| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
2.1 |
CIS_Azure_1.1.0_2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1 |
2 Security Center |
Ensure that standard pricing tier is selected |
Shared |
The customer is responsible for implementing this recommendation. |
The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
15 |
| CIS_Azure_1.1.0 |
2.12 |
CIS_Azure_1.1.0_2.12 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.12 |
2 Security Center |
Ensure ASC Default policy setting "Monitor JIT Network Access" is not "Disabled" |
Shared |
The customer is responsible for implementing this recommendation. |
Enable JIT Network Access for virtual machines. |
link |
2 |
| CIS_Azure_1.3.0 |
2.1 |
CIS_Azure_1.3.0_2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1 |
2 Security Center |
Ensure that Azure Defender is set to On for Servers |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Server, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.10 |
CIS_Azure_1.3.0_2.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.10 |
2 Security Center |
Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Microsoft Cloud App Security (MCAS) integration with Security Center. |
link |
8 |
| CIS_Azure_1.3.0 |
2.2 |
CIS_Azure_1.3.0_2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.2 |
2 Security Center |
Ensure that Azure Defender is set to On for App Service |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.3 |
CIS_Azure_1.3.0_2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.3 |
2 Security Center |
Ensure that Azure Defender is set to On for Azure SQL database servers |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.4 |
CIS_Azure_1.3.0_2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.4 |
2 Security Center |
Ensure that Azure Defender is set to On for SQL servers on machines |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.5 |
CIS_Azure_1.3.0_2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.5 |
2 Security Center |
Ensure that Azure Defender is set to On for Storage |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.6 |
CIS_Azure_1.3.0_2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.6 |
2 Security Center |
Ensure that Azure Defender is set to On for Kubernetes |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.7 |
CIS_Azure_1.3.0_2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.7 |
2 Security Center |
Ensure that Azure Defender is set to On for Container Registries |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Container Registries, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.8 |
CIS_Azure_1.3.0_2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.8 |
2 Security Center |
Ensure that Azure Defender is set to On for Key Vault |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Azure Defender enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center. |
link |
9 |
| CIS_Azure_1.3.0 |
2.9 |
CIS_Azure_1.3.0_2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.9 |
2 Security Center |
Ensure that Windows Defender ATP (WDATP) integration with Security Center is selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Windows Defender ATP (WDATP) integration with Security Center. |
link |
8 |
| CIS_Azure_1.4.0 |
2.1 |
CIS_Azure_1.4.0_2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.1 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Servers is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.10 |
CIS_Azure_1.4.0_2.10 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.10 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is Selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Microsoft Defender for Cloud Apps (MCAS) integration with Microsoft Defender for Cloud. |
link |
8 |
| CIS_Azure_1.4.0 |
2.2 |
CIS_Azure_1.4.0_2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.2 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for App Service is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.3 |
CIS_Azure_1.4.0_2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.3 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Azure SQL Databases is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Azure SQL Databases enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.4 |
CIS_Azure_1.4.0_2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.4 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for SQL servers on machines is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.5 |
CIS_Azure_1.4.0_2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.5 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Storage is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.6 |
CIS_Azure_1.4.0_2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.6 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Kubernetes is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Kubernetes enables threat detection for Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.7 |
CIS_Azure_1.4.0_2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.7 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Container Registries is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Container Registries enables threat detection for Container Registries, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.8 |
CIS_Azure_1.4.0_2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.8 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Key Vault is set to 'On' |
Shared |
The customer is responsible for implementing this recommendation. |
Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. |
link |
9 |
| CIS_Azure_1.4.0 |
2.9 |
CIS_Azure_1.4.0_2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 2.9 |
2 Microsoft Defender for Cloud |
Ensure that Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected |
Shared |
The customer is responsible for implementing this recommendation. |
This setting enables Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud. |
link |
8 |
| FedRAMP_High_R4 |
SI-4(22) |
FedRAMP_High_R4_SI-4(22) |
FedRAMP High SI-4 (22) |
System And Information Integrity |
Unauthorized Network Services |
Shared |
n/a |
The information system detects network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes] and [Selection (one or more): audits; alerts [Assignment: organization-defined personnel or roles]].
Supplemental Guidance: Unauthorized or unapproved network services include, for example, services in service-oriented architectures that lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Related controls: AC-6, CM-7, SA-5, SA-9. |
link |
1 |
| hipaa |
0201.09j1Organizational.124-09.j |
hipaa-0201.09j1Organizational.124-09.j |
0201.09j1Organizational.124-09.j |
02 Endpoint Protection |
0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software are addressed via a network-based malware detection (NBMD) solution. |
|
18 |
| hipaa |
0663.10h1System.7-10.h |
hipaa-0663.10h1System.7-10.h |
0663.10h1System.7-10.h |
06 Configuration Management |
0663.10h1System.7-10.h 10.04 Security of System Files |
Shared |
n/a |
The operating system has in place supporting technical controls such as antivirus, file integrity monitoring, host-based (personal) firewalls or port filtering tools, and logging as part of its baseline. |
|
16 |
| hipaa |
0825.09m3Organizational.23-09.m |
hipaa-0825.09m3Organizational.23-09.m |
0825.09m3Organizational.23-09.m |
08 Network Protection |
0825.09m3Organizational.23-09.m 09.06 Network Security Management |
Shared |
n/a |
Technical tools such as an IDS/IPS are implemented and operating on the network perimeter and other key points to identify vulnerabilities, monitor traffic, detect attack attempts and successful compromises, and mitigate threats; and these tools are updated on a regular basis. |
|
7 |
| hipaa |
0870.09m3Organizational.20-09.m |
hipaa-0870.09m3Organizational.20-09.m |
0870.09m3Organizational.20-09.m |
08 Network Protection |
0870.09m3Organizational.20-09.m 09.06 Network Security Management |
Shared |
n/a |
Access to all proxies is denied, except for those hosts, ports, and services that are explicitly required. |
|
8 |
| hipaa |
1411.09f1System.1-09.f |
hipaa-1411.09f1System.1-09.f |
1411.09f1System.1-09.f |
14 Third Party Assurance |
1411.09f1System.1-09.f 09.02 Control Third Party Service Delivery |
Shared |
n/a |
The results of monitoring activities of third-party services are compared against the Service Level Agreements or contracts at least annually. |
|
9 |
| NIST_SP_800-171_R2_3 |
.14.6 |
NIST_SP_800-171_R2_3.14.6 |
NIST SP 800-171 R2 3.14.6 |
System and Information Integrity |
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the system. Organizations can monitor systems, for example, by observing audit record activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. System monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms supporting critical applications, with such devices being employed at managed system interfaces. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of systems to support such objectives. System monitoring is an integral part of continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Unusual or unauthorized activities or conditions related to inbound/outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. [SP 800-94] provides guidance on intrusion detection and prevention systems. |
link |
31 |
| NIST_SP_800-53_R4 |
SI-4(22) |
NIST_SP_800-53_R4_SI-4(22) |
NIST SP 800-53 Rev. 4 SI-4 (22) |
System And Information Integrity |
Unauthorized Network Services |
Shared |
n/a |
The information system detects network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes] and [Selection (one or more): audits; alerts [Assignment: organization-defined personnel or roles]].
Supplemental Guidance: Unauthorized or unapproved network services include, for example, services in service-oriented architectures that lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Related controls: AC-6, CM-7, SA-5, SA-9. |
link |
1 |
| NIST_SP_800-53_R5 |
SI-4(22) |
NIST_SP_800-53_R5_SI-4(22) |
NIST SP 800-53 Rev. 5 SI-4 (22) |
System and Information Integrity |
Unauthorized Network Services |
Shared |
n/a |
(a) Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes]; and
(b) [Selection (OneOrMore): Audit;Alert [Assignment: organization-defined personnel or roles] ] when detected. |
link |
1 |
| SOC_2 |
CC7.2 |
SOC_2_CC7.2 |
SOC 2 Type 2 CC7.2 |
System Operations |
Monitor system components for anomalous behavior |
Shared |
The customer is responsible for implementing this recommendation. |
• Implements Detection Policies, Procedures, and Tools — Detection policies and
procedures are defined and implemented and detection tools are implemented on infrastructure and software to identify anomalies in the operation or unusual activity
on systems. Procedures may include (1) a defined governance process for security
event detection and management that includes provision of resources; (2) use of intelligence sources to identify newly discovered threats and vulnerabilities; and (3)
logging of unusual system activities.
• Designs Detection Measures — Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers;
(2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software.
• Implements Filters to Analyze Anomalies — Management has implemented procedures to filter, summarize, and analyze anomalies to identify security events.
• Monitors Detection Tools for Effective Operation — Management has implemented
processes to monitor the effectiveness of detection tools |
|
20 |
| SWIFT_CSCF_v2022 |
6.5A |
SWIFT_CSCF_v2022_6.5A |
SWIFT CSCF v2022 6.5A |
6. Detect Anomalous Activity to Systems or Transaction Records |
Detect and contain anomalous network activity into and within the local or remote SWIFT environment. |
Shared |
n/a |
Intrusion detection is implemented to detect unauthorised network access and anomalous activity. |
link |
18 |