last sync: 2023-Jan-27 18:40:07 UTC

Azure Policy definition

Authorize access to security functions and information

Name Authorize access to security functions and information
Azure Portal
Id aeed863a-0f56-429f-945d-8bb66bd06841
Version 1.1.0
details on versioning
Category Regulatory Compliance
Microsoft docs
Description CMA_0022 - Authorize access to security functions and information
Mode All
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default
Manual
Allowed
Manual, Disabled
RBAC
Role(s)
none
Rule
Aliases
Rule
ResourceTypes
IF (1)
Microsoft.Resources/subscriptions
Compliance The following 91 compliance controls are associated with this Policy definition 'Authorize access to security functions and information' (aeed863a-0f56-429f-945d-8bb66bd06841)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
CIS_Azure_1.1.0 1.10 CIS_Azure_1.1.0_1.10 CIS Microsoft Azure Foundations Benchmark recommendation 1.10 1 Identity and Access Management Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to provide consent for the apps before use. link 3
CIS_Azure_1.1.0 1.11 CIS_Azure_1.1.0_1.11 CIS Microsoft Azure Foundations Benchmark recommendation 1.11 1 Identity and Access Management Ensure that 'Users can register applications' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to register third-party applications. link 3
CIS_Azure_1.1.0 1.12 CIS_Azure_1.1.0_1.12 CIS Microsoft Azure Foundations Benchmark recommendation 1.12 1 Identity and Access Management Ensure that 'Guest user permissions are limited' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Limit guest user permissions. link 8
CIS_Azure_1.1.0 1.13 CIS_Azure_1.1.0_1.13 CIS Microsoft Azure Foundations Benchmark recommendation 1.13 1 Identity and Access Management Ensure that 'Members can invite' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict invitations to administrators only. link 8
CIS_Azure_1.1.0 1.14 CIS_Azure_1.1.0_1.14 CIS Microsoft Azure Foundations Benchmark recommendation 1.14 1 Identity and Access Management Ensure that 'Guests can invite' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict guest invitations. link 8
CIS_Azure_1.1.0 1.15 CIS_Azure_1.1.0_1.15 CIS Microsoft Azure Foundations Benchmark recommendation 1.15 1 Identity and Access Management Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Restrict access to the Azure AD administration portal to administrators only. link 7
CIS_Azure_1.1.0 1.16 CIS_Azure_1.1.0_1.16 CIS Microsoft Azure Foundations Benchmark recommendation 1.16 1 Identity and Access Management Ensure that 'Self-service group management enabled' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict group creation to administrators only. link 4
CIS_Azure_1.1.0 1.17 CIS_Azure_1.1.0_1.17 CIS Microsoft Azure Foundations Benchmark recommendation 1.17 1 Identity and Access Management Ensure that 'Users can create security groups' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict security group creation to administrators only. link 4
CIS_Azure_1.1.0 1.18 CIS_Azure_1.1.0_1.18 CIS Microsoft Azure Foundations Benchmark recommendation 1.18 1 Identity and Access Management Ensure that 'Users who can manage security groups' is set to 'None' Shared The customer is responsible for implementing this recommendation. Restrict security group management to administrators only. link 4
CIS_Azure_1.1.0 1.19 CIS_Azure_1.1.0_1.19 CIS Microsoft Azure Foundations Benchmark recommendation 1.19 1 Identity and Access Management Ensure that 'Users can create Office 365 groups' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict Office 365 group creation to administrators only. link 4
CIS_Azure_1.1.0 1.20 CIS_Azure_1.1.0_1.20 CIS Microsoft Azure Foundations Benchmark recommendation 1.20 1 Identity and Access Management Ensure that 'Users who can manage Office 365 groups' is set to 'None' Shared The customer is responsible for implementing this recommendation. Restrict Office 365 group management to administrators only. link 4
CIS_Azure_1.1.0 1.23 CIS_Azure_1.1.0_1.23 CIS Microsoft Azure Foundations Benchmark recommendation 1.23 1 Identity and Access Management Ensure that no custom subscription owner roles are created Shared The customer is responsible for implementing this recommendation. Subscription ownership should not include permission to create custom owner roles. The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access. link 6
CIS_Azure_1.1.0 1.9 CIS_Azure_1.1.0_1.9 CIS Microsoft Azure Foundations Benchmark recommendation 1.9 1 Identity and Access Management Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to provide consent for the apps before use. link 3
CIS_Azure_1.1.0 3.6 CIS_Azure_1.1.0_3.6 CIS Microsoft Azure Foundations Benchmark recommendation 3.6 3 Storage Accounts Ensure that 'Public access level' is set to Private for blob containers Shared The customer is responsible for implementing this recommendation. Disable anonymous access to blob containers. link 7
CIS_Azure_1.1.0 8.5 CIS_Azure_1.1.0_8.5 CIS Microsoft Azure Foundations Benchmark recommendation 8.5 8 Other Security Considerations Enable role-based access control (RBAC) within Azure Kubernetes Services Shared The customer is responsible for implementing this recommendation. Ensure that RBAC is enabled on all Azure Kubernetes Services Instances link 7
CIS_Azure_1.3.0 1.10 CIS_Azure_1.3.0_1.10 CIS Microsoft Azure Foundations Benchmark recommendation 1.10 1 Identity and Access Management Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to provide consent for the apps before use. link 3
CIS_Azure_1.3.0 1.11 CIS_Azure_1.3.0_1.11 CIS Microsoft Azure Foundations Benchmark recommendation 1.11 1 Identity and Access Management Ensure that 'Users can register applications' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to register third-party applications. link 3
CIS_Azure_1.3.0 1.12 CIS_Azure_1.3.0_1.12 CIS Microsoft Azure Foundations Benchmark recommendation 1.12 1 Identity and Access Management Ensure that 'Guest user permissions are limited' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Limit guest user permissions. link 8
CIS_Azure_1.3.0 1.13 CIS_Azure_1.3.0_1.13 CIS Microsoft Azure Foundations Benchmark recommendation 1.13 1 Identity and Access Management Ensure that 'Members can invite' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict invitations to administrators only. link 8
CIS_Azure_1.3.0 1.14 CIS_Azure_1.3.0_1.14 CIS Microsoft Azure Foundations Benchmark recommendation 1.14 1 Identity and Access Management Ensure that 'Guests can invite' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict guest being able to invite other guests to collaborate with your organization. link 8
CIS_Azure_1.3.0 1.15 CIS_Azure_1.3.0_1.15 CIS Microsoft Azure Foundations Benchmark recommendation 1.15 1 Identity and Access Management Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Restrict access to the Azure AD administration portal to administrators only. link 6
CIS_Azure_1.3.0 1.16 CIS_Azure_1.3.0_1.16 CIS Microsoft Azure Foundations Benchmark recommendation 1.16 1 Identity and Access Management Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict group creation to administrators only. link 4
CIS_Azure_1.3.0 1.17 CIS_Azure_1.3.0_1.17 CIS Microsoft Azure Foundations Benchmark recommendation 1.17 1 Identity and Access Management Ensure that 'Users can create security groups in Azure Portals' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict security group creation to administrators only. link 4
CIS_Azure_1.3.0 1.18 CIS_Azure_1.3.0_1.18 CIS Microsoft Azure Foundations Benchmark recommendation 1.18 1 Identity and Access Management Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict security group management to administrators only. link 4
CIS_Azure_1.3.0 1.19 CIS_Azure_1.3.0_1.19 CIS Microsoft Azure Foundations Benchmark recommendation 1.19 1 Identity and Access Management Ensure that 'Users can create Microsoft 365 groups in Azure Portals' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict Microsoft 365 group creation to administrators only. link 4
CIS_Azure_1.3.0 1.21 CIS_Azure_1.3.0_1.21 CIS Microsoft Azure Foundations Benchmark recommendation 1.21 1 Identity and Access Management Ensure that no custom subscription owner roles are created Shared The customer is responsible for implementing this recommendation. Subscription ownership should not include permission to create custom owner roles. The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access. link 6
CIS_Azure_1.3.0 1.23 CIS_Azure_1.3.0_1.23 CIS Microsoft Azure Foundations Benchmark recommendation 1.23 1 Identity and Access Management Ensure Custom Role is assigned for Administering Resource Locks Shared The customer is responsible for implementing this recommendation. Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration. link 4
CIS_Azure_1.3.0 1.9 CIS_Azure_1.3.0_1.9 CIS Microsoft Azure Foundations Benchmark recommendation 1.9 1 Identity and Access Management Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to provide consent for the apps before use. link 3
CIS_Azure_1.3.0 3.5 CIS_Azure_1.3.0_3.5 CIS Microsoft Azure Foundations Benchmark recommendation 3.5 3 Storage Accounts Ensure that 'Public access level' is set to Private for blob containers Shared The customer is responsible for implementing this recommendation. Disable anonymous access to blob containers and disallow blob public access on storage account. link 7
CIS_Azure_1.3.0 8.5 CIS_Azure_1.3.0_8.5 CIS Microsoft Azure Foundations Benchmark recommendation 8.5 8 Other Security Considerations Enable role-based access control (RBAC) within Azure Kubernetes Services Shared The customer is responsible for implementing this recommendation. Ensure that RBAC is enabled on all Azure Kubernetes Services Instances link 7
CIS_Azure_1.4.0 1.10 CIS_Azure_1.4.0_1.10 CIS Microsoft Azure Foundations Benchmark recommendation 1.10 1 Identity and Access Management Ensure that 'Users can add gallery apps to My Apps' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to provide consent for the apps before use. link 3
CIS_Azure_1.4.0 1.11 CIS_Azure_1.4.0_1.11 CIS Microsoft Azure Foundations Benchmark recommendation 1.11 1 Identity and Access Management Ensure that 'Users can register applications' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to register third-party applications. link 3
CIS_Azure_1.4.0 1.12 CIS_Azure_1.4.0_1.12 CIS Microsoft Azure Foundations Benchmark recommendation 1.12 1 Identity and Access Management Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'' Shared The customer is responsible for implementing this recommendation. Limit guest user permissions. link 8
CIS_Azure_1.4.0 1.13 CIS_Azure_1.4.0_1.13 CIS Microsoft Azure Foundations Benchmark recommendation 1.13 1 Identity and Access Management Ensure that 'Guest invite restrictions' is set to "Only users assigned to specific admin roles can invite guest users" Shared The customer is responsible for implementing this recommendation. Restrict invitations to users with specific admin roles only. link 8
CIS_Azure_1.4.0 1.14 CIS_Azure_1.4.0_1.14 CIS Microsoft Azure Foundations Benchmark recommendation 1.14 1 Identity and Access Management Ensure That 'Restrict access to Azure AD administration portal' is Set to "Yes" Shared The customer is responsible for implementing this recommendation. Restrict access to the Azure AD administration portal to administrators only. link 6
CIS_Azure_1.4.0 1.15 CIS_Azure_1.4.0_1.15 CIS Microsoft Azure Foundations Benchmark recommendation 1.15 1 Identity and Access Management Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes' Shared The customer is responsible for implementing this recommendation. Restricts group creation to administrators with permissions only. link 4
CIS_Azure_1.4.0 1.16 CIS_Azure_1.4.0_1.16 CIS Microsoft Azure Foundations Benchmark recommendation 1.16 1 Identity and Access Management Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict security group creation to administrators only. link 4
CIS_Azure_1.4.0 1.17 CIS_Azure_1.4.0_1.17 CIS Microsoft Azure Foundations Benchmark recommendation 1.17 1 Identity and Access Management Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict security group management to administrators only. link 4
CIS_Azure_1.4.0 1.18 CIS_Azure_1.4.0_1.18 CIS Microsoft Azure Foundations Benchmark recommendation 1.18 1 Identity and Access Management Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' Shared The customer is responsible for implementing this recommendation. Restrict Microsoft 365 group creation to administrators only. link 4
CIS_Azure_1.4.0 1.20 CIS_Azure_1.4.0_1.20 CIS Microsoft Azure Foundations Benchmark recommendation 1.20 1 Identity and Access Management Ensure That No Custom Subscription Owner Roles Are Created Shared The customer is responsible for implementing this recommendation. Subscription ownership should not include permission to create custom owner roles. The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access. link 6
CIS_Azure_1.4.0 1.22 CIS_Azure_1.4.0_1.22 CIS Microsoft Azure Foundations Benchmark recommendation 1.22 1 Identity and Access Management Ensure a Custom Role is Assigned Permissions for Administering Resource Locks Shared The customer is responsible for implementing this recommendation. Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration. link 4
CIS_Azure_1.4.0 1.9 CIS_Azure_1.4.0_1.9 CIS Microsoft Azure Foundations Benchmark recommendation 1.9 1 Identity and Access Management Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No' Shared The customer is responsible for implementing this recommendation. Require administrators to provide consent for the apps before use. link 3
CIS_Azure_1.4.0 3.5 CIS_Azure_1.4.0_3.5 CIS Microsoft Azure Foundations Benchmark recommendation 3.5 3 Storage Accounts Ensure that 'Public access level' is set to Private for blob containers Shared The customer is responsible for implementing this recommendation. Disable anonymous access to blob containers and disallow blob public access on storage account. link 7
CIS_Azure_1.4.0 8.7 CIS_Azure_1.4.0_8.7 CIS Microsoft Azure Foundations Benchmark recommendation 8.7 8 Other Security Considerations Enable role-based access control (RBAC) within Azure Kubernetes Services Shared The customer is responsible for implementing this recommendation. Ensure that RBAC is enabled on all Azure Kubernetes Services Instances link 7
FedRAMP_High_R4 AC-3 FedRAMP_High_R4_AC-3 FedRAMP High AC-3 Access Control Access Enforcement Shared n/a The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. Supplemental Guidance: Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security. Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PE-3. References: None. link 21
FedRAMP_High_R4 AC-6(1) FedRAMP_High_R4_AC-6(1) FedRAMP High AC-6 (1) Access Control Authorize Access To Security Functions Shared n/a The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information]. Supplemental Guidance: Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users. Related controls: AC-17, AC-18, AC-19. link 3
FedRAMP_Moderate_R4 AC-3 FedRAMP_Moderate_R4_AC-3 FedRAMP Moderate AC-3 Access Control Access Enforcement Shared n/a The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. Supplemental Guidance: Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security. Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PE-3. References: None. link 21
FedRAMP_Moderate_R4 AC-6(1) FedRAMP_Moderate_R4_AC-6(1) FedRAMP Moderate AC-6 (1) Access Control Authorize Access To Security Functions Shared n/a The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information]. Supplemental Guidance: Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users. Related controls: AC-17, AC-18, AC-19. link 3
hipaa 0227.09k2Organizational.12-09.k hipaa-0227.09k2Organizational.12-09.k 0227.09k2Organizational.12-09.k 02 Endpoint Protection 0227.09k2Organizational.12-09.k 09.04 Protection Against Malicious and Mobile Code Shared n/a The organization takes specific actions to protect against mobile code performing unauthorized actions. 18
hipaa 0894.01m2Organizational.7-01.m hipaa-0894.01m2Organizational.7-01.m 0894.01m2Organizational.7-01.m 08 Network Protection 0894.01m2Organizational.7-01.m 01.04 Network Access Control Shared n/a Networks are segregated from production-level networks when migrating physical servers, applications, or data to virtualized servers. 19
hipaa 11180.01c3System.6-01.c hipaa-11180.01c3System.6-01.c 11180.01c3System.6-01.c 11 Access Control 11180.01c3System.6-01.c 01.02 Authorized Access to Information Systems Shared n/a Access to management functions or administrative consoles for systems hosting virtualized systems are restricted to personnel based upon the principle of least privilege and supported through technical controls. 7
hipaa 1123.01q1System.2-01.q hipaa-1123.01q1System.2-01.q 1123.01q1System.2-01.q 11 Access Control 1123.01q1System.2-01.q 01.05 Operating System Access Control Shared n/a Users who perform privileged functions (e.g., system administration) use separate accounts when performing those privileged functions. 6
hipaa 1129.01v1System.12-01.v hipaa-1129.01v1System.12-01.v 1129.01v1System.12-01.v 11 Access Control 1129.01v1System.12-01.v 01.06 Application and Information Access Control Shared n/a Access rights to applications and application functions should be restricted in accordance with the access control policy. 12
hipaa 1143.01c1System.123-01.c hipaa-1143.01c1System.123-01.c 1143.01c1System.123-01.c 11 Access Control 1143.01c1System.123-01.c 01.02 Authorized Access to Information Systems Shared n/a Privileges are formally authorized and controlled, allocated to users on a need-to-use and event-by-event basis for their functional role (e.g., user or administrator), and documented for each system product/element. 10
hipaa 1144.01c1System.4-01.c hipaa-1144.01c1System.4-01.c 1144.01c1System.4-01.c 11 Access Control 1144.01c1System.4-01.c 01.02 Authorized Access to Information Systems Shared n/a The organization explicitly authorizes access to specific security relevant functions (deployed in hardware, software, and firmware) and security-relevant information. 6
hipaa 1146.01c2System.23-01.c hipaa-1146.01c2System.23-01.c 1146.01c2System.23-01.c 11 Access Control 1146.01c2System.23-01.c 01.02 Authorized Access to Information Systems Shared n/a The organization promotes the development and use of programs that avoid the need to run with elevated privileges and system routines to avoid the need to grant privileges to users. 8
hipaa 1147.01c2System.456-01.c hipaa-1147.01c2System.456-01.c 1147.01c2System.456-01.c 11 Access Control 1147.01c2System.456-01.c 01.02 Authorized Access to Information Systems Shared n/a Elevated privileges are assigned to a different user ID from those used for normal business use, all users access privileged services in a single role, and such privileged access is minimized. 6
hipaa 1148.01c2System.78-01.c hipaa-1148.01c2System.78-01.c 1148.01c2System.78-01.c 11 Access Control 1148.01c2System.78-01.c 01.02 Authorized Access to Information Systems Shared n/a The organization restricts access to privileged functions and all security-relevant information. 8
hipaa 1230.09c2Organizational.1-09.c hipaa-1230.09c2Organizational.1-09.c 1230.09c2Organizational.1-09.c 12 Audit Logging & Monitoring 1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures Shared n/a No single person is able to access, modify, or use information systems without authorization or detection. 13
hipaa 1232.09c3Organizational.12-09.c hipaa-1232.09c3Organizational.12-09.c 1232.09c3Organizational.12-09.c 12 Audit Logging & Monitoring 1232.09c3Organizational.12-09.c 09.01 Documented Operating Procedures Shared n/a Access for individuals responsible for administering access controls is limited to the minimum necessary based upon each user's role and responsibilities and these individuals cannot access audit functions related to these controls. 21
hipaa 1276.09c2Organizational.2-09.c hipaa-1276.09c2Organizational.2-09.c 1276.09c2Organizational.2-09.c 12 Audit Logging & Monitoring 1276.09c2Organizational.2-09.c 09.01 Documented Operating Procedures Shared n/a Security audit activities are independent. 18
hipaa 1451.05iCSPOrganizational.2-05.i hipaa-1451.05iCSPOrganizational.2-05.i 1451.05iCSPOrganizational.2-05.i 14 Third Party Assurance 1451.05iCSPOrganizational.2-05.i 05.02 External Parties Shared n/a Cloud service providers design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain. 21
hipaa 1504.06e1Organizational.34-06.e hipaa-1504.06e1Organizational.34-06.e 1504.06e1Organizational.34-06.e 15 Incident Management 1504.06e1Organizational.34-06.e 06.01 Compliance with Legal Requirements Shared n/a Management approves the use of information assets and takes appropriate action when unauthorized activity occurs. 16
hipaa 19141.06c1Organizational.7-06.c hipaa-19141.06c1Organizational.7-06.c 19141.06c1Organizational.7-06.c 19 Data Protection & Privacy 19141.06c1Organizational.7-06.c 06.01 Compliance with Legal Requirements Shared n/a Important records, such as contracts, personnel records, financial information, client/customer information, etc., of the organization are protected from loss, destruction and falsification through the implementation of security controls such as access controls, encryption, backups, electronic signatures, locked facilities or containers, etc. 10
ISO27001-2013 A.13.1.1 ISO27001-2013_A.13.1.1 ISO 27001:2013 A.13.1.1 Communications Security Network controls Shared n/a Networks shall be managed and controlled to protect information in systems and applications. link 40
ISO27001-2013 A.14.1.2 ISO27001-2013_A.14.1.2 ISO 27001:2013 A.14.1.2 System Acquisition, Development And Maintenance Securing application services on public networks Shared n/a Information involved in application services passing over public networks shall be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification. link 32
ISO27001-2013 A.14.1.3 ISO27001-2013_A.14.1.3 ISO 27001:2013 A.14.1.3 System Acquisition, Development And Maintenance Protecting application services transactions Shared n/a Information involved in application service transactions shall be protected to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay. link 29
ISO27001-2013 A.18.1.3 ISO27001-2013_A.18.1.3 ISO 27001:2013 A.18.1.3 Compliance Protection of records Shared n/a Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with legislative, regulatory, contractual and business requirements. link 15
ISO27001-2013 A.6.2.2 ISO27001-2013_A.6.2.2 ISO 27001:2013 A.6.2.2 Organization of Information Security Teleworking Shared n/a A policy and supporting security measures shall be implemented to protect information accessed, processed or stored at teleworking sites. link 16
ISO27001-2013 A.9.1.2 ISO27001-2013_A.9.1.2 ISO 27001:2013 A.9.1.2 Access Control Access to networks and network services Shared n/a Users shall only be provided with access to the network and network services that they have been specifically authorized to use. link 29
ISO27001-2013 A.9.2.2 ISO27001-2013_A.9.2.2 ISO 27001:2013 A.9.2.2 Access Control User access provisioning Shared n/a A formal user access provisioning process shall be implemented to assign or revoke access rights for all user types to all systems and services. link 19
ISO27001-2013 A.9.2.3 ISO27001-2013_A.9.2.3 ISO 27001:2013 A.9.2.3 Access Control Management of privileged access rights Shared n/a The allocation and use of privileged access rights shall be restricted and controlled. link 33
ISO27001-2013 A.9.4.1 ISO27001-2013_A.9.4.1 ISO 27001:2013 A.9.4.1 Access Control Information access restriction Shared n/a Access to information and application system functions shall be restricted in accordance with the access control policy. link 11
ISO27001-2013 A.9.4.4 ISO27001-2013_A.9.4.4 ISO 27001:2013 A.9.4.4 Access Control Use of privileged utility programs Shared n/a The use of utility programs that might be capable of overriding system and application controls shall be restricted and tightly controlled. link 9
ISO27001-2013 A.9.4.5 ISO27001-2013_A.9.4.5 ISO 27001:2013 A.9.4.5 Access Control Access control to program source code Shared n/a Access to program source code shall be restricted. link 10
NIST_SP_800-171_R2_3 .1.2 NIST_SP_800-171_R2_3.1.2 NIST SP 800-171 R2 3.1.2 Access Control Limit system access to the types of transactions and functions that authorized users are permitted to execute. Shared Microsoft and the customer share responsibilities for implementing this requirement. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary. Other attributes required for authorizing access include restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). link 31
NIST_SP_800-171_R2_3 .1.5 NIST_SP_800-171_R2_3.1.5 NIST SP 800-171 R2 3.1.5 Access Control Employ the principle of least privilege, including for specific security functions and privileged accounts. Shared Microsoft and the customer share responsibilities for implementing this requirement. Organizations employ the principle of least privilege for specific duties and authorized accesses for users and processes. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. Organizations consider the creation of additional processes, roles, and system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational systems. Security functions include establishing system accounts, setting events to be logged, setting intrusion detection parameters, and configuring access authorizations (i.e., permissions, privileges). Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information or functions. Organizations may differentiate in the application of this requirement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk. link 8
NIST_SP_800-53_R4 AC-3 NIST_SP_800-53_R4_AC-3 NIST SP 800-53 Rev. 4 AC-3 Access Control Access Enforcement Shared n/a The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. Supplemental Guidance: Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security. Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PE-3. References: None. link 21
NIST_SP_800-53_R4 AC-6(1) NIST_SP_800-53_R4_AC-6(1) NIST SP 800-53 Rev. 4 AC-6 (1) Access Control Authorize Access To Security Functions Shared n/a The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information]. Supplemental Guidance: Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users. Related controls: AC-17, AC-18, AC-19. link 3
NIST_SP_800-53_R5 AC-3 NIST_SP_800-53_R5_AC-3 NIST SP 800-53 Rev. 5 AC-3 Access Control Access Enforcement Shared n/a Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. link 21
NIST_SP_800-53_R5 AC-6(1) NIST_SP_800-53_R5_AC-6(1) NIST SP 800-53 Rev. 5 AC-6 (1) Access Control Authorize Access to Security Functions Shared n/a Authorize access for [Assignment: organization-defined individuals or roles] to: (a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]; and (b) [Assignment: organization-defined security-relevant information]. link 3
PCI_DSS_v4.0 10.6.3 PCI_DSS_v4.0_10.6.3 PCI DSS v4.0 10.6.3 Requirement 10: Log and Monitor All Access to System Components and Cardholder Data Time-synchronization mechanisms support consistent time settings across all systems Shared n/a Time synchronization settings and data are protected as follows: • Access to time data is restricted to only personnel with a business need. • Any changes to time settings on critical systems are logged, monitored, and reviewed. link 10
PCI_DSS_v4.0 7.2.1 PCI_DSS_v4.0_7.2.1 PCI DSS v4.0 7.2.1 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is appropriately defined and assigned Shared n/a An access control model is defined and includes granting access as follows: • Appropriate access depending on the entity’s business and access needs. • Access to system components and data resources that is based on users’ job classification and functions. • The least privileges required (for example, user, administrator) to perform a job function. link 10
PCI_DSS_v4.0 7.2.2 PCI_DSS_v4.0_7.2.2 PCI DSS v4.0 7.2.2 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is appropriately defined and assigned Shared n/a Access is assigned to users, including privileged users, based on: • Job classification and function. • Least privileges necessary to perform job responsibilities. link 7
PCI_DSS_v4.0 7.2.3 PCI_DSS_v4.0_7.2.3 PCI DSS v4.0 7.2.3 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is appropriately defined and assigned Shared n/a Required privileges are approved by authorized personnel. link 8
PCI_DSS_v4.0 7.2.6 PCI_DSS_v4.0_7.2.6 PCI DSS v4.0 7.2.6 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is appropriately defined and assigned Shared n/a All user access to query repositories of stored cardholder data is restricted as follows: • Via applications or other programmatic methods, with access and allowed actions based on user roles and least privileges. • Only the responsible administrator(s) can directly access or query repositories of stored CHD. link 8
PCI_DSS_v4.0 7.3.1 PCI_DSS_v4.0_7.3.1 PCI DSS v4.0 7.3.1 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is managed via an access control system(s) Shared n/a An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components. link 17
PCI_DSS_v4.0 7.3.2 PCI_DSS_v4.0_7.3.2 PCI DSS v4.0 7.3.2 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is managed via an access control system(s) Shared n/a The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function. link 10
PCI_DSS_v4.0 7.3.3 PCI_DSS_v4.0_7.3.3 PCI DSS v4.0 7.3.3 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is managed via an access control system(s) Shared n/a The access control system(s) is set to “deny all” by default. link 6
SOC_2 CC6.1 SOC_2_CC6.1 SOC 2 Type 2 CC6.1 Logical and Physical Access Controls Logical access security software, infrastructure, and architectures Shared The customer is responsible for implementing this recommendation. The following points of focus, specifically related to all engagements using the trust services criteria, highlight important characteristics relating to this criterion: • Identifies and Manages the Inventory of Information Assets — The entity identifies, Page 29 TSP Ref. # TRUST SERVICES CRITERIA AND POINTS OF FOCUS inventories, classifies, and manages information assets. • Restricts Logical Access — Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets. • Identifies and Authenticates Users — Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely. • Considers Network Segmentation — Network segmentation permits unrelated portions of the entity's information system to be isolated from each other. • Manages Points of Access — Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. • Restricts Access to Information Assets — Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. • Manages Identification and Authentication — Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. • Manages Credentials for Infrastructure and Software — New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. • Uses Encryption to Protect Data — The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. • Protects Encryption Keys — Processes are in place to protect encryption keys during generation, storage, use, and destruction 80
SWIFT_CSCF_v2022 2.11A SWIFT_CSCF_v2022_2.11A SWIFT CSCF v2022 2.11A 2. Reduce Attack Surface and Vulnerabilities Restrict transaction activity to validated and approved business counterparties. Shared n/a Implement RMA controls to restrict transaction activity with effective business counterparties. link 10
History
Date/Time (UTC ymd) (i) Change type Change detail
2022-09-27 16:35:32 change Minor (1.0.0 > 1.1.0)
2022-09-02 16:33:37 add aeed863a-0f56-429f-945d-8bb66bd06841
Initiatives
usage
Initiative DisplayName Initiative Id Initiative Category State Type
CIS Microsoft Azure Foundations Benchmark v1.1.0 1a5bb27d-173f-493e-9568-eb56638dde4d Regulatory Compliance GA BuiltIn
CIS Microsoft Azure Foundations Benchmark v1.3.0 612b5213-9160-4969-8578-1518bd2a000c Regulatory Compliance GA BuiltIn
CIS Microsoft Azure Foundations Benchmark v1.4.0 c3f5c4d9-9a1d-4a99-85c0-7f93e384d5c5 Regulatory Compliance GA BuiltIn
FedRAMP High d5264498-16f4-418a-b659-fa7ef418175f Regulatory Compliance GA BuiltIn
FedRAMP Moderate e95f5a9f-57ad-4d03-bb0b-b1d16db93693 Regulatory Compliance GA BuiltIn
HITRUST/HIPAA a169a624-5599-4385-a696-c8d643089fab Regulatory Compliance GA BuiltIn
ISO 27001:2013 89c6cddc-1c73-4ac1-b19c-54d1a15a42f2 Regulatory Compliance GA BuiltIn
NIST SP 800-171 Rev. 2 03055927-78bd-4236-86c0-f36125a10dc9 Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 4 cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f Regulatory Compliance GA BuiltIn
NIST SP 800-53 Rev. 5 179d1daa-458f-4e47-8086-2a68d0d6c38f Regulatory Compliance GA BuiltIn
PCI DSS v4 c676748e-3af9-4e22-bc28-50feed564afb Regulatory Compliance GA BuiltIn
SOC 2 Type 2 4054785f-702b-4a98-9215-009cbd58b141 Regulatory Compliance GA BuiltIn
SWIFT CSP-CSCF v2022 7bc7cd6c-4114-ff31-3cac-59be3157596d Regulatory Compliance GA BuiltIn
JSON
changes

JSON