials including, but not limited to:
• Creation of new accounts.
• Elevation of privileges.
• All changes, additions, or deletions to accounts with administrative access. |
link |
13 |
| PCI_DSS_v4.0 |
10.2.1.6 |
PCI_DSS_v4.0_10.2.1.6 |
PCI DSS v4.0 10.2.1.6 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture the following:
• All initialization of new audit logs, and
• All starting, stopping, or pausing of the existing audit logs. |
link |
8 |
| PCI_DSS_v4.0 |
10.2.1.7 |
PCI_DSS_v4.0_10.2.1.7 |
PCI DSS v4.0 10.2.1.7 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs capture all creation and deletion of system-level objects. |
link |
1 |
| PCI_DSS_v4.0 |
10.2.2 |
PCI_DSS_v4.0_10.2.2 |
PCI DSS v4.0 10.2.2 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events |
Shared |
n/a |
Audit logs record the following details for each auditable event:
• User identification.
• Type of event.
• Date and time.
• Success and failure indication.
• Origination of event.
• Identity or name of affected data, system component, resource, or service (for example, name and protocol). |
link |
5 |
| PCI_DSS_v4.0 |
5.3.4 |
PCI_DSS_v4.0_5.3.4 |
PCI DSS v4.0 5.3.4 |
Requirement 05: Protect All Systems and Networks from Malicious Software |
Anti-malware mechanisms and processes are active, maintained, and monitored |
Shared |
n/a |
Audit logs for the anti-malware solution are enabled and retained in accordance with Requirement 10.5.1. |
link |
4 |
| SWIFT_CSCF_v2022 |
6.1 |
SWIFT_CSCF_v2022_6.1 |
SWIFT CSCF v2022 6.1 |
6. Detect Anomalous Activity to Systems or Transaction Records |
Ensure that local SWIFT infrastructure is protected against malware and act upon results. |
Shared |
n/a |
Anti-malware software from a reputable vendor is installed, kept up-to-date on all systems, and results are considered for appropriate resolving actions. |
link |
31 |
| SWIFT_CSCF_v2022 |
6.4 |
SWIFT_CSCF_v2022_6.4 |
SWIFT CSCF v2022 6.4 |
6. Detect Anomalous Activity to Systems or Transaction Records |
Record security events and detect anomalous actions and operations within the local SWIFT environment. |
Shared |
n/a |
Capabilities to detect anomalous activity are implemented, and a process or tool is in place to keep and review logs. |
link |
52 |