AzInitiativeAdvertizer

last sync: 2025-Apr-29 17:15:47 UTC

NCSC Cyber Assurance Framework (CAF) v3.2

Azure BuiltIn Policy Initiative (PolicySet)

Source

Display name

NCSC Cyber Assurance Framework (CAF) v3.2

Id

6d220abf-cf6f-4b17-8f7e-0644c4cc84b4

Version

1.1.0
Details on versioning

Versioning

Versions supported for Versioning: 2
1.1.0
1.0.0
Built-in Versioning [Preview]

Category

Regulatory Compliance
Microsoft Learn

Description

UK framework providing cybersecurity guidance for critical national infrastructure to protect systems and data.

Cloud environments

AzureCloud = true
AzureChinaCloud = unknown
AzureUSGovernment = unknown

Available in AzUSGov

Unknown, no evidence if PolicySet definition is/not available in AzureUSGovernment

Type

BuiltIn

Deprecated

False

Preview

False

Policy-used summary

Policy types	Policy states	Policy categories
Total Policies: 82 Builtin Policies: 82 Static Policies: 0	GA: 77 Preview: 5	19 categories: API Management: 1 App Configuration: 1 App Service: 4 Azure Data Explorer: 1 Cognitive Services: 1 Compute: 4 Cosmos DB: 1 Event Hub: 1 Guest Configuration: 17 Internet of Things: 1 Key Vault: 4 Kubernetes: 6 Machine Learning: 1 Monitoring: 12 Network: 4 Security Center: 15 SQL: 5 Storage: 2 Synapse: 1

Policy-used

Policy DisplayName	Policy Id	Category	Version	Versioning	Effect	Roles#	Roles	State	policy in AzUSGov
[Preview]: Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed	8dfab9c4-fe7b-49ad-85e4-1e9be085358f	Kubernetes	6.0.0-preview	1x 6.0.0-preview	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		Preview	true
[Preview]: Guest Attestation extension should be installed on supported Linux virtual machines	672fe5a1-2fcd-42d7-b85d-902b6e28c6ff	Security Center	6.0.0-preview	1x 6.0.0-preview	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		Preview	true
[Preview]: IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK)	47031206-ce96-41f8-861b-6a915f3de284	Internet of Things	1.0.0-preview	1x 1.0.0-preview	Default Audit Allowed Audit, Deny, Disabled	0		Preview	true
[Preview]: Linux virtual machines should use only signed and trusted boot components	13a6c84f-49a5-410a-b5df-5b880c3fe009	Security Center	1.0.0-preview	1x 1.0.0-preview	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		Preview	unknown
[Preview]: Log Analytics Extension should be enabled for listed virtual machine images	32133ab0-ee4b-4b44-98d6-042180979d50	Monitoring	2.0.1-preview	1x 2.0.1-preview	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		Preview	true
A Microsoft Entra administrator should be provisioned for MySQL servers	146412e9-005c-472b-9e48-c87b72ac229e	SQL	1.1.1	2x 1.1.1, 1.1.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown
A Microsoft Entra administrator should be provisioned for PostgreSQL servers	b4dec045-250a-48c2-b5cc-e0c4eec8b5b4	SQL	1.0.1	2x 1.0.1, 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
An activity log alert should exist for specific Administrative operations	b954148f-4c11-4c38-8221-be76711e194a	Monitoring	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
An activity log alert should exist for specific Policy operations	c5447c04-a4d7-4ba8-a263-c9ee321a6858	Monitoring	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
An activity log alert should exist for specific Security operations	3b980d31-7904-4bb7-8575-5665739a8052	Monitoring	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
API endpoints in Azure API Management should be authenticated	8ac833bd-f505-48d5-887e-c993a1d3eea0	Security Center	1.0.1	1x 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown
API Management should disable public network access to the service configuration endpoints	df73bd95-24da-4a4f-96b9-4e8b94b402bd	API Management	1.0.1	1x 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown
App Configuration should disable public network access	3d9f5e4c-9947-4579-9539-2a7695fbc187	App Configuration	1.0.0	1x 1.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	unknown
App Service apps should have authentication enabled	95bccee9-a7f8-4bec-9ee9-62c3473701fc	App Service	2.0.1	1x 2.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
App Service apps should have Client Certificates (Incoming client certificates) enabled	19dd1db6-f442-49cf-a838-b0786b4401ef	App Service	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Application Insights components should block log ingestion and querying from public networks	1bc02227-0cb6-4e11-8f53-eb0b22eab7e8	Monitoring	1.1.0	1x 1.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	unknown
Audit Linux machines that allow remote connections from accounts without passwords	ea53dbee-c6c9-4f0e-9f9e-de0039b78023	Guest Configuration	3.1.0	2x 3.1.0, 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Audit Linux machines that do not have the passwd file permissions set to 0644	e6955644-301c-44b5-a4c4-528577de6861	Guest Configuration	3.1.0	2x 3.1.0, 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Audit virtual machines without disaster recovery configured	0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56	Compute	1.0.0	1x 1.0.0	Fixed auditIfNotExists	0		GA	true
Audit VMs that do not use managed disks	06a78e20-9358-41c9-923c-fb736d382a4d	Compute	1.0.0	1x 1.0.0	Fixed audit	0		GA	true
Audit Windows machines missing any of specified members in the Administrators group	30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7	Guest Configuration	2.0.0	1x 2.0.0	Fixed auditIfNotExists	0		GA	true
Audit Windows machines that do not have the maximum password age set to specified number of days	4ceb8dc2-559c-478b-a15b-733fbf1e3738	Guest Configuration	2.1.0	1x 2.1.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Audit Windows machines that do not have the password complexity setting enabled	bf16e0bb-31e1-4646-8202-60a235cc7e74	Guest Configuration	2.0.0	1x 2.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Audit Windows machines that have extra accounts in the Administrators group	3d2a3320-2a72-4c67-ac5f-caa40fbee2b2	Guest Configuration	2.0.0	1x 2.0.0	Fixed auditIfNotExists	0		GA	true
Audit Windows machines that have the specified members in the Administrators group	69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f	Guest Configuration	2.0.0	1x 2.0.0	Fixed auditIfNotExists	0		GA	true
Azure Arc enabled Kubernetes clusters should have the Azure Policy extension installed	6b2122c1-8120-4ff5-801b-17625a355590	Kubernetes	1.1.0	1x 1.1.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Azure Defender for open-source relational databases should be enabled	0a9fbe0d-c5c4-4da8-87d8-f4fd77338835	Security Center	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown
Azure Defender for SQL should be enabled for unprotected Azure SQL servers	abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9	SQL	2.0.1	1x 2.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Azure Defender for SQL should be enabled for unprotected MySQL flexible servers	3bc8a0d5-38e0-4a3d-a657-2cb64468fc34	Security Center	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Azure Defender for SQL should be enabled for unprotected PostgreSQL flexible servers	d38668f5-d155-42c7-ab3d-9b57b50f8fbf	Security Center	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Azure Event Hub namespaces should have local authentication methods disabled	5d4e3c65-4873-47be-94f3-6f8b953a3598	Event Hub	1.0.1	1x 1.0.1	Default Audit Allowed Audit, Deny, Disabled	0		GA	unknown
Azure Key Vault should use RBAC permission model	12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5	Key Vault	1.0.1	2x 1.0.1, 1.0.0-preview	Default Audit Allowed Audit, Deny, Disabled	0		GA	unknown
Azure Machine Learning Computes should have local authentication methods disabled	e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f	Machine Learning	2.1.0	2x 2.1.0, 2.0.1	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Azure Monitor Logs for Application Insights should be linked to a Log Analytics workspace	d550e854-df1a-4de9-bf44-cd894b39a95e	Monitoring	1.1.0	1x 1.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	unknown
Azure Monitor solution 'Security and Audit' must be deployed	3e596b57-105f-48a6-be97-03e9243bad6e	Monitoring	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown
Azure SQL Database should have Microsoft Entra-only authentication enabled during creation	abda6d70-9778-44e7-84a8-06713e6db027	SQL	1.2.0	2x 1.2.0, 1.1.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Azure SQL Managed Instances should have Microsoft Entra-only authentication enabled during creation	78215662-041e-49ed-a9dd-5385911b3a1f	SQL	1.2.0	2x 1.2.0, 1.1.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Azure Web Application Firewall should be enabled for Azure Front Door entry-points	055aa869-bc98-4af8-bafc-23f1ab6ffe2c	Network	1.0.2	1x 1.0.2	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Certificates should have the specified maximum validity period	0a075868-4c26-42ef-914c-5bc007359560	Key Vault	2.2.1	2x 2.2.1, 2.2.0-preview	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	true
Cognitive Services accounts should use customer owned storage	46aa9b05-0e60-4eae-a88b-1e9d374fa515	Cognitive Services	2.0.0	1x 2.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	unknown
Cosmos DB database accounts should have local authentication methods disabled	5450f5bd-9c72-4390-a9c4-a7aba4edfdd2	Cosmos DB	1.1.0	1x 1.1.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Disk encryption should be enabled on Azure Data Explorer	f4b53539-8df9-40e4-86c6-6b607703bd4e	Azure Data Explorer	2.0.0	1x 2.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Email notification for high severity alerts should be enabled	6e2593d9-add6-4083-9c9b-4b7d2188c899	Security Center	1.2.0	3x 1.2.0, 1.1.0, 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Flow logs should be configured for every network security group	c251913d-7d24-4958-af87-478ed3b9ba41	Network	1.1.0	1x 1.1.0	Default Audit Allowed Audit, Disabled	0		GA	true
Function apps should have Client Certificates (Incoming client certificates) enabled	ab6a902f-9493-453b-928d-62c30b11b5a6	App Service	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Function apps should use managed identity	0da106f2-4ca3-48e8-bc85-c638fe6aea8f	App Service	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Guest Configuration extension should be installed on your machines	ae89ebca-1c92-4898-ac2c-9f63decb045c	Security Center	1.0.3	1x 1.0.3	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Key Vault keys should have an expiration date	152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0	Key Vault	1.0.2	1x 1.0.2	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Key Vault secrets should have an expiration date	98728c90-32c7-4049-8429-847dc0f4fe37	Key Vault	1.0.2	1x 1.0.2	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Kubernetes cluster containers should not share host process ID or host IPC namespace	47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8	Kubernetes	5.2.0	2x 5.2.0, 5.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	true
Kubernetes cluster containers should only use allowed capabilities	c26596ff-4d70-4e6a-9a30-c2506bd2f80c	Kubernetes	6.2.0	2x 6.2.0, 6.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	true
Kubernetes cluster should not allow privileged containers	95edb821-ddaf-4404-9732-666045e056b4	Kubernetes	9.2.0	2x 9.2.0, 9.1.0	Default Deny Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	true
Kubernetes clusters should not use the default namespace	9f061a12-e40d-4183-a00e-171812443373	Kubernetes	4.2.0	2x 4.2.0, 4.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	true
Log Analytics extension should be enabled in virtual machine scale sets for listed virtual machine images	5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138	Monitoring	2.0.1	1x 2.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Log Analytics workspaces should block log ingestion and querying from public networks	6c53d030-cc64-46f0-906d-2bc061cd1334	Monitoring	1.1.0	1x 1.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	0		GA	unknown
Managed disks should be double encrypted with both platform-managed and customer-managed keys	ca91455f-eace-4f96-be59-e6e2c35b4816	Compute	1.0.0	1x 1.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption	d461a302-a187-421a-89ac-84acdb4edc04	Compute	2.0.0	1x 2.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	unknown
Management ports should be closed on your virtual machines	22730e10-96f6-4aac-ad84-9383d35b5917	Security Center	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Microsoft Defender for APIs should be enabled	7926a6d1-b268-4586-8197-e8ae90c877d7	Security Center	1.0.3	1x 1.0.3	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown
Microsoft Defender for Containers should be enabled	1c988dd6-ade4-430f-a608-2a3e5b0a6d38	Security Center	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Microsoft Defender for SQL should be enabled for unprotected Synapse workspaces	d31e5c31-63b2-4f12-887b-e49456834fa1	Security Center	1.0.0	1x 1.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Security Center standard pricing tier should be selected	a1181c5f-672a-477a-979a-7d58aa086233	Security Center	1.1.0	1x 1.1.0	Default Audit Allowed Audit, Disabled	0		GA	true
Storage account encryption scopes should use double encryption for data at rest	bfecdea6-31c4-4045-ad42-71b9dc87247d	Storage	1.0.0	1x 1.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	unknown
Storage accounts should prevent shared key access	8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54	Storage	2.0.0	1x 2.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Subscriptions should have a contact email address for security issues	4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7	Security Center	1.0.1	1x 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Synapse Workspaces should use only Microsoft Entra identities for authentication during workspace creation	2158ddbe-fefa-408e-b43f-d4faef8ff3b8	Synapse	1.2.0	2x 1.2.0, 1.1.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
The Log Analytics extension should be installed on Virtual Machine Scale Sets	efbde977-ba53-4479-b8e9-10b957924fbf	Monitoring	1.0.1	1x 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity	d26f7642-7545-4e18-9b75-8c9bbdee3a9a	Security Center	1.0.1	1x 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Virtual machines should be connected to a specified workspace	f47b5582-33ec-4c5c-87c0-b010a6b2e917	Monitoring	1.1.0	1x 1.1.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Virtual machines should be connected to an approved virtual network	d416745a-506c-48b6-8ab1-83cb814bcaa3	Network	1.0.0	1x 1.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Virtual machines should have the Log Analytics extension installed	a70ca396-0a34-413a-88e1-b956c1e683be	Monitoring	1.0.1	1x 1.0.1	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users	21a6bc25-125e-4d13-b82d-2e19b7208ab7	Network	1.0.0	1x 1.0.0	Default Audit Allowed Audit, Deny, Disabled	0		GA	true
Windows machines should meet requirements for 'Security Options - Accounts'	ee984370-154a-4ee8-9726-19d900e56fc0	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'Security Options - Audit'	33936777-f2ac-45aa-82ec-07958ec9ade4	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'Security Options - Recovery console'	f71be03e-e25b-4d0f-b8bc-9b3e309b66c0	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'Security Options - User Account Control'	492a29ed-d143-4f03-b6a4-705ce081b463	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'Security Settings - Account Policies'	f2143251-70de-4e81-87a8-36cee5a2f29d	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking'	58383b73-94a9-4414-b382-4146eb02611b	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'User Rights Assignment'	e068b215-0026-4354-b347-8fb2766f73a2	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements for 'Windows Firewall Properties'	35d9882c-993d-44e6-87d2-db66ce21b636	Guest Configuration	3.0.0	1x 3.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows machines should meet requirements of the Azure compute security baseline	72650e9f-97bc-4b2a-ab5f-9781a9fcecbc	Guest Configuration	2.0.0	1x 2.0.0	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	true
Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost.	3dc5edcd-002d-444c-b216-e123bbfa37c0	Guest Configuration	1.1.1	2x 1.1.1, 1.1.0-preview	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	0		GA	unknown

Roles used

No Roles used

History

Date/Time (UTC ymd) (i)	Changes
2025-03-12 18:29:00	Version change: '1.0.0' to '1.1.0' remove Policy [Deprecated]: Vulnerabilities in security configuration on your machines should be remediated (e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15)
2025-01-28 19:35:17	add Initiative 6d220abf-cf6f-4b17-8f7e-0644c4cc84b4

JSON compare

compare mode: version left: version right:

JSON

api-version=2023-04-01
EPAC