AzPolicyAdvertizer

last sync: 2024-Apr-23 17:45:49 UTC

Specify permitted actions associated with customer audit information | Regulatory Compliance - Operational

Azure BuiltIn Policy definition

Source Azure Portal
Display name Specify permitted actions associated with customer audit information
Id 3eecf628-a1c8-1b48-1b5c-7ca781e97970
Version 1.1.0
Details on versioning
Category Regulatory Compliance
Microsoft Learn
Description CMA_C1122 - Specify permitted actions associated with customer audit information
Additional metadata Name/Id: CMA_C1122 / CMA_C1122
Category: Operational
Title: Specify permitted actions associated with customer audit information
Ownership: Customer
Description: The customer is responsible for specifying the permitted actions associated with the review, analysis, and reporting of customer-controlled audit information.
Requirements: The customer is responsible for implementing this recommendation.
Mode All
Type BuiltIn
Preview False
Deprecated False
Effect Default
Manual
Allowed
Manual, Disabled
RBAC role(s) none
Rule aliases none
Rule resource types IF (1)
Microsoft.Resources/subscriptions
Compliance
The following 5 compliance controls are associated with this Policy definition 'Specify permitted actions associated with customer audit information' (3eecf628-a1c8-1b48-1b5c-7ca781e97970)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
FedRAMP_High_R4 AU-6(7) FedRAMP_High_R4_AU-6(7) FedRAMP High AU-6 (7) Audit And Accountability Permitted Actions Shared n/a The organization specifies the permitted actions for each [Selection (one or more): information system process; role; user] associated with the review, analysis, and reporting of audit information. Supplemental Guidance: Organizations specify permitted actions for information system processes, roles, and/or users associated with the review, analysis, and reporting of audit records through account management techniques. Specifying permitted actions on audit information is a way to enforce the principle of least privilege. Permitted actions are enforced by the information system and include, for example, read, write, execute, append, and delete. link 1
hipaa 0202.09j1Organizational.3-09.j hipaa-0202.09j1Organizational.3-09.j 0202.09j1Organizational.3-09.j 02 Endpoint Protection 0202.09j1Organizational.3-09.j 09.04 Protection Against Malicious and Mobile Code Shared n/a Audit logs of the scans are maintained. 15
hipaa 12101.09ab1Organizational.3-09.ab hipaa-12101.09ab1Organizational.3-09.ab 12101.09ab1Organizational.3-09.ab 12 Audit Logging & Monitoring 12101.09ab1Organizational.3-09.ab 09.10 Monitoring Shared n/a The organization specifies how often audit logs are reviewed, how the reviews are documented, and the specific roles and responsibilities of the personnel conducting the reviews, including the professional certifications or other qualifications required. 18
NIST_SP_800-53_R4 AU-6(7) NIST_SP_800-53_R4_AU-6(7) NIST SP 800-53 Rev. 4 AU-6 (7) Audit And Accountability Permitted Actions Shared n/a The organization specifies the permitted actions for each [Selection (one or more): information system process; role; user] associated with the review, analysis, and reporting of audit information. Supplemental Guidance: Organizations specify permitted actions for information system processes, roles, and/or users associated with the review, analysis, and reporting of audit records through account management techniques. Specifying permitted actions on audit information is a way to enforce the principle of least privilege. Permitted actions are enforced by the information system and include, for example, read, write, execute, append, and delete. link 1
NIST_SP_800-53_R5 AU-6(7) NIST_SP_800-53_R5_AU-6(7) NIST SP 800-53 Rev. 5 AU-6 (7) Audit and Accountability Permitted Actions Shared n/a Specify the permitted actions for each [Selection (OneOrMore): system process;role;user] associated with the review, analysis, and reporting of audit record information. link 1
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type
FedRAMP High d5264498-16f4-418a-b659-fa7ef418175f Regulatory Compliance GA BuiltIn
HITRUST/HIPAA a169a624-5599-4385-a696-c8d643089fab Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 4 cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 5 179d1daa-458f-4e47-8086-2a68d0d6c38f Regulatory Compliance GA BuiltIn
History
Date/Time (UTC ymd) (i) Change type Change detail
2022-09-27 16:35:32 change Minor (1.0.0 > 1.1.0)
2022-09-19 17:41:40 add 3eecf628-a1c8-1b48-1b5c-7ca781e97970
JSON compare
compare mode: version left: version right:
JSON
api-version=2021-06-01
EPAC