Microsoft implements this System and Services Acquisition control
Name/Id: ACF1576 / Microsoft Managed Control 1576 Category: System and Services Acquisition Title: Acquisitions Process | Design / Implementation Information For Security Controls Ownership: Customer, Microsoft Description: The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: security-relevant external system interfaces and high-level design and implementation information required by the SDL process at a level of detail sufficient for secure deployment. Requirements: The acquisition process includes contractual requirements to provide documentation of security functionality, including security-relevant external system interfaces and high-level design. Documentation provided in response to this requirement is stored by Azure service teams in their internal SharePoint sites.
Rule resource types
IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups