Az Policy Advertizer

Azure_Security_Benchmark_v3.0

DP-5

Azure_Security_Benchmark_v3.0_DP-5

Microsoft cloud security benchmark DP-5

Data Protection

Use customer-managed key option in data at rest encryption when required

Shared

**Security Principle:** If required for regulatory compliance, define the use case and service scope where customer-managed key option is needed. Enable and implement data at rest encryption using customer-managed key in services. **Azure Guidance:** Azure also provides encryption option using keys managed by yourself (customer-managed keys) for certain services. However, using customer-managed key option requires additional operational efforts to manage the key lifecycle. This may include encryption key generation, rotation, revoke and access control, etc. **Implementation and additional context:** Encryption model and key management table: https://docs.microsoft.com/azure/security/fundamentals/encryption-models Services that support encryption using customer-managed key: https://docs.microsoft.com/azure/security/fundamentals/encryption-models#supporting-services How to configure customer managed encryption keys in Azure Storage: https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal

n/a

CMMC_2.0_L2_SC.L2-3.13.10

CMMC_2.0_L2

SC.L2-3.13.10

404 not found

n/a

CMMC_L3

SC.3.177

CMMC_L3_SC.3.177

CMMC L3 SC.3.177

System and Communications Protection

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptography can be employed to support many security solutions including the protection of controlled unclassified information, the provision of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances for such information but lack the necessary formal access approvals. Cryptography can also be used to support random number generation and hash generation. Cryptographic standards include FIPSvalidated cryptography and/or NSA-approved cryptography.

DORA_2022_2554

9.3b

DORA_2022_2554_9.3b

DORA 2022 2554 9.3b

Minimize Risks of Data Corruption and Loss in ICT Processes

Shared

n/a

Implement information and communication technology (ICT) processes that minimize the risk of data corruption or loss, unauthorized access, and technical flaws that may disrupt business activities.

DORA_2022_2554

9.3c

DORA_2022_2554_9.3c

DORA 2022 2554 9.3c

Prevent Data Availability and Integrity Issues in ICT Systems

Shared

n/a

Implement measures in information and communication technology (ICT) to prevent issues related to data availability, authenticity, integrity, confidentiality breaches, and data loss.

EU_GDPR_2016_679_Art._24

EU General Data Protection Regulation (GDPR) 2016/679 Art. 24

Chapter 4 - Controller and processor

Responsibility of the controller

Shared

n/a

306

EU_GDPR_2016_679_Art._25

EU General Data Protection Regulation (GDPR) 2016/679 Art. 25

Chapter 4 - Controller and processor

Data protection by design and by default

Shared

n/a

306

EU_GDPR_2016_679_Art._28

EU General Data Protection Regulation (GDPR) 2016/679 Art. 28

Chapter 4 - Controller and processor

Processor

Shared

n/a

306

EU_GDPR_2016_679_Art._32

EU General Data Protection Regulation (GDPR) 2016/679 Art. 32

Chapter 4 - Controller and processor

Security of processing

Shared

n/a

306

FedRAMP_High_R4

SC-12

FedRAMP_High_R4_SC-12

FedRAMP High SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]. Supplemental Guidance: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems. Related controls: SC-13, SC-17. References: NIST Special Publications 800-56, 800-57.

FedRAMP_Moderate_R4_SC-12

FedRAMP_Moderate_R4

SC-12

FedRAMP Moderate SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

2.10.1

K_ISMS_P_2018_2.10.1

K ISMS P 2018 2.10.1

2.10

Establish Procedures for Managing the Security of System Operations

Shared

n/a

Establish and implement operating procedures for managing the security of system operations such as designating system administrators, updating policies, changing rulesets, monitoring events, managing policy implementations or exceptions.

408

2.10.2

K_ISMS_P_2018_2.10.2

K ISMS P 2018 2.10.2

2.10

Establish Protective Measures for Administrator Privileges and Security Configurations

Shared

n/a

Establish and implement protective measures with regard to administrator privileges and security configurations to ensure that important information and personal information are not exposed as a result of unauthorized access by service type or misconfigurations.

385

2.7.1b

K_ISMS_P_2018_2.7.1b

K ISMS P 2018 2.7.1b

2.7

Ensure Data is Encrypted at Rest and In-Transit

Shared

n/a

Ensure data is encrypted when storing and transmitting personal and important information.

2.7.2

K_ISMS_P_2018_2.7.2

K ISMS P 2018 2.7.2

2.7

Establish Encryption Key Management Procedures

Shared

n/a

Establish and implement procedures for securely creating, using, storing, distributing, and destroying encryption keys. Additionally, establish and implement procedures for recovering encryption keys, if necessary.

New_Zealand_ISM_23.4.9.C.01

3.4.3

K_ISMS_P_2018_3.4.3

K ISMS P 2018 3.4.3

3.4

Implement Measure to Protect the Personal Information of Dormant Users

Shared

n/a

Implement measures to protect the personal information of dormant users including notification of relevant matters, or disposal of storage of personal information.

New_Zealand_ISM

23.4.9.C.01

23. Public Cloud Security

23.4.9.C.01 Data protection mechanisms

n/a

For each cloud service, agencies MUST ensure that the mechanisms used to protect data meet agency requirements.

NIST_SP_800-171_R2_3

.13.10

NIST_SP_800-171_R2_3.13.10

NIST SP 800-171 R2 3.13.10

System and Communications Protection

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters. [SP 800-56A] and [SP 800-57-1] provide guidance on cryptographic key management and key establishment.

NIST_SP_800-53_R4

SC-12

NIST_SP_800-53_R4_SC-12

NIST SP 800-53 Rev. 4 SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

NIST_SP_800-53_R5

SC-12

NIST_SP_800-53_R5_SC-12

NIST SP 800-53 Rev. 5 SC-12

System and Communications Protection

Cryptographic Key Establishment and Management

Shared

n/a

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

NZ_ISM_v3.5

CR-3

NZ_ISM_v3.5_CR-3

NZISM Security Benchmark CR-3

Cryptography

17.1.53 Reducing storage and physical transfer requirements

Customer

n/a

When encryption is applied to media or media residing within IT equipment it provides an additional layer of defence. Whilst such measures do not reduce or alter the classification of the information itself, physical storage, handling and transfer requirements may be reduced to those of a lesser classification for the media or equipment (but not the data itself).

NZISM_Security_Benchmark_v1.1

CR-3

NZISM_Security_Benchmark_v1.1_CR-3

NZISM Security Benchmark CR-3

Cryptography

17.1.46 Reducing storage and physical transfer requirements

Customer

If an agency wishes to use encryption to reduce the storage or physical transfer requirements for IT equipment or media that contains classified information, they SHOULD use: full disk encryption; or partial disk encryption where the access control will only allow writing to the encrypted partition holding the classified information.

RBI_CSF_Banks_v2016

13.4

RBI_CSF_Banks_v2016_13.4

Advanced Real-Timethreat Defenceand Management

Advanced Real-Timethreat Defenceand Management-13.4

n/a

Consider implementingsecure web gateways with capability to deep scan network packets including secure (HTTPS, etc.) traffic passing through the web/internet gateway

RBI_CSF_Banks_v2016

21.1

RBI_CSF_Banks_v2016_21.1

Metrics

Metrics-21.1

n/a

Develop a comprehensive set of metrics that provide for prospective and retrospective measures, like key performance indicators and key risk indicators

RMiT_v1.0

10.53

RMiT_v1.0_10.53

RMiT 10.53

Cloud Services

Cloud Services - 10.53

Shared

n/a

A financial institution must implement appropriate safeguards on customer and counterparty information and proprietary data when using cloud services to protect against unauthorised disclosure and access. This shall include retaining ownership, control and management of all data pertaining to customer and counterparty information, proprietary data and services hosted on the cloud, including the relevant cryptographic keys management.

SOC_2

CC6.1

SOC_2_CC6.1

SOC 2 Type 2 CC6.1

Logical and Physical Access Controls

Logical access security software, infrastructure, and architectures

Shared

The customer is responsible for implementing this recommendation.

The following points of focus, specifically related to all engagements using the trust services criteria, highlight important characteristics relating to this criterion: • Identifies and Manages the Inventory of Information Assets — The entity identifies, Page 29 TSP Ref. # TRUST SERVICES CRITERIA AND POINTS OF FOCUS inventories, classifies, and manages information assets. • Restricts Logical Access — Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets. • Identifies and Authenticates Users — Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely. • Considers Network Segmentation — Network segmentation permits unrelated portions of the entity's information system to be isolated from each other. • Manages Points of Access — Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. • Restricts Access to Information Assets — Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. • Manages Identification and Authentication — Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. • Manages Credentials for Infrastructure and Software — New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. • Uses Encryption to Protect Data — The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. • Protects Encryption Keys — Processes are in place to protect encryption keys during generation, storage, use, and destruction

SWIFT_CSCF_v2021

2.5A

SWIFT_CSCF_v2021_2.5A

SWIFT CSCF v2021 2.5A

Reduce Attack Surface and Vulnerabilities

External Transmission Data Protection

n/a

Protect the confidentiality of SWIFT-related data transmitted or stored outside of the secure zone as part of operational processes.