last sync: 2024-Jun-13 18:14:14 UTC

Microsoft Managed Control 1659 - Architecture And Provisioning For Name / Address Resolution Service | Regulatory Compliance - System and Communications Protection

Azure BuiltIn Policy definition

Source Azure Portal
Display name Microsoft Managed Control 1659 - Architecture And Provisioning For Name / Address Resolution Service
Id 35a4102f-a778-4a2e-98c2-971056288df8
Version 1.0.0
Details on versioning
Category Regulatory Compliance
Microsoft Learn
Description Microsoft implements this System and Communications Protection control
Additional metadata Name/Id: ACF1659 / Microsoft Managed Control 1659
Category: System and Communications Protection
Title: Architecture And Provisioning For Name / Address Resolution Service
Ownership: Customer, Microsoft
Description: The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.
Requirements: The Azure DNS offering provides name and address resolution. Fault tolerance is built into the service through redundancy at multiple levels, including multiple DNS server clusters and multiple servers per cluster, and deployment at multiple Azure datacenter facilities which are geographically separated. Azure DNS also leverages network controls to restrict type of hosts that can access an authoritative DNS server in a particular role. The implementation incorporates a master repository of DNS zones. Master repository is deployed in multiple datacenters across different geographical regions for redundancy purposes. Data from master repository is pulled into edge DNS servers on demand for resolving authoritative DNS queries. Data from master repository is backed up and monitored with the security incident and event management tool as documented in the AU family of controls. Additionally, a backup system built using a completely different hardware and software system stack is implemented and kept in sync with the master repository. This system is engaged in case of a catastrophic failure of the primary system. Azure DNS recursive resolver service has built-in cross region failover capability that automatically switches the DNS traffic to another region in case there is a catastrophic failure of DNS resolution in one region.
Mode Indexed
Type Static
Preview False
Deprecated False
Effect Fixed
audit
RBAC role(s) none
Rule aliases none
Rule resource types IF (2)
Microsoft.Resources/subscriptions
Microsoft.Resources/subscriptions/resourceGroups
Compliance
The following 1 compliance controls are associated with this Policy definition 'Microsoft Managed Control 1659 - Architecture And Provisioning For Name / Address Resolution Service' (35a4102f-a778-4a2e-98c2-971056288df8)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
op.pl.2 Security Architecture op.pl.2 Security Architecture 404 not found n/a n/a 65
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type
Spain ENS 175daf90-21e1-4fec-b745-7b4c909aa94c Regulatory Compliance GA BuiltIn
History none
JSON compare n/a
JSON
api-version=2021-06-01
EPAC