compliance controls are associated with this Policy definition 'Detect network services that have not been authorized or approved' (86ecd378-a3a0-5d5b-207c-05e6aaca43fc)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
2.1 |
CIS_Azure_1.1.0_2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1 |
2 Security Center |
Ensure that standard pricing tier is selected |
Shared |
The customer is responsible for implementing this recommendation. |
The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
15 |
| CIS_Azure_1.1.0 |
2.12 |
CIS_Azure_1.1.0_2.12 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.12 |
2 Security Center |
Ensure ASC Default policy setting "Monitor JIT Network Access" is not "Disabled" |
Shared |
The customer is responsible for implementing this recommendation. |
Enable JIT Network Access for virtual machines. |
link |
2 |
| CIS_Azure_1.3.0 |
2.1 |
CIS_Azure_1.3.0_2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1 |
2 Security Center |
Ensure that Azure Defender is set to On for Servers |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Server, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.10 |
CIS_Azure_1.3.0_2.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.10 |
2 Security Center |
Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Microsoft Cloud App Security (MCAS) integration with Security Center. |
link |
8 |
| CIS_Azure_1.3.0 |
2.2 |
CIS_Azure_1.3.0_2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.2 |
2 Security Center |
Ensure that Azure Defender is set to On for App Service |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.3 |
CIS_Azure_1.3.0_2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.3 |
2 Security Center |
Ensure that Azure Defender is set to On for Azure SQL database servers |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.4 |
CIS_Azure_1.3.0_2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.4 |
2 Security Center |
Ensure that Azure Defender is set to On for SQL servers on machines |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.5 |
CIS_Azure_1.3.0_2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.5 |
2 Security Center |
Ensure that Azure Defender is set to On for Storage |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.6 |
CIS_Azure_1.3.0_2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.6 |
2 Security Center |
Ensure that Azure Defender is set to On for Kubernetes |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.7 |
CIS_Azure_1.3.0_2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.7 |
2 Security Center |
Ensure that Azure Defender is set to On for Container Registries |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Container Registries, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.8 |
CIS_Azure_1.3.0_2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.8 |
2 Security Center |
Ensure that Azure Defender is set to On for Key Vault |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.9 |
CIS_Azure_1.3.0_2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.9 |
2 Security Center |
Ensure that Windows Defender ATP (WDATP) integration with Security Center is selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Windows Defender ATP (WDATP) integration with Security Center. |
link |
8 |
| CIS_Azure_1.4.0 |
2.1 |
CIS_Azure_1.4.0_2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Servers is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.10 |
CIS_Azure_1.4.0_2.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.10 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is Selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Microsoft Defender for Cloud Apps (MCAS) integration with Microsoft Defender for Cloud. |
link |
8 |
| CIS_Azure_1.4.0 |
2.2 |
CIS_Azure_1.4.0_2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.2 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for App Service is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.3 |
CIS_Azure_1.4.0_2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.3 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Azure SQL Databases is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Azure SQL Databases enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.4 |
CIS_Azure_1.4.0_2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.4 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for SQL servers on machines is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.5 |
CIS_Azure_1.4.0_2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.5 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Storage is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.6 |
CIS_Azure_1.4.0_2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.6 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Kubernetes is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Kubernetes enables threat detection for Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.7 |
CIS_Azure_1.4.0_2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.7 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Container Registries is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Container Registries enables threat detection for Container Registries, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.8 |
CIS_Azure_1.4.0_2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.8 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Key Vault is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.9 |
CIS_Azure_1.4.0_2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.9 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud. |
link |
8 |
| CIS_Azure_2.0.0 |
2.1.1 |
CIS_Azure_2.0.0_2.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.1 |
2.1 |
Ensure That Microsoft Defender for Servers Is Set to 'On' |
Shared |
Turning on Microsoft Defender for Servers in Microsoft Defender for Cloud incurs an additional cost per resource. |
Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for Servers allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.10 |
CIS_Azure_2.0.0_2.1.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.10 |
2.1 |
Ensure That Microsoft Defender for Key Vault Is Set To 'On' |
Shared |
Turning on Microsoft Defender for Key Vault incurs an additional cost per resource. |
Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for Key Vault allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.17 |
CIS_Azure_2.0.0_2.1.17 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.17 |
2.1 |
Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On' |
Shared |
Microsoft Defender for Containers will require additional licensing. |
Enable automatic provisioning of the Microsoft Defender for Containers components.
As with any compute resource, Container environments require hardening and run-time protection to ensure safe operations and detection of threats and vulnerabilities. |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.2 |
CIS_Azure_2.0.0_2.1.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.2 |
2.1 |
Ensure That Microsoft Defender for App Services Is Set To 'On' |
Shared |
Turning on Microsoft Defender for App Service incurs an additional cost per resource. |
Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for App Service allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.21 |
CIS_Azure_2.0.0_2.1.21 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.21 |
2.1 |
Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected |
Shared |
Microsoft Defender for Cloud Apps works with Standard pricing tier Subscription. Choosing the Standard pricing tier of Microsoft Defender for Cloud incurs an additional cost per resource. |
This integration setting enables Microsoft Defender for Cloud Apps (formerly 'Microsoft Cloud App Security' or 'MCAS' - see additional info) to communicate with Microsoft Defender for Cloud.
Microsoft Defender for Cloud offers an additional layer of protection by using Azure Resource Manager events, which is considered to be the control plane for Azure. By analyzing the Azure Resource Manager records, Microsoft Defender for Cloud detects unusual or potentially harmful operations in the Azure subscription environment.
Several of the preceding analytics are powered by Microsoft Defender for Cloud Apps. To benefit from these analytics, subscription must have a Cloud App Security license.
Microsoft Defender for Cloud Apps works only with Standard Tier subscriptions. |
link |
8 |
| CIS_Azure_2.0.0 |
2.1.22 |
CIS_Azure_2.0.0_2.1.22 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.22 |
2.1 |
Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected |
Shared |
Microsoft Defender for Endpoint works with Standard pricing tier Subscription. Choosing the Standard pricing tier of Microsoft Defender for Cloud incurs an additional cost per resource. |
This integration setting enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud.
**IMPORTANT:** When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable.
1. For server 2019 & above if defender is installed (default for these server SKU's) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal.
1. If the new unified agent is required for server SKU's of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned.
Microsoft Defender for Endpoint integration brings comprehensive Endpoint Detection and Response (EDR) capabilities within Microsoft Defender for Cloud. This integration helps to spot abnormalities, as well as detect and respond to advanced attacks on endpoints monitored by Microsoft Defender for Cloud.
MDE works only with Standard Tier subscriptions. |
link |
8 |
| CIS_Azure_2.0.0 |
2.1.4 |
CIS_Azure_2.0.0_2.1.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.4 |
2.1 |
Ensure That Microsoft Defender for Azure SQL Databases Is Set To 'On' |
Shared |
Turning on Microsoft Defender for Azure SQL Databases incurs an additional cost per resource. |
Turning on Microsoft Defender for Azure SQL Databases enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for Azure SQL Databases allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.5 |
CIS_Azure_2.0.0_2.1.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.5 |
2.1 |
Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' |
Shared |
Turning on Microsoft Defender for SQL servers on machines incurs an additional cost per resource. |
Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for SQL servers on machines allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.7 |
CIS_Azure_2.0.0_2.1.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.7 |
2.1 |
Ensure That Microsoft Defender for Storage Is Set To 'On' |
Shared |
Turning on Microsoft Defender for Storage incurs an additional cost per resource. |
Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for Storage allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| CIS_Azure_2.0.0 |
2.1.8 |
CIS_Azure_2.0.0_2.1.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1.8 |
2.1 |
Ensure That Microsoft Defender for Containers Is Set To 'On' |
Shared |
Turning on Microsoft Defender for Containers incurs an additional cost per resource. |
Turning on Microsoft Defender for Containers enables threat detection for Container Registries including Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for Container Registries allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC). |
link |
9 |
| FedRAMP_High_R4 |
SI-4(22) |
FedRAMP_High_R4_SI-4(22) |
FedRAMP High SI-4 (22) |
System And Information Integrity |
Unauthorized Network Services |
Shared |
n/a |
The information system detects network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes] and [Selection (one or more): audits; alerts [Assignment: organization-defined personnel or roles]].
Supplemental Guidance: Unauthorized or unapproved network services include, for example, services in service-oriented architectures that lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Related controls: AC-6, CM-7, SA-5, SA-9. |
link |
1 |
| hipaa |
0201.09j1Organizational.124-09.j |
hipaa-0201.09j1Organizational.124-09.j |
0201.09j1Organizational.124-09.j |
02 Endpoint Protection |
0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software are addressed via a network-based malware detection (NBMD) solution. |
|
18 |
| hipaa |
0663.10h1System.7-10.h |
hipaa-0663.10h1System.7-10.h |
0663.10h1System.7-10.h |
06 Configuration Management |
0663.10h1System.7-10.h 10.04 Security of System Files |
Shared |
n/a |
The operating system has in place supporting technical controls such as antivirus, file integrity monitoring, host-based (personal) firewalls or port filtering tools, and logging as part of its baseline. |
|
16 |
| hipaa |
0825.09m3Organizational.23-09.m |
hipaa-0825.09m3Organizational.23-09.m |
0825.09m3Organizational.23-09.m |
08 Network Protection |
0825.09m3Organizational.23-09.m 09.06 Network Security Management |
Shared |
n/a |
Technical tools such as an IDS/IPS are implemented and operating on the network perimeter and other key points to identify vulnerabilities, monitor traffic, detect attack attempts and successful compromises, and mitigate threats; and these tools are updated on a regular basis. |
|
7 |
| hipaa |
0870.09m3Organizational.20-09.m |
hipaa-0870.09m3Organizational.20-09.m |
0870.09m3Organizational.20-09.m |
08 Network Protection |
0870.09m3Organizational.20-09.m 09.06 Network Security Management |
Shared |
n/a |
Access to all proxies is denied, except for those hosts, ports, and services that are explicitly required. |
|
8 |
| hipaa |
1411.09f1System.1-09.f |
hipaa-1411.09f1System.1-09.f |
1411.09f1System.1-09.f |
14 Third Party Assurance |
1411.09f1System.1-09.f 09.02 Control Third Party Service Delivery |
Shared |
n/a |
The results of monitoring activities of third-party services are compared against the Service Level Agreements or contracts at least annually. |
|
9 |
| NIST_SP_800-171_R2_3 |
.14.6 |
NIST_SP_800-171_R2_3.14.6 |
NIST SP 800-171 R2 3.14.6 |
System and Information Integrity |
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the system. Organizations can monitor systems, for example, by observing audit record activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. System monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms supporting critical applications, with such devices being employed at managed system interfaces. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of systems to support such objectives. System monitoring is an integral part of continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Unusual or unauthorized activities or conditions related to inbound/outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. [SP 800-94] provides guidance on intrusion detection and prevention systems. |
link |
28 |
| NIST_SP_800-53_R4 |
SI-4(22) |
NIST_SP_800-53_R4_SI-4(22) |
NIST SP 800-53 Rev. 4 SI-4 (22) |
System And Information Integrity |
Unauthorized Network Services |
Shared |
n/a |
The information system detects network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes] and [Selection (one or more): audits; alerts [Assignment: organization-defined personnel or roles]].
Supplemental Guidance: Unauthorized or unapproved network services include, for example, services in service-oriented architectures that lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Related controls: AC-6, CM-7, SA-5, SA-9. |
link |
1 |
| NIST_SP_800-53_R5 |
SI-4(22) |
NIST_SP_800-53_R5_SI-4(22) |
NIST SP 800-53 Rev. 5 SI-4 (22) |
System and Information Integrity |
Unauthorized Network Services |
Shared |
n/a |
(a) Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes]; and
(b) [Selection (OneOrMore): Audit;Alert [Assignment: organization-defined personnel or roles] ] when detected. |
link |
1 |
| SOC_2 |
CC7.2 |
SOC_2_CC7.2 |
SOC 2 Type 2 CC7.2 |
System Operations |
Monitor system components for anomalous behavior |
Shared |
The customer is responsible for implementing this recommendation. |
• Implements Detection Policies, Procedures, and Tools — Detection policies and
procedures are defined and implemented and detection tools are implemented on infrastructure and software to identify anomalies in the operation or unusual activity
on systems. Procedures may include (1) a defined governance process for security
event detection and management that includes provision of resources; (2) use of intelligence sources to identify newly discovered threats and vulnerabilities; and (3)
logging of unusual system activities.
• Designs Detection Measures — Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers;
(2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software.
• Implements Filters to Analyze Anomalies — Management has implemented procedures to filter, summarize, and analyze anomalies to identify security events.
• Monitors Detection Tools for Effective Operation — Management has implemented
processes to monitor the effectiveness of detection tools |
|
20 |
| SWIFT_CSCF_v2022 |
6.5A |
SWIFT_CSCF_v2022_6.5A |
SWIFT CSCF v2022 6.5A |
6. Detect Anomalous Activity to Systems or Transaction Records |
Detect and contain anomalous network activity into and within the local or remote SWIFT environment. |
Shared |
n/a |
Intrusion detection is implemented to detect unauthorised network access and anomalous activity. |
link |
18 |