| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
1.3 |
CIS_Azure_1.1.0_1.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.3 |
1 Identity and Access Management |
Ensure that there are no guest users |
Shared |
The customer is responsible for implementing this recommendation. |
Do not add guest users if not needed. |
link |
8 |
| CIS_Azure_1.3.0 |
1.3 |
CIS_Azure_1.3.0_1.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.3 |
1 Identity and Access Management |
Ensure guest users are reviewed on a monthly basis |
Shared |
The customer is responsible for implementing this recommendation. |
Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.
Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user. |
link |
8 |
| CIS_Azure_1.4.0 |
1.3 |
CIS_Azure_1.4.0_1.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 1.3 |
1 Identity and Access Management |
Ensure guest users are reviewed on a monthly basis |
Shared |
The customer is responsible for implementing this recommendation. |
Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.
Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user. |
link |
8 |
| FedRAMP_High_R4 |
AC-6(7) |
FedRAMP_High_R4_AC-6(7) |
FedRAMP High AC-6 (7) |
Access Control |
Review Of User Privileges |
Shared |
n/a |
The organization:
(a) Reviews [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and
(b) Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
Supplemental Guidance: The need for certain assigned user privileges may change over time reflecting changes in organizational missions/business function, environments of operation, technologies, or threat. Periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions. Related control: CA-7. |
link |
4 |
| hipaa |
1168.01e2System.2-01.e |
hipaa-1168.01e2System.2-01.e |
1168.01e2System.2-01.e |
11 Access Control |
1168.01e2System.2-01.e 01.02 Authorized Access to Information Systems |
Shared |
n/a |
The organization reviews critical system accounts and privileged access rights every 60 days; all other accounts, including user access and changes to access authorizations, are reviewed every 90 days. |
|
4 |
| hipaa |
1232.09c3Organizational.12-09.c |
hipaa-1232.09c3Organizational.12-09.c |
1232.09c3Organizational.12-09.c |
12 Audit Logging & Monitoring |
1232.09c3Organizational.12-09.c 09.01 Documented Operating Procedures |
Shared |
n/a |
Access for individuals responsible for administering access controls is limited to the minimum necessary based upon each user's role and responsibilities and these individuals cannot access audit functions related to these controls. |
|
21 |
| hipaa |
1276.09c2Organizational.2-09.c |
hipaa-1276.09c2Organizational.2-09.c |
1276.09c2Organizational.2-09.c |
12 Audit Logging & Monitoring |
1276.09c2Organizational.2-09.c 09.01 Documented Operating Procedures |
Shared |
n/a |
Security audit activities are independent. |
|
18 |
| ISO27001-2013 |
A.9.2.5 |
ISO27001-2013_A.9.2.5 |
ISO 27001:2013 A.9.2.5 |
Access Control |
Review of user access rights |
Shared |
n/a |
Asset owners shall review users' access rights at regular intervals. |
link |
17 |
| NIST_SP_800-53_R4 |
AC-6(7) |
NIST_SP_800-53_R4_AC-6(7) |
NIST SP 800-53 Rev. 4 AC-6 (7) |
Access Control |
Review Of User Privileges |
Shared |
n/a |
The organization:
(a) Reviews [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and
(b) Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
Supplemental Guidance: The need for certain assigned user privileges may change over time reflecting changes in organizational missions/business function, environments of operation, technologies, or threat. Periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions. Related control: CA-7. |
link |
4 |
| NIST_SP_800-53_R5 |
AC-6(7) |
NIST_SP_800-53_R5_AC-6(7) |
NIST SP 800-53 Rev. 5 AC-6 (7) |
Access Control |
Review of User Privileges |
Shared |
n/a |
(a) Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and
(b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs. |
link |
4 |
| SWIFT_CSCF_v2022 |
2.11A |
SWIFT_CSCF_v2022_2.11A |
SWIFT CSCF v2022 2.11A |
2. Reduce Attack Surface and Vulnerabilities |
Restrict transaction activity to validated and approved business counterparties. |
Shared |
n/a |
Implement RMA controls to restrict transaction activity with effective business counterparties. |
link |
10 |
| SWIFT_CSCF_v2022 |
5.1 |
SWIFT_CSCF_v2022_5.1 |
SWIFT CSCF v2022 5.1 |
5. Manage Identities and Segregate Privileges |
Enforce the security principles of need-to-know access, least privilege, and separation of duties for operator accounts. |
Shared |
n/a |
Accounts are defined according to the security principles of need-to-know access, least privilege, and separation of duties. |
link |
35 |