last sync: 2025-Mar-23 22:31:17 UTC

Log Analytics Workspaces should block non-Azure Active Directory based ingestion.

Azure BuiltIn Policy definition

Source Azure Portal
Display name Log Analytics Workspaces should block non-Azure Active Directory based ingestion.
Id e15effd4-2278-4c65-a0da-4d6f6d1890e2
Version 1.0.0
Details on versioning
Versioning Versions supported for Versioning: 1
1.0.0
Built-in Versioning [Preview]
Category Monitoring
Microsoft Learn
Description Enforcing log ingestion to require Azure Active Directory authentication prevents unauthenticated logs from an attacker which could lead to incorrect status, false alerts, and incorrect logs stored in the system.
Cloud environments AzureCloud = true
AzureUSGovernment = unknown
AzureChinaCloud = unknown
Available in AzUSGov Unknown, no evidence if Policy definition is/not available in AzureUSGovernment
Mode Indexed
Type BuiltIn
Preview False
Deprecated False
Effect Default
Audit
Allowed
Deny, Audit, Disabled
RBAC role(s) none
Rule aliases IF (1)
Alias Namespace ResourceType Path PathIsDefault DefaultPath Modifiable
Microsoft.OperationalInsights/workspaces/features.disableLocalAuth Microsoft.OperationalInsights workspaces properties.features.disableLocalAuth True False
Rule resource types IF (1)
Microsoft.OperationalInsights/workspaces
Compliance
The following 50 compliance controls are associated with this Policy definition 'Log Analytics Workspaces should block non-Azure Active Directory based ingestion.' (e15effd4-2278-4c65-a0da-4d6f6d1890e2)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
CIS_Controls_v8.1 3.3 CIS_Controls_v8.1_3.3 CIS Controls v8.1 3.3 Data Protection Configure data access control lists Shared 1. Configure data access control lists based on a user’s need to know. 2. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. To ensure that users have access only to the data necessary for their roles. 25
CIS_Controls_v8.1 6.8 CIS_Controls_v8.1_6.8 CIS Controls v8.1 6.8 Access Control Management Define and maintain role-based access control. Shared 1. Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. 2. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently. To implement a system of role-based access control. 30
CMMC_L2_v1.9.0 AC.L1_3.1.1 CMMC_L2_v1.9.0_AC.L1_3.1.1 Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 AC.L1 3.1.1 Access Control Authorized Access Control Shared Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). To ensure security and integrity. 27
CMMC_L2_v1.9.0 AC.L2_3.1.5 CMMC_L2_v1.9.0_AC.L2_3.1.5 Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 AC.L2 3.1.5 Access Control Least Privilege Shared Employ the principle of least privilege, including for specific security functions and privileged accounts. To restrict information system access. 27
CSA_v4.0.12 IAM_05 CSA_v4.0.12_IAM_05 CSA Cloud Controls Matrix v4.0.12 IAM 05 Identity & Access Management Least Privilege Shared n/a Employ the least privilege principle when implementing information system access. 27
CSA_v4.0.12 IAM_10 CSA_v4.0.12_IAM_10 CSA Cloud Controls Matrix v4.0.12 IAM 10 Identity & Access Management Management of Privileged Access Roles Shared n/a Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access. 56
Cyber_Essentials_v3.1 2 Cyber_Essentials_v3.1_2 Cyber Essentials v3.1 2 Cyber Essentials Secure Configuration Shared n/a Aim: ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfill their role. 61
Cyber_Essentials_v3.1 4 Cyber_Essentials_v3.1_4 Cyber Essentials v3.1 4 Cyber Essentials User Access Control Shared n/a Aim: ensure that user accounts (1) are assigned to authorised individuals only, and (2) provide access to only those applications, computers and networks the user needs to carry out their role. 74
EU_GDPR_2016_679_Art. 24 EU_GDPR_2016_679_Art._24 EU General Data Protection Regulation (GDPR) 2016/679 Art. 24 Chapter 4 - Controller and processor Responsibility of the controller Shared n/a n/a 311
EU_GDPR_2016_679_Art. 25 EU_GDPR_2016_679_Art._25 EU General Data Protection Regulation (GDPR) 2016/679 Art. 25 Chapter 4 - Controller and processor Data protection by design and by default Shared n/a n/a 311
EU_GDPR_2016_679_Art. 28 EU_GDPR_2016_679_Art._28 EU General Data Protection Regulation (GDPR) 2016/679 Art. 28 Chapter 4 - Controller and processor Processor Shared n/a n/a 311
EU_GDPR_2016_679_Art. 32 EU_GDPR_2016_679_Art._32 EU General Data Protection Regulation (GDPR) 2016/679 Art. 32 Chapter 4 - Controller and processor Security of processing Shared n/a n/a 311
FBI_Criminal_Justice_Information_Services_v5.9.5_5 .5 FBI_Criminal_Justice_Information_Services_v5.9.5_5.5 FBI Criminal Justice Information Services (CJIS) v5.9.5 5.5 Policy and Implementation - Access Control Access Control Shared Refer to Section 5.13.6 for additional access control requirements related to mobile devices used to access CJI. Access control provides the planning and implementation of mechanisms to restrict reading, writing, processing, and transmission of CJIS information and the modification of information systems, applications, services and communication configurations allowing access to CJIS information. 97
FFIEC_CAT_2017 3.1.2 FFIEC_CAT_2017_3.1.2 FFIEC CAT 2017 3.1.2 Cybersecurity Controls Access and Data Management Shared n/a Employee access is granted to systems and confidential data based on job responsibilities and the principles of least privilege.'FFIEC_Cybersecurity Control'!F8 - Employee access to systems and confidential data provides for separation of duties. - Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g., assigned to individuals, not shared, and require stronger 'FFIEC_Cybersecurity Control'!F7password controls). - User access reviews are performed periodically for all systems and applications based on the risk to the application or system. - Changes to physical and logical user access, including those that result from voluntary and involuntary terminations, are submitted to and approved by appropriate personnel. - Identification and authentication are required and managed for access to systems, applications, and hardware. - Access controls include password complexity and limits to password attempts and reuse. - All default passwords and unnecessary default accounts are changed before system implementation. - Customer access to Internet-based products or services requires authentication controls (e.g., layered controls, multifactor) that are commensurate with the risk. - Production and non-production environments are segregated to prevent unauthorized access or changes to information assets. (*N/A if no production environment exists at the institution or the institution’s third party.) - Physical security controls are used to prevent unauthorized access to information systems and telecommunication systems. - All passwords are encrypted in storage and in transit. - Confidential data are encrypted when transmitted across public or untrusted networks (e.g., Internet). - Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store confidential data. (*N/A if mobile devices are not used.) - Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication. - Administrative, physical, or technical controls are in place to prevent users without administrative responsibilities from installing unauthorized software. - Customer service (e.g., the call center) utilizes formal procedures to authenticate customers commensurate with the risk of the transaction or request. - Data is disposed of or destroyed according to documented requirements and within expected time frames. 59
ISO_IEC_27002_2022 8.2 ISO_IEC_27002_2022_8.2 ISO IEC 27002 2022 8.2 Protection, Preventive, Control Privileged access rights Shared The allocation and use of privileged access rights should be restricted and managed. To ensure only authorized users, software components and services are provided with privileged access rights. 29
ISO_IEC_27017_2015 12.4.3 ISO_IEC_27017_2015_12.4.3 ISO IEC 27017 2015 12.4.3 Operations Security Administrator and Operation Logs Shared For Cloud Service Customer: If a privileged operation is delegated to the cloud service customer, the operation and performance of those operations should be logged. The cloud service customer should determine whether logging capabilities provided by the cloud service provider are appropriate or whether the cloud service customer should implement additional logging capabilities. To log operation and performance of those operations wherein rivileged operation is delegated to the cloud service customer. 28
NIST_CSF_v2.0 PR.AA_05 NIST_CSF_v2.0_PR.AA_05 NIST CSF v2.0 PR.AA 05 PROTECT- Identity Management, Authentication, and Access Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties. Shared n/a To implement safeguards for managing organization’s cybersecurity risks. 29
NIST_SP_800-171_R3_3 .12.5 NIST_SP_800-171_R3_3.12.5 NIST 800-171 R3 3.12.5 Security Assessment Control Information Exchange Shared The types of agreements selected are based on factors such as the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual) and the level of access to the organizational system by users of the other system. Types of agreements can include interconnection security agreements, information exchange security agreements, memoranda of understanding or agreement, service-level agreements, or other types of agreements. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (e.g., service providers, contractors, system developers, and system integrators). Examples of the types of information contained in exchange agreements include the interface characteristics, security requirements, controls, and responsibilities for each system. a. Approve and manage the exchange of CUI between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; nondisclosure agreements]. b. Document, as part of the exchange agreements, interface characteristics, security requirements, and responsibilities for each system. c. Review and update the exchange agreements periodically. 25
NIST_SP_800-53_R5.1.1 AC.6 NIST_SP_800-53_R5.1.1_AC.6 NIST SP 800-53 R5.1.1 AC.6 Access Control Least Privilege Shared Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems. 25
NZISM_v3.7 16.1.33.C.01. NZISM_v3.7_16.1.33.C.01. NZISM v3.7 16.1.33.C.01. Identification, Authentication and Passwords 16.1.33.C.01. - To promote security and accountability within the agency's systems. Shared n/a Agencies MUST NOT use shared credentials to access accounts. 25
NZISM_v3.7 16.1.33.C.02. NZISM_v3.7_16.1.33.C.02. NZISM v3.7 16.1.33.C.02. Identification, Authentication and Passwords 16.1.33.C.02. - To promote security and accountability within the agency's systems. Shared n/a Agencies SHOULD NOT use shared credentials to access accounts. 25
NZISM_v3.7 16.1.34.C.01. NZISM_v3.7_16.1.34.C.01. NZISM v3.7 16.1.34.C.01. Identification, Authentication and Passwords 16.1.34.C.01. - To promote security and accountability within the agency's systems. Shared n/a If agencies choose to allow shared, non user-specific accounts they MUST ensure that an independent means of determining the identification of the system user is implemented. 25
NZISM_v3.7 16.1.35.C.02. NZISM_v3.7_16.1.35.C.02. NZISM v3.7 16.1.35.C.02. Identification, Authentication and Passwords 16.1.35.C.02. - To implement additional authentication factors to enhance security. Shared n/a Agencies SHOULD ensure that they combine the use of multiple methods when identifying and authenticating system users. 25
NZISM_v3.7 16.1.36.C.01. NZISM_v3.7_16.1.36.C.01. NZISM v3.7 16.1.36.C.01. Identification, Authentication and Passwords 16.1.36.C.01. - To enhance overall security posture. Shared n/a Agencies MUST NOT allow storage of unprotected authentication information that grants system access, or decrypts an encrypted device, to be located on, or with the system or device, to which the authentication information grants access. 17
NZISM_v3.7 16.1.37.C.01. NZISM_v3.7_16.1.37.C.01. NZISM v3.7 16.1.37.C.01. Identification, Authentication and Passwords 16.1.37.C.01. - To enhance overall security posture. Shared n/a Agencies MUST ensure that system authentication data is protected when in transit on agency networks or All-of-Government systems. 17
NZISM_v3.7 16.1.39.C.01. NZISM_v3.7_16.1.39.C.01. NZISM v3.7 16.1.39.C.01. Identification, Authentication and Passwords 16.1.39.C.01. - To enhance overall security posture. Shared n/a Where systems contain NZEO or other nationalities releasability marked or protectively marked information, agencies MUST provide a mechanism that allows system users and processes to identify users who are foreign nationals, including seconded foreign nationals. 17
NZISM_v3.7 16.1.39.C.02. NZISM_v3.7_16.1.39.C.02. NZISM v3.7 16.1.39.C.02. Identification, Authentication and Passwords 16.1.39.C.02. - To enhance overall security posture. Shared n/a Agencies using NZEO systems SHOULD ensure that identification includes specific nationality for all foreign nationals, including seconded foreign nationals. 17
NZISM_v3.7 16.1.41.C.02. NZISM_v3.7_16.1.41.C.02. NZISM v3.7 16.1.41.C.02. Identification, Authentication and Passwords 16.1.41.C.02. - To enhance overall security posture. Shared n/a Agencies MUST NOT: 1. allow predictable reset passwords; 2. reuse passwords when resetting multiple accounts; 3. store passwords in the clear on the system; 4. allow passwords to be reused within eight password changes; and 5. allow system users to use sequential passwords. 17
NZISM_v3.7 16.1.43.C.01. NZISM_v3.7_16.1.43.C.01. NZISM v3.7 16.1.43.C.01. Identification, Authentication and Passwords 16.1.43.C.01. - To enhance overall security posture. Shared n/a Agencies SHOULD disable LAN Manager for password authentication on workstations and servers. 17
NZISM_v3.7 16.1.48.C.02. NZISM_v3.7_16.1.48.C.02. NZISM v3.7 16.1.48.C.02. Identification, Authentication and Passwords 16.1.48.C.02. - To enhance overall security posture. Shared n/a Agencies SHOULD seek legal advice on the exact wording of logon banners. 16
NZISM_v3.7 16.1.49.C.01. NZISM_v3.7_16.1.49.C.01. NZISM v3.7 16.1.49.C.01. Identification, Authentication and Passwords 16.1.49.C.01. - To enhance overall security posture. Shared n/a Agencies SHOULD configure systems to display the date and time of the system user's previous login during the login process. 15
NZISM_v3.7 16.1.50.C.01. NZISM_v3.7_16.1.50.C.01. NZISM v3.7 16.1.50.C.01. Identification, Authentication and Passwords 16.1.50.C.01. - To enhance overall security posture. Shared n/a Agencies SHOULD NOT permit the display of last logged on username, credentials or other identifying details. 15
NZISM_v3.7 16.1.50.C.02. NZISM_v3.7_16.1.50.C.02. NZISM v3.7 16.1.50.C.02. Identification, Authentication and Passwords 16.1.50.C.02. - To enhance overall security posture. Shared n/a Agencies SHOULD NOT permit the caching of credentials unless specifically required. 15
NZISM_v3.7 16.2.3.C.01. NZISM_v3.7_16.2.3.C.01. NZISM v3.7 16.2.3.C.01. System Access and Passwords 16.2.3.C.01. - To enhance overall security posture. Shared n/a Agencies MUST NOT allow access to NZEO information from systems and facilities not under the sole control of the government of New Zealand and New Zealand citizens. 14
NZISM_v3.7 16.2.3.C.02. NZISM_v3.7_16.2.3.C.02. NZISM v3.7 16.2.3.C.02. System Access and Passwords 16.2.3.C.02. - To enhance overall security posture. Shared n/a Unless a multilateral or bilateral security agreement is in place, agencies SHOULD NOT allow access to classified information from systems and facilities not under the sole control of the government of New Zealand and New Zealand citizens. 11
PCI_DSS_v4.0.1 7.2.1 PCI_DSS_v4.0.1_7.2.1 PCI DSS v4.0.1 7.2.1 Restrict Access to System Components and Cardholder Data by Business Need to Know An access control model is defined and includes granting access as follows: Appropriate access depending on the entity’s business and access needs. Access to system components and data resources that is based on users’ job classification and functions. The least privileges required (for example, user, administrator) to perform a job function Shared n/a Examine documented policies and procedures and interview personnel to verify the access control model is defined in accordance with all elements specified in this requirement. Examine access control model settings and verify that access needs are appropriately defined in accordance with all elements specified in this requirement 43
PCI_DSS_v4.0.1 7.2.2 PCI_DSS_v4.0.1_7.2.2 PCI DSS v4.0.1 7.2.2 Restrict Access to System Components and Cardholder Data by Business Need to Know Access is assigned to users, including privileged users, based on: Job classification and function. Least privileges necessary to perform job responsibilities Shared n/a Examine policies and procedures to verify they cover assigning access to users in accordance with all elements specified in this requirement. Examine user access settings, including for privileged users, and interview responsible management personnel to verify that privileges assigned are in accordance with all elements specified in this requirement. Interview personnel responsible for assigning access to verify that privileged user access is assigned in accordance with all elements specified in this requirement 43
PCI_DSS_v4.0.1 7.2.5 PCI_DSS_v4.0.1_7.2.5 PCI DSS v4.0.1 7.2.5 Restrict Access to System Components and Cardholder Data by Business Need to Know All application and system accounts and related access privileges are assigned and managed as follows: Based on the least privileges necessary for the operability of the system or application. Access is limited to the systems, applications, or processes that specifically require their use Shared n/a Examine policies and procedures to verify they define processes to manage and assign application and system accounts and related access privileges in accordance with all elements specified in this requirement. Examine privileges associated with system and application accounts and interview responsible personnel to verify that application and system accounts and related access privileges are assigned and managed in accordance with all elements specified in this requirement 44
PCI_DSS_v4.0.1 7.2.6 PCI_DSS_v4.0.1_7.2.6 PCI DSS v4.0.1 7.2.6 Restrict Access to System Components and Cardholder Data by Business Need to Know All user access to query repositories of stored cardholder data is restricted as follows: Via applications or other programmatic methods, with access and allowed actions based on user roles and least privileges. Only the responsible administrator(s) can directly access or query repositories of stored CHD Shared n/a Examine policies and procedures and interview personnel to verify processes are defined for granting user access to query repositories of stored cardholder data, in accordance with all elements specified in this requirement. Examine configuration settings for querying repositories of stored cardholder data to verify they are in accordance with all elements specified in this requirement 41
PCI_DSS_v4.0.1 7.3.1 PCI_DSS_v4.0.1_7.3.1 PCI DSS v4.0.1 7.3.1 Restrict Access to System Components and Cardholder Data by Business Need to Know An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components Shared n/a Examine vendor documentation and system settings to verify that access is managed for each system component via an access control system(s) that restricts access based on a user’s need to know and covers all system components 27
RBI_ITF_NBFC_v2017 3.1.g RBI_ITF_NBFC_v2017_3.1.g RBI IT Framework 3.1.g Information and Cyber Security Trails-3.1 n/a The IS Policy must provide for a IS framework with the following basic tenets: Trails- NBFCs shall ensure that audit trails exist for IT assets satisfying its business requirements including regulatory and legal requirements, facilitating audit, serving as forensic evidence when required and assisting in dispute resolution. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail. link 36
Sarbanes_Oxley_Act_(1)_2022_1 Sarbanes_Oxley_Act_(1)_2022_1 Sarbanes_Oxley_Act_(1)_2022_1 Sarbanes Oxley Act 2022 1 PUBLIC LAW Sarbanes Oxley Act 2022 (SOX) Shared n/a n/a 92
SOC_2023 CC5.3 SOC_2023_CC5.3 SOC 2023 CC5.3 Control Activities To maintain alignment with organizational objectives and regulatory requirements. Shared n/a Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures. 229
SOC_2023 CC6.1 SOC_2023_CC6.1 SOC 2023 CC6.1 Logical and Physical Access Controls To mitigate security events and ensuring the confidentiality, integrity, and availability of critical information assets. Shared n/a Entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives by identifying and managing the inventory of information assets, restricting logical access, identification and authentication of users, consider network segmentation, manage points of access, restricting access of information assets, managing identification and authentication, managing credentials for infrastructure and software, using encryption to protect data and protect using encryption keys. 128
SOC_2023 CC6.2 SOC_2023_CC6.2 SOC 2023 CC6.2 Logical and Physical Access Controls To ensure effective access control and ensuring the security of the organization's systems and data. Shared n/a 1. Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. 2. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized. 50
SOC_2023 CC6.3 SOC_2023_CC6.3 404 not found n/a n/a 56
SOC_2023 CC6.7 SOC_2023_CC6.7 404 not found n/a n/a 52
SOC_2023 CC7.2 SOC_2023_CC7.2 SOC 2023 CC7.2 Systems Operations To maintain robust security measures and ensure operational resilience. Shared n/a The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events. 167
SOC_2023 CC8.1 SOC_2023_CC8.1 SOC 2023 CC8.1 Change Management To minimise risks, ensure quality, optimise efficiency, and enhance resilience in the face of change. Shared n/a The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives by Managing Changes Throughout the System Life Cycle, authorizing changes, designing and developing changes, documenting all changes, tracking system changes, configuring software's, testing system changes, approving system changes, deploying system changes, identifying and evaluating system changes, creating baseline configurations for IT technologies and providing necessary changes in emergency situations. 147
SWIFT_CSCF_2024 1.2 SWIFT_CSCF_2024_1.2 SWIFT Customer Security Controls Framework 2024 1.2 Privileged Account Control Operating System Privileged Account Control Shared Tightly protecting administrator-level accounts within the operating system reduces the opportunity for an attacker to use the privileges of the account as part of an attack (for example, executing commands or deleting evidence). To restrict and control the allocation and usage of administrator-level operating system accounts. 53
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
[Preview]: Reserve Bank of India - IT Framework for NBFC 7f89f09c-48c1-f28d-1bd5-84f3fb22f86c Regulatory Compliance Preview BuiltIn unknown
CIS Controls v8.1 046796ef-e8a7-4398-bbe9-cce970b1a3ae Regulatory Compliance GA BuiltIn unknown
CSA CSA Cloud Controls Matrix v4.0.12 8791506a-dec4-497a-a83f-3abfde37c400 Regulatory Compliance GA BuiltIn unknown
Cyber Essentials v3.1 b2f588d7-1ed5-47c7-977d-b93dff520c4c Regulatory Compliance GA BuiltIn unknown
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 a4087154-2edb-4329-b56a-1cc986807f3c Regulatory Compliance GA BuiltIn unknown
EU General Data Protection Regulation (GDPR) 2016/679 7326812a-86a4-40c8-af7c-8945de9c4913 Regulatory Compliance GA BuiltIn unknown
FBI Criminal Justice Information Services (CJIS) v5.9.5 4fcabc2a-30b2-4ba5-9fbb-b1a4e08fb721 Regulatory Compliance GA BuiltIn unknown
FFIEC CAT 2017 1d5dbdd5-6f93-43ce-a939-b19df3753cf7 Regulatory Compliance GA BuiltIn unknown
ISO/IEC 27002 2022 e3030e83-88d5-4f23-8734-6577a2c97a32 Regulatory Compliance GA BuiltIn unknown
ISO/IEC 27017 2015 f48ecfa6-581c-43f9-8141-cd4adc72cf26 Regulatory Compliance GA BuiltIn unknown
NIST 800-171 R3 38916c43-6876-4971-a4b1-806aa7e55ccc Regulatory Compliance GA BuiltIn unknown
NIST CSF v2.0 184a0e05-7b06-4a68-bbbe-13b8353bc613 Regulatory Compliance GA BuiltIn unknown
NIST SP 800-53 R5.1.1 60205a79-6280-4e20-a147-e2011e09dc78 Regulatory Compliance GA BuiltIn unknown
NZISM v3.7 4476df0a-18ab-4bfe-b6ad-cccae1cf320f Regulatory Compliance GA BuiltIn unknown
PCI DSS v4.0.1 a06d5deb-24aa-4991-9d58-fa7563154e31 Regulatory Compliance GA BuiltIn unknown
Sarbanes Oxley Act 2022 5757cf73-35d1-46d4-8c78-17b7ddd6076a Regulatory Compliance GA BuiltIn unknown
SOC 2023 53ad89f5-8542-49e9-ba81-1cbd686e0d52 Regulatory Compliance GA BuiltIn unknown
SWIFT Customer Security Controls Framework 2024 7499005e-df5a-45d9-810f-041cf346678c Regulatory Compliance GA BuiltIn unknown
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-06-22 14:29:30 add e15effd4-2278-4c65-a0da-4d6f6d1890e2
JSON compare n/a
JSON
api-version=2021-06-01
EPAC