Policies

Azure > CIS v1 > 4 Database Services > 4.02 Ensure that 'AuditActionGroups' in 'auditing' policy for a SQL server is set properly (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 4 Database Services > 4.03 Ensure that 'Auditing' Retention is 'greater than 90 days' (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 4 Database Services > 4.04 Ensure that 'Advanced Data Security' on a SQL server is set to 'On' (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 4 Database Services > 4.05 Ensure that 'Threat Detection types' is set to 'All' (Scored)

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.01 Run Automated Vulnerability Scanning Tools

Azure > CIS v1 > 4 Database Services > 4.06 Ensure that 'Send alerts to' is set (Scored)

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.01 Run Automated Vulnerability Scanning Tools

Azure > CIS v1 > 4 Database Services > 4.07 Ensure that 'Email service and co-administrators' is 'Enabled' (Scored)

CIS > Controls v7 > 19 Incident Response and Management

Azure > CIS v1 > 4 Database Services > 4.08 Ensure that Azure Active Directory Admin is configured (Scored)

CIS > Controls v7 > 19 Incident Response and Management

Azure > CIS v1 > 4 Database Services > 4.09 Ensure that 'Data encryption' is set to 'On' on a SQL Database (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

Azure > CIS v1 > 4 Database Services > 4.10 Ensure SQL server's TDE protector is encrypted with BYOK (Use your own key) (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

Azure > CIS v1 > 4 Database Services > 4.11 Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.04 Encrypt or Hash all Authentication Credentials

Azure > CIS v1 > 4 Database Services > 4.12 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.04 Encrypt All Sensitive Information in Transit

Azure > CIS v1 > 4 Database Services > 4.13 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

Azure > CIS v1 > 4 Database Services > 4.14 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.04 Encrypt All Sensitive Information in Transit

Azure > CIS v1 > 4 Database Services > 4.15 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

Azure > CIS v1 > 4 Database Services > 4.16 Ensure server parameter 'log_duration' is set to 'ON' for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

Azure > CIS v1 > 4 Database Services > 4.17 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

Azure > CIS v1 > 4 Database Services > 4.18 Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.1 Ensure that a Log Profile exists (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.04 Ensure Adequate Storage for Logs

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.2 Ensure that Activity Log Retention is set 365 days or greater (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.3 Ensure audit profile captures all the activities (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.4 Ensure the log profile captures activity logs for all regions including global (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.5 Ensure the storage container storing the activity logs is not publicly accessible (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.6 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key) (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile > 5.1.7 Ensure that logging for Azure KeyVault is 'Enabled' (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.2 Ensure that Activity Log Alert exists for Create or Update Network Security Group (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.3 Ensure that Activity Log Alert exists for Delete Network Security Group (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.4 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.5 Ensure that activity log alert exists for the Delete Network Security Group Rule (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.6 Ensure that Activity Log Alert exists for Create or Update Security Solution (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.7 Ensure that Activity Log Alert exists for Delete Security Solution (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.8 Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts > 5.2.9 Ensure that Activity Log Alert exists for Update Security Policy (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 6 Networking > 6.01 Ensure that RDP access is restricted from the internet (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

Azure > CIS v1 > 6 Networking > 6.02 Ensure that SSH access is restricted from the internet (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

Azure > CIS v1 > 6 Networking > 6.03 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP) (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

Azure > CIS v1 > 6 Networking > 6.04 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (Scored)

CIS > Controls v7 > 12 Boundary Defense

Azure > CIS v1 > 6 Networking > 6.05 Ensure that Network Watcher is 'Enabled' (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.04 Ensure Adequate Storage for Logs

Azure > CIS v1 > 7 Virtual Machines > 7.01 Ensure that 'OS disk' are encrypted (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.02 Document Traffic Configuration Rules

Azure > CIS v1 > 7 Virtual Machines > 7.02 Ensure that 'Data disks' are encrypted (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

Azure > CIS v1 > 7 Virtual Machines > 7.03 Ensure that 'Unattached disks' are encrypted (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

Azure > CIS v1 > 7 Virtual Machines > 7.04 Ensure that only approved extensions are installed (Not Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

Azure > CIS v1 > 7 Virtual Machines > 7.04 Ensure that only approved extensions are installed (Not Scored) > Attestation

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.01 Maintain Inventory of Authorized Software

Azure > CIS v1 > 7 Virtual Machines > 7.05 Ensure that the latest OS Patches for all Virtual Machines are applied (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.01 Maintain Inventory of Authorized Software

Azure > CIS v1 > 7 Virtual Machines > 7.05 Ensure that the latest OS Patches for all Virtual Machines are applied (Not Scored) > Attestation

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.04 Deploy Automated Operating System Patch Management Tools

Azure > CIS v1 > 7 Virtual Machines > 7.06 Ensure that the endpoint protection for all Virtual Machines is installed (Not Scored)

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.04 Deploy Automated Operating System Patch Management Tools

Azure > CIS v1 > 7 Virtual Machines > 7.06 Ensure that the endpoint protection for all Virtual Machines is installed (Not Scored) > Attestation

CIS > Controls v7 > 08 Malware Defenses > 8.02 Ensure AntiMalware Software and Signatures are Updated

Azure > CIS v1 > 8 Other Security Considerations > 8.01 Ensure that the expiration date is set on all keys (Scored)

CIS > Controls v7 > 08 Malware Defenses > 8.02 Ensure AntiMalware Software and Signatures are Updated

Azure > CIS v1 > 8 Other Security Considerations > 8.02 Ensure that the expiration date is set on all Secrets (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1 > 8 Other Security Considerations > 8.03 Ensure that Resource Locks are set for mission critical Azure resources (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1 > 8 Other Security Considerations > 8.03 Ensure that Resource Locks are set for mission critical Azure resources (Not Scored) > Attestation

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1 > 8 Other Security Considerations > 8.04 Ensure the key vault is recoverable (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1 > 8 Other Security Considerations > 8.05 Enable role-based access control (RBAC) within Azure Kubernetes Services (Scored)

CIS > Controls v7 > 10 Data Recovery Capabilities

Azure > CIS v1 > 9 Application Services > 9.01 Ensure App Service Authentication is set on Azure App Service (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1 > 9 Application Services > 9.02 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1 > 9 Application Services > 9.03 Ensure web app is using the latest version of TLS encryption (Scored)

CIS > Controls v7 > 07 Email and Web Browser Protections

Azure > CIS v1 > 9 Application Services > 9.04 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' (Scored)

CIS > Controls v7 > 07 Email and Web Browser Protections

Azure > CIS v1 > 9 Application Services > 9.05 Ensure that Register with Azure Active Directory is enabled on App Service (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1 > 9 Application Services > 9.06 Ensure that '.Net Framework' version is the latest, if used as a part of the web app (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

Azure > CIS v1 > 9 Application Services > 9.07 Ensure that 'PHP version' is the latest, if used to run the web app (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

Azure > CIS v1 > 9 Application Services > 9.08 Ensure that 'Python version' is the latest, if used to run the web app (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

Azure > CIS v1 > 9 Application Services > 9.09 Ensure that 'Java version' is the latest, if used to run the web app (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

Azure > CIS v1 > 9 Application Services > 9.10 Ensure that 'HTTP Version' is the latest, if used to run the web app (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

Azure > CIS v1 > 1 Identity and Access Management

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

Azure > CIS v1 > 2 Security Center

CIS

Azure > CIS v1 > 3 Storage

CIS

Azure > CIS v1 > 4 Database Services

CIS

Azure > CIS v1 > 5 Logging and Monitoring

CIS

Azure > CIS v1 > 5 Logging and Monitoring > 5.1 Configuring Log Profile

CIS

Azure > CIS v1 > 5 Logging and Monitoring > 5.2 Monitoring using Activity Log alerts

CIS

Azure > CIS v1 > 6 Networking

CIS

Azure > CIS v1 > 7 Virtual Machines

CIS

Azure > CIS v1 > 8 Other Security Considerations

CIS

Azure > CIS v1 > 9 Application Services

CIS

Azure > CIS v1.2 > Maximum Attestation Duration

CIS

CIS

Azure > CIS v1.2

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.01 - Ensure that multi-factor authentication is enabled for all privileged users (Not Scored)

CIS

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.01 - Ensure that multi-factor authentication is enabled for all privileged users (Not Scored) > Attestation

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.02 - Ensure that multi-factor authentication is enabled for all non- privileged users (Not Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.02 - Ensure that multi-factor authentication is enabled for all non- privileged users (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.03 - Ensure guest users are reviewed on a monthly basis (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.04 - Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.08 Disable Any Unassociated Accounts

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.04 - Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.05 - Ensure that 'Number of methods required to reset' is set to '2' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.05 - Ensure that 'Number of methods required to reset' is set to '2' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.06 - Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0" (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.06 - Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0" (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.07 - Ensure that 'Notify users on password resets?' is set to 'Yes' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.07 - Ensure that 'Notify users on password resets?' is set to 'Yes' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.08 - Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.08 - Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' (Not Scored) > Attestation

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.09 - Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No' (Not Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.09 - Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.10 - Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.10 - Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 02 Inventory and Control of Software Assets

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.11 - Ensure that 'Users can register applications' is set to 'No' (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.11 - Ensure that 'Users can register applications' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 02 Inventory and Control of Software Assets

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.12 - Ensure that 'Guest user permissions are limited' is set to 'Yes' (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.12 - Ensure that 'Guest user permissions are limited' is set to 'Yes' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.13 - Ensure that 'Members can invite' is set to 'No' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.13 - Ensure that 'Members can invite' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.14 - Ensure that 'Guests can invite' is set to 'No' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.14 - Ensure that 'Guests can invite' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.15 - Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.15 - Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes' (Not Scored) > Attestation

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.16 - Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No' (Not Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.16 - Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.17 - Ensure that 'Users can create security groups' is set to 'No' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.17 - Ensure that 'Users can create security groups' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.18 - Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.18 - Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.19 - Ensure that 'Users can create Office 365 groups' is set to 'No' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.19 - Ensure that 'Users can create Office 365 groups' is set to 'No' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.20 - Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes' (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.20 - Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes' (Not Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.21 - Ensure that no custom subscription owner roles are created (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.22 - Ensure Security Defaults is enabled on Azure Active Directory (Not Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.22 - Ensure Security Defaults is enabled on Azure Active Directory (Not Scored) > Attestation

CIS > Controls v7 > 13 Data Protection

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.23 - Ensure Custom Role is assigned for Administering Resource Locks (Not Scored)

CIS > Controls v7 > 13 Data Protection

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.23 - Ensure Custom Role is assigned for Administering Resource Locks (Not Scored) > Attestation

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

Azure > CIS v1.2 > 7 - Virtual Machines > 7.01 - Ensure Virtual Machines are utilizing Managed Disks (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

Azure > CIS v1.2 > 7 - Virtual Machines > 7.02 - Ensure that 'OS and Data' disks are encrypted with CMK (Scored)

CIS > Controls v7 > 13 Data Protection

Azure > CIS v1.2 > 7 - Virtual Machines > 7.03 - Ensure that 'Unattached disks' are encrypted with CMK (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

Azure > CIS v1.2 > 7 - Virtual Machines > 7.04 - Ensure that only approved extensions are installed (Not Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

Azure > CIS v1.2 > 7 - Virtual Machines > 7.04 - Ensure that only approved extensions are installed (Not Scored) > Attestation

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.01 Maintain Inventory of Authorized Software

Azure > CIS v1.2 > 7 - Virtual Machines > 7.05 - Ensure that the latest OS Patches for all Virtual Machines are applied (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.01 Maintain Inventory of Authorized Software

Azure > CIS v1.2 > 7 - Virtual Machines > 7.05 - Ensure that the latest OS Patches for all Virtual Machines are applied (Not Scored) > Attestation

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.04 Deploy Automated Operating System Patch Management Tools

Azure > CIS v1.2 > 7 - Virtual Machines > 7.06 - Ensure that the endpoint protection for all Virtual Machines is installed (Not Scored)

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.04 Deploy Automated Operating System Patch Management Tools

Azure > CIS v1.2 > 7 - Virtual Machines > 7.06 - Ensure that the endpoint protection for all Virtual Machines is installed (Not Scored) > Attestation

CIS > Controls v7 > 08 Malware Defenses > 8.02 Ensure AntiMalware Software and Signatures are Updated

Azure > CIS v1.2 > 8 - Other Security Considerations > 8.01 - Ensure that the expiration date is set on all keys (Scored)

CIS > Controls v7 > 08 Malware Defenses > 8.02 Ensure AntiMalware Software and Signatures are Updated

Azure > CIS v1.2 > 8 - Other Security Considerations > 8.02 - Ensure that the expiration date is set on all secrets (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 8 - Other Security Considerations > 8.03 - Ensure that Resource Locks are set for mission critical Azure resources (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

Azure > CIS v1.2 > 8 - Other Security Considerations > 8.03 - Ensure that Resource Locks are set for mission critical Azure resources (Not Scored) > Attestation

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1.2 > 8 - Other Security Considerations > 8.04 - Ensure the key vault is recoverable (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1.2 > 8 - Other Security Considerations > 8.05 - Enable role-based access control (RBAC) within Azure Kubernetes Services (Scored)

CIS > Controls v7 > 10 Data Recovery Capabilities

Azure > CIS v1.2 > 1 - Identity and Access Management

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know

Azure > CIS v1.2 > 1 - Identity and Access Management > Maximum Attestation Duration

CIS

Azure > CIS v1.2 > 7 - Virtual Machines

CIS

Azure > CIS v1.2 > 7 - Virtual Machines > Maximum Attestation Duration

CIS

Azure > CIS v1.2 > 8 - Other Security Considerations

CIS

Azure > CIS v1.2 > 8 - Other Security Considerations > Maximum Attestation Duration

CIS

Azure > CIS v2.0 > Maximum Attestation Duration

CIS

CIS

Azure > CIS v2.0

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.01 - Ensure Security Defaults is enabled on Azure Active Directory

CIS

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.01 - Ensure Security Defaults is enabled on Azure Active Directory > Attestation

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.02 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.02 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users > Attestation

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.03 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.05 Use Multifactor Authentication For All Administrative Access

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.03 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.04 Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is Disabled

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.04 Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is Disabled > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.01 - Ensure Trusted Locations Are Defined

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.02 - Ensure that an exclusionary Geographic Access Policy is considered

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.02 - Ensure that an exclusionary Geographic Access Policy is considered > Attestation

CIS > Controls v7 > 12 Boundary Defense > 12.01 Maintain an Inventory of Network Boundaries

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.03 - Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups

CIS > Controls v7 > 12 Boundary Defense > 12.01 Maintain an Inventory of Network Boundaries

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.03 - Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.04 - Ensure that A Multi-factor Authentication Policy Exists for All Users

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.04 - Ensure that A Multi-factor Authentication Policy Exists for All Users > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.05 - Ensure Multi-factor Authentication is Required for Risky Sign-ins

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.05 - Ensure Multi-factor Authentication is Required for Risky Sign-ins > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.06 - Ensure Multi-factor Authentication is Required for Azure Management

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.06 - Ensure Multi-factor Authentication is Required for Azure Management > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.03 - Ensure that 'Users can create Azure AD Tenants' is set to 'No'

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.03 - Ensure that 'Users can create Azure AD Tenants' is set to 'No' > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.04 - Ensure Access Review is Set Up for External Users in Azure AD Privileged Identity Management

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.04 - Ensure Access Review is Set Up for External Users in Azure AD Privileged Identity Management > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.08 Disable Any Unassociated Accounts

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.05 - Ensure Guest Users Are Reviewed on a Regular Basis

CIS > Controls v7 > 16 Account Monitoring and Control > 16.08 Disable Any Unassociated Accounts

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.06 - Ensure That 'Number of methods required to reset' is set to '2'

CIS > Controls v7 > 16 Account Monitoring and Control > 16.08 Disable Any Unassociated Accounts

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.06 - Ensure That 'Number of methods required to reset' is set to '2' > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.07 - Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.07 - Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization > Attestation

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.04 Use Unique Passwords

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.08 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.04 Use Unique Passwords

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.08 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.10 Ensure All Accounts Have An Expiration Date