Az Policy Advertizer

1.6

CIS_Azure_1.1.0_1.6

CIS Microsoft Azure Foundations Benchmark recommendation 1.6

1 Identity and Access Management

Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

Shared

The customer is responsible for implementing this recommendation.

Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.

1.7

CIS_Azure_1.1.0_1.7

CIS Microsoft Azure Foundations Benchmark recommendation 1.7

1 Identity and Access Management

Ensure that 'Notify users on password resets?' is set to 'Yes'

Shared

The customer is responsible for implementing this recommendation.

Ensure that users are notified on their primary and secondary emails on password resets.

1.8

CIS_Azure_1.1.0_1.8

CIS Microsoft Azure Foundations Benchmark recommendation 1.8

1 Identity and Access Management

Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'

Shared

The customer is responsible for implementing this recommendation.

Ensure that all administrators are notified if any other administrator resets their password.

4.19

CIS_Azure_1.1.0_4.19

CIS Microsoft Azure Foundations Benchmark recommendation 4.19

4 Database Services

Ensure that Azure Active Directory Admin is configured

Shared

The customer is responsible for implementing this recommendation.

Use Azure Active Directory Authentication for authentication with SQL Database.

4.8

CIS_Azure_1.1.0_4.8

CIS Microsoft Azure Foundations Benchmark recommendation 4.8

4 Database Services

Ensure that Azure Active Directory Admin is configured

Shared

The customer is responsible for implementing this recommendation.

Use Azure Active Directory Authentication for authentication with SQL Database.

9.5

CIS_Azure_1.1.0_9.5

CIS Microsoft Azure Foundations Benchmark recommendation 9.5

9 AppService

Ensure that Register with Azure Active Directory is enabled on App Service

Shared

The customer is responsible for implementing this recommendation.

Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords.

1.6

CIS_Azure_1.3.0_1.6

CIS Microsoft Azure Foundations Benchmark recommendation 1.6

1 Identity and Access Management

Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0"

Shared

The customer is responsible for implementing this recommendation.

Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.

1.7

CIS_Azure_1.3.0_1.7

CIS Microsoft Azure Foundations Benchmark recommendation 1.7

1 Identity and Access Management

Ensure that 'Notify users on password resets?' is set to 'Yes'

Shared

The customer is responsible for implementing this recommendation.

Ensure that users are notified on their primary and secondary emails on password resets.

1.8

CIS_Azure_1.3.0_1.8

CIS Microsoft Azure Foundations Benchmark recommendation 1.8

1 Identity and Access Management

Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'

Shared

The customer is responsible for implementing this recommendation.

Ensure that all administrators are notified if any other administrator resets their password.

4.4

CIS_Azure_1.3.0_4.4

CIS Microsoft Azure Foundations Benchmark recommendation 4.4

4 Database Services

Ensure that Azure Active Directory Admin is configured

Shared

The customer is responsible for implementing this recommendation.

Use Azure Active Directory Authentication for authentication with SQL Database.

9.5

CIS_Azure_1.3.0_9.5

CIS Microsoft Azure Foundations Benchmark recommendation 9.5

9 AppService

Ensure that Register with Azure Active Directory is enabled on App Service

Shared

The customer is responsible for implementing this recommendation.

1.6

CIS_Azure_1.4.0_1.6

CIS Microsoft Azure Foundations Benchmark recommendation 1.6

1 Identity and Access Management

Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

Shared

The customer is responsible for implementing this recommendation.

Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.

1.7

CIS_Azure_1.4.0_1.7

CIS Microsoft Azure Foundations Benchmark recommendation 1.7

1 Identity and Access Management

Ensure that 'Notify users on password resets?' is set to 'Yes'

Shared

The customer is responsible for implementing this recommendation.

Ensure that users are notified on their primary and secondary emails on password resets.

1.8

CIS_Azure_1.4.0_1.8

CIS Microsoft Azure Foundations Benchmark recommendation 1.8

1 Identity and Access Management

Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'

Shared

The customer is responsible for implementing this recommendation.

Ensure that all administrators are notified if any other administrator resets their password.

4.5

CIS_Azure_1.4.0_4.5

CIS Microsoft Azure Foundations Benchmark recommendation 4.5

4 Database Services

Ensure that Azure Active Directory Admin is configured

Shared

The customer is responsible for implementing this recommendation.

Use Azure Active Directory Authentication for authentication with SQL Database to manage credentials in a single place.

9.5

CIS_Azure_1.4.0_9.5

CIS Microsoft Azure Foundations Benchmark recommendation 9.5

9 AppService

Ensure that Register with Azure Active Directory is enabled on App Service

Shared

The customer is responsible for implementing this recommendation.

1.10

CIS_Azure_2.0.0_1.10

CIS Microsoft Azure Foundations Benchmark recommendation 1.10

Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'

Shared

All Global Administrators will receive a notification from Azure every time a password is reset. This is useful for auditing procedures to confirm that there are no out of the ordinary password resets for Global Administrators. There is additional overhead, however, in the time required for Global Administrators to audit the notifications. This setting is only useful if all Global Administrators pay attention to the notifications, and audit each one.

Ensure that all Global Administrators are notified if any other administrator resets their password. Global Administrator accounts are sensitive. Any password reset activity notification, when sent to all Global Administrators, ensures that all Global administrators can passively confirm if such a reset is a common pattern within their group. For example, if all Global Administrators change their password every 30 days, any password reset activity before that may require administrator(s) to evaluate any unusual activity and confirm its origin.

1.8

CIS_Azure_2.0.0_1.8

CIS Microsoft Azure Foundations Benchmark recommendation 1.8

Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

Shared

Users will be prompted for their multifactor authentication at the duration set here.

Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. This setting is necessary if you have setup 'Require users to register when signing in option'. If authentication re-confirmation is disabled, registered users will never be prompted to re-confirm their existing authentication information. If the authentication information for a user changes, such as a phone number or email, then the password reset information for that user reverts to the previously registered authentication information.

1.9

CIS_Azure_2.0.0_1.9

CIS Microsoft Azure Foundations Benchmark recommendation 1.9

Ensure that 'Notify users on password resets?' is set to 'Yes'

Shared

Users will receive emails alerting them to password changes to both their primary and secondary emails.

Ensure that users are notified on their primary and secondary emails on password resets. User notification on password reset is a proactive way of confirming password reset activity. It helps the user to recognize unauthorized password reset activities.

4.1.4

CIS_Azure_2.0.0_4.1.4

CIS Microsoft Azure Foundations Benchmark recommendation 4.1.4

4.1

Ensure that Azure Active Directory Admin is Configured for SQL Servers

Shared

This will create administrative overhead with user account and permission management. For further security on these administrative accounts, you may want to consider higher tiers of AAD which support features like Multi Factor Authentication, that will cost more.

Use Azure Active Directory Authentication for authentication with SQL Database to manage credentials in a single place. Azure Active Directory authentication is a mechanism to connect to Microsoft Azure SQL Database and SQL Data Warehouse by using identities in Azure Active Directory (Azure AD). With Azure AD authentication, identities of database users and other Microsoft services can be managed in one central location. Central ID management provides a single place to manage database users and simplifies permission management. - It provides an alternative to SQL Server authentication. - Helps stop the proliferation of user identities across database servers. - Allows password rotation in a single place. - Customers can manage database permissions using external (AAD) groups. - It can eliminate storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Azure Active Directory. - Azure AD authentication uses contained database users to authenticate identities at the database level. - Azure AD supports token-based authentication for applications connecting to SQL Database. - Azure AD authentication supports ADFS (domain federation) or native user/password authentication for a local Azure Active Directory without domain synchronization. - Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification.

9.5

CIS_Azure_2.0.0_9.5

CIS Microsoft Azure Foundations Benchmark recommendation 9.5

Ensure that Register with Azure Active Directory is enabled on App Service

Shared

n/a

Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in App Service, the app will connect to other Azure services securely without the need for usernames and passwords. App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services.

FedRAMP_High_R4

AC-17(1)

FedRAMP_High_R4_AC-17(1)

FedRAMP High AC-17 (1)

Access Control

Automated Monitoring / Control

Shared

n/a

The information system monitors and controls remote access methods. Supplemental Guidance: Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets). Related controls: AU-2, AU-12.

FedRAMP_High_R4

AC-2(1)

FedRAMP_High_R4_AC-2(1)

FedRAMP High AC-2 (1)

Access Control

Automated System Account Management

Shared

n/a

The organization employs automated mechanisms to support the management of information system accounts. Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage.

FedRAMP_High_R4

AC-2(4)

FedRAMP_High_R4_AC-2(4)

FedRAMP High AC-2 (4)

Access Control

Automated Audit Actions

Shared

n/a

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles]. Supplemental Guidance: Related controls: AU-2, AU-12.

FedRAMP_Moderate_R4_AC-17(1)

FedRAMP_Moderate_R4

AC-17(1)

FedRAMP Moderate AC-17 (1)

Access Control

Automated Monitoring / Control

Shared

n/a

FedRAMP_Moderate_R4_AC-2(1)

FedRAMP_Moderate_R4

AC-2(1)

FedRAMP Moderate AC-2 (1)

Access Control

Automated System Account Management

Shared

n/a

FedRAMP_Moderate_R4_AC-2(4)

FedRAMP_Moderate_R4

AC-2(4)

FedRAMP Moderate AC-2 (4)

Access Control

Automated Audit Actions

Shared

n/a

hipaa-0902.09s2Organizational.13-09.s

0902.09s2Organizational.13-09.s

0902.09s2Organizational.13-09.s

09 Transmission Protection

0902.09s2Organizational.13-09.s 09.08 Exchange of Information

Shared

n/a

Remote (external) access to the organization's information assets and access to external information assets (for which the organization has no control) is based on clearly defined terms and conditions.

hipaa-0912.09s1Organizational.4-09.s

0912.09s1Organizational.4-09.s

0912.09s1Organizational.4-09.s

09 Transmission Protection

0912.09s1Organizational.4-09.s 09.08 Exchange of Information

Shared

n/a

Cryptography is used to protect the confidentiality and integrity of remote access sessions to the internal network and to external systems.

hipaa-11155.02i2Organizational.2-02.i

11155.02i2Organizational.2-02.i

11155.02i2Organizational.2-02.i

11 Access Control

11155.02i2Organizational.2-02.i 02.04 Termination or Change of Employment

Shared

n/a

The organization employs automated mechanisms to notify specific personnel or roles (formally defined by the organization) upon termination of an individual.

hipaa-1118.01j2Organizational.124-01.j

1118.01j2Organizational.124-01.j

1118.01j2Organizational.124-01.j

11 Access Control

1118.01j2Organizational.124-01.j 01.04 Network Access Control

Shared

n/a

The organization has implemented encryption (e.g., VPN solutions or private lines) and logs remote access to the organization's network by employees, contractors, or third-party.

hipaa-1179.01j3Organizational.1-01.j

1179.01j3Organizational.1-01.j

1179.01j3Organizational.1-01.j

11 Access Control

1179.01j3Organizational.1-01.j 01.04 Network Access Control

Shared

n/a

The information system monitors and controls remote access methods.

hipaa-1208.09aa3System.1-09.aa

1208.09aa3System.1-09.aa

1208.09aa3System.1-09.aa

12 Audit Logging & Monitoring

1208.09aa3System.1-09.aa 09.10 Monitoring

Shared

n/a

Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes.

A.12.4.1

ISO27001-2013_A.12.4.1

ISO 27001:2013 A.12.4.1

Operations Security

Event Logging

Shared

n/a

Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed.

A.12.4.3

ISO27001-2013_A.12.4.3

ISO 27001:2013 A.12.4.3

Operations Security

Administrator and operator logs

Shared

n/a

System administrator and system operator activities shall be logged and the logs protected and regularly reviewed.

A.13.1.1

ISO27001-2013_A.13.1.1

ISO 27001:2013 A.13.1.1

Communications Security

Network controls

Shared

n/a

Networks shall be managed and controlled to protect information in systems and applications.

A.14.1.2

ISO27001-2013_A.14.1.2

ISO 27001:2013 A.14.1.2

System Acquisition, Development And Maintenance

Securing application services on public networks

Shared

n/a

Information involved in application services passing over public networks shall be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification.

A.6.2.1

ISO27001-2013_A.6.2.1

ISO 27001:2013 A.6.2.1

Organization of Information Security

Mobile device policy

Shared

n/a

A policy and supporting security measures shall be adopted to manage the risks introduced by using mobile devices.

A.6.2.2

ISO27001-2013_A.6.2.2

ISO 27001:2013 A.6.2.2

Organization of Information Security

Teleworking

Shared

n/a

A policy and supporting security measures shall be implemented to protect information accessed, processed or stored at teleworking sites.

A.9.1.2

ISO27001-2013_A.9.1.2

ISO 27001:2013 A.9.1.2

Access Control

Access to networks and network services

Shared

n/a

Users shall only be provided with access to the network and network services that they have been specifically authorized to use.

A.9.2.2

ISO27001-2013_A.9.2.2

ISO 27001:2013 A.9.2.2

Access Control

User access provisioning

Shared

n/a

A formal user access provisioning process shall be implemented to assign or revoke access rights for all user types to all systems and services.

A.9.2.3

ISO27001-2013_A.9.2.3

ISO 27001:2013 A.9.2.3

Access Control

Management of privileged access rights

Shared

n/a

The allocation and use of privileged access rights shall be restricted and controlled.

A.9.4.1

ISO27001-2013_A.9.4.1

ISO 27001:2013 A.9.4.1

Access Control

Information access restriction

Shared

n/a

Access to information and application system functions shall be restricted in accordance with the access control policy.

NIST_SP_800-171_R2_3.1.12

NIST_SP_800-171_R2_3

.1.12

NIST SP 800-171 R2 3.1.12

Access Control

Monitor and control remote access sessions.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Remote access is access to organizational systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the Internet). Remote access methods include dial-up, broadband, and wireless. Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate control (e.g., employing encryption techniques for confidentiality protection), may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks. VPNs with encrypted tunnels can affect the capability to adequately monitor network communications traffic for malicious code. Automated monitoring and control of remote access sessions allows organizations to detect cyber-attacks and help to ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of system components (e.g., servers, workstations, notebook computers, smart phones, and tablets). [SP 800-46], [SP 800-77], and [SP 800-113] provide guidance on secure remote access and virtual private networks.

NIST_SP_800-53_R4_AC-17(1)

NIST_SP_800-53_R4

AC-17(1)

NIST SP 800-53 Rev. 4 AC-17 (1)

Access Control

Automated Monitoring / Control

Shared

n/a

NIST_SP_800-53_R4_AC-2(1)

NIST_SP_800-53_R4

AC-2(1)

NIST SP 800-53 Rev. 4 AC-2 (1)

Access Control

Automated System Account Management

Shared

n/a

NIST_SP_800-53_R4_AC-2(4)

NIST_SP_800-53_R4

AC-2(4)

NIST SP 800-53 Rev. 4 AC-2 (4)

Access Control

Automated Audit Actions

Shared

n/a

NIST_SP_800-53_R5_AC-17(1)

NIST_SP_800-53_R5

AC-17(1)

NIST SP 800-53 Rev. 5 AC-17 (1)

Access Control

Monitoring and Control

Shared

n/a

Employ automated mechanisms to monitor and control remote access methods.

NIST_SP_800-53_R5_AC-2(1)

NIST_SP_800-53_R5

AC-2(1)

NIST SP 800-53 Rev. 5 AC-2 (1)

Access Control

Automated System Account Management

Shared

n/a

Support the management of system accounts using [Assignment: organization-defined automated mechanisms].

NIST_SP_800-53_R5_AC-2(4)

NIST_SP_800-53_R5

AC-2(4)

NIST SP 800-53 Rev. 5 AC-2 (4)

Access Control

Automated Audit Actions

Shared

n/a

Automatically audit account creation, modification, enabling, disabling, and removal actions.

PCI_DSS_v4.0

10.2.1.5

PCI_DSS_v4.0_10.2.1.5

PCI DSS v4.0 10.2.1.5

Requirement 10: Log and Monitor All Access to System Components and Cardholder Data

Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events

Shared

n/a

Audit logs capture all changes to identification and authentication credentials including, but not limited to: • Creation of new accounts. • Elevation of privileges. • All changes, additions, or deletions to accounts with administrative access.

PCI_DSS_v4.0

7.3.1

PCI_DSS_v4.0_7.3.1

PCI DSS v4.0 7.3.1

Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know

Access to system components and data is managed via an access control system(s)

Shared

n/a

An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components.

PCI_DSS_v4.0

7.3.2

PCI_DSS_v4.0_7.3.2

PCI DSS v4.0 7.3.2

Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know

Access to system components and data is managed via an access control system(s)

Shared

n/a

The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function.

SWIFT_CSCF_v2022

5.1

SWIFT_CSCF_v2022_5.1

SWIFT CSCF v2022 5.1

5. Manage Identities and Segregate Privileges

Enforce the security principles of need-to-know access, least privilege, and separation of duties for operator accounts.

Shared

n/a

Accounts are defined according to the security principles of need-to-know access, least privilege, and separation of duties.