Analyze/catalog/frameworks/cis-controls.json
|
{
"key": "CIS Controls", "order": 7, "name": "CIS Critical Security Controls", "shortName": "CIS Controls v8.1", "version": "v8.1", "publisher": "Center for Internet Security (CIS)", "type": "framework", "url": "https://www.cisecurity.org/controls/v8-1", "retrieved": "2026-09-24", "mapping": "jsolve", "note": "Mapping by JSolve B.V.: which tests evidence a control is JSolve's assessment, not the publisher's. A control with tests is fully assessed only when they check everything about it that Azure configuration can show. Controls that do not concern the Azure environment (people, physical security, organization-wide governance, end-user devices, software development) are not applicable; the other controls without a test need evidence outside configuration. Safeguards are listed by id with the name of their control; the safeguard text is not reproduced.", "controls": { "1.1": {"title":"Control 1: Inventory and Control of Enterprise Assets","applicability":"manual"}, "1.2": {"title":"Control 1: Inventory and Control of Enterprise Assets","applicability":"manual"}, "1.3": {"title":"Control 1: Inventory and Control of Enterprise Assets","applicability":"notApplicable"}, "1.4": {"title":"Control 1: Inventory and Control of Enterprise Assets","applicability":"notApplicable"}, "1.5": {"title":"Control 1: Inventory and Control of Enterprise Assets","applicability":"notApplicable"}, "2.1": {"title":"Control 2: Inventory and Control of Software Assets","coverage":"partial","tests":["AZ-VM-013"]}, "2.2": {"title":"Control 2: Inventory and Control of Software Assets","coverage":"partial","tests":["AZ-APIM-007","AZ-GOV-008","AZ-VM-009"]}, "2.3": {"title":"Control 2: Inventory and Control of Software Assets","applicability":"manual"}, "2.4": {"title":"Control 2: Inventory and Control of Software Assets","coverage":"partial","tests":["AZ-VM-013"]}, "2.5": {"title":"Control 2: Inventory and Control of Software Assets","applicability":"manual"}, "2.6": {"title":"Control 2: Inventory and Control of Software Assets","applicability":"manual"}, "2.7": {"title":"Control 2: Inventory and Control of Software Assets","applicability":"manual"}, "3.1": {"title":"Control 3: Data Protection","applicability":"notApplicable"}, "3.2": {"title":"Control 3: Data Protection","coverage":"partial","tests":["AZ-DEF-024"]}, "3.3": {"title":"Control 3: Data Protection","coverage":"partial","tests":["AZ-ACR-002","AZ-APP-009","AZ-LOGIC-001","AZ-STG-003","AZ-STG-004"]}, "3.4": {"title":"Control 3: Data Protection","applicability":"manual"}, "3.5": {"title":"Control 3: Data Protection","applicability":"manual"}, "3.6": {"title":"Control 3: Data Protection","applicability":"notApplicable"}, "3.7": {"title":"Control 3: Data Protection","applicability":"notApplicable"}, "3.8": {"title":"Control 3: Data Protection","applicability":"manual"}, "3.9": {"title":"Control 3: Data Protection","applicability":"notApplicable"}, "3.10": {"title":"Control 3: Data Protection","coverage":"partial","tests":["AZ-APIM-002","AZ-APIM-005","AZ-APIM-006","AZ-APP-001","AZ-APP-002","AZ-APP-003","AZ-BOT-003","AZ-CAPP-001","AZ-MY-001","AZ-NET-013","AZ-PAAS-003","AZ-PG-001","AZ-RED-001","AZ-SQL-006","AZ-STG-001","AZ-STG-002","AZ-STG-018","AZ-STG-019"]}, "3.11": {"title":"Control 3: Data Protection","coverage":"partial","tests":["AZ-ADX-002","AZ-ADX-003","AZ-AKS-009","AZ-AUTO-001","AZ-SQL-007","AZ-SQL-008","AZ-STG-020","AZ-STG-021","AZ-VM-001","AZ-VM-002"]}, "3.12": {"title":"Control 3: Data Protection","applicability":"manual"}, "3.13": {"title":"Control 3: Data Protection","applicability":"manual"}, "3.14": {"title":"Control 3: Data Protection","coverage":"partial","tests":["AZ-LOG-014","AZ-MY-002","AZ-PG-002","AZ-PG-003","AZ-SQL-001"]}, "4.1": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","coverage":"partial","tests":["AZ-AKS-004","AZ-APP-007","AZ-DEF-001","AZ-DFA-004","AZ-GOV-001","AZ-GOV-002","AZ-GOV-009","AZ-NET-014","AZ-VM-007"]}, "4.2": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"manual"}, "4.3": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"notApplicable"}, "4.4": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","coverage":"partial","tests":["AZ-ACI-001","AZ-ACR-003","AZ-ADX-001","AZ-AI-002","AZ-AI-005","AZ-AI-007","AZ-AKS-003","AZ-APP-008","AZ-AVD-001","AZ-BOT-001","AZ-CAPP-002","AZ-COS-002","AZ-DB-001","AZ-DB-002","AZ-DBX-002","AZ-DBX-003","AZ-DBX-004","AZ-KV-003","AZ-KV-004","AZ-NET-001","AZ-NET-002","AZ-NET-003","AZ-NET-004","AZ-NET-005","AZ-NET-006","AZ-NET-008","AZ-PAAS-001","AZ-SQL-005","AZ-STG-006","AZ-STG-007","AZ-STG-008","AZ-STG-009","AZ-VM-011","AZ-VM-012"]}, "4.5": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"notApplicable"}, "4.6": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","coverage":"partial","tests":["AZ-APP-003","AZ-NET-011"]}, "4.7": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","coverage":"partial","tests":["AZ-ACR-001","AZ-AKS-001","AZ-APP-004"]}, "4.8": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","coverage":"partial","tests":["AZ-APIM-001","AZ-APP-003","AZ-APP-005"]}, "4.9": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"manual"}, "4.10": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"notApplicable"}, "4.11": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"notApplicable"}, "4.12": {"title":"Control 4: Secure Configuration of Enterprise Assets and Software","applicability":"notApplicable"}, "5.1": {"title":"Control 5: Account Management","applicability":"manual"}, "5.2": {"title":"Control 5: Account Management","applicability":"manual"}, "5.3": {"title":"Control 5: Account Management","coverage":"partial","tests":["AZ-IAM-020"]}, "5.4": {"title":"Control 5: Account Management","coverage":"partial","tests":["AZ-IAM-018"]}, "5.5": {"title":"Control 5: Account Management","applicability":"manual"}, "5.6": {"title":"Control 5: Account Management","coverage":"partial","tests":["AZ-ACR-001","AZ-ACR-004","AZ-ACR-005","AZ-AI-001","AZ-AI-007","AZ-AKS-001","AZ-AKS-002","AZ-APP-004","AZ-BOT-002","AZ-COS-001","AZ-MSG-001","AZ-MY-003","AZ-PAAS-002","AZ-PG-004","AZ-RED-002","AZ-SQL-003","AZ-SQL-004","AZ-STG-005","AZ-STG-011","AZ-STG-023"]}, "6.1": {"title":"Control 6: Access Control Management","applicability":"notApplicable"}, "6.2": {"title":"Control 6: Access Control Management","coverage":"partial","tests":["AZ-IAM-006","AZ-IAM-007"]}, "6.3": {"title":"Control 6: Access Control Management","coverage":"partial","tests":["AZ-IAM-026","AZ-IAM-027"]}, "6.4": {"title":"Control 6: Access Control Management","coverage":"partial","tests":["AZ-NET-021"]}, "6.5": {"title":"Control 6: Access Control Management","coverage":"partial","tests":["AZ-IAM-024","AZ-IAM-026","AZ-IAM-027"]}, "6.6": {"title":"Control 6: Access Control Management","applicability":"manual"}, "6.7": {"title":"Control 6: Access Control Management","coverage":"partial","tests":["AZ-ACR-001","AZ-ACR-004","AZ-ACR-005","AZ-AI-001","AZ-AI-007","AZ-AKS-001","AZ-AKS-002","AZ-AKS-008","AZ-APP-004","AZ-APP-006","AZ-AUTO-002","AZ-BOT-002","AZ-COS-001","AZ-IAM-022","AZ-LOGIC-003","AZ-LOGIC-005","AZ-LOGIC-006","AZ-MSG-001","AZ-MY-003","AZ-PAAS-002","AZ-PG-004","AZ-RED-002","AZ-SQL-003","AZ-SQL-004","AZ-STG-005","AZ-STG-011","AZ-STG-023"]}, "6.8": {"title":"Control 6: Access Control Management","coverage":"partial","tests":["AZ-AKS-002","AZ-APIM-004","AZ-COS-003","AZ-GOV-005","AZ-IAM-008","AZ-IAM-010","AZ-IAM-023","AZ-KV-002","AZ-KV-009","AZ-MSG-001"]}, "7.1": {"title":"Control 7: Continuous Vulnerability Management","applicability":"notApplicable"}, "7.2": {"title":"Control 7: Continuous Vulnerability Management","applicability":"notApplicable"}, "7.3": {"title":"Control 7: Continuous Vulnerability Management","coverage":"partial","tests":["AZ-AKS-006","AZ-DFA-002"]}, "7.4": {"title":"Control 7: Continuous Vulnerability Management","coverage":"partial","tests":["AZ-AKS-006"]}, "7.5": {"title":"Control 7: Continuous Vulnerability Management","coverage":"partial","tests":["AZ-DEF-003","AZ-DEF-008","AZ-DEF-009","AZ-DEF-015","AZ-DEF-017","AZ-SQL-009","AZ-VM-005"]}, "7.6": {"title":"Control 7: Continuous Vulnerability Management","applicability":"manual"}, "7.7": {"title":"Control 7: Continuous Vulnerability Management","coverage":"partial","tests":["AZ-DFA-003","AZ-GOV-010"]}, "8.1": {"title":"Control 8: Audit Log Management","applicability":"notApplicable"}, "8.2": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-DBX-005","AZ-LOG-001","AZ-LOG-002","AZ-LOG-014","AZ-LOG-015","AZ-LOG-021","AZ-MY-002","AZ-NET-024","AZ-PG-002","AZ-PG-003","AZ-SQL-001","AZ-VM-008"]}, "8.3": {"title":"Control 8: Audit Log Management","applicability":"manual"}, "8.4": {"title":"Control 8: Audit Log Management","applicability":"manual"}, "8.5": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-LOG-014","AZ-MY-002","AZ-PG-002","AZ-PG-003","AZ-SQL-001"]}, "8.6": {"title":"Control 8: Audit Log Management","coverage":"full","tests":["AZ-NET-025"]}, "8.7": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-NET-024"]}, "8.8": {"title":"Control 8: Audit Log Management","applicability":"manual"}, "8.9": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-DEF-023","AZ-LOG-001","AZ-LOG-002","AZ-VM-008"]}, "8.10": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-LOG-016","AZ-LOG-019","AZ-LOG-022","AZ-LOG-024","AZ-SQL-002"]}, "8.11": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-DEF-002","AZ-DEF-003","AZ-DEF-004","AZ-DEF-005","AZ-DEF-006","AZ-DEF-007","AZ-DEF-008","AZ-DEF-009","AZ-DEF-010","AZ-DEF-011","AZ-DEF-012","AZ-DEF-013"]}, "8.12": {"title":"Control 8: Audit Log Management","coverage":"partial","tests":["AZ-LOG-001","AZ-LOG-002","AZ-LOG-015"]}, "9.1": {"title":"Control 9: Email and Web Browser Protections","applicability":"notApplicable"}, "9.2": {"title":"Control 9: Email and Web Browser Protections","coverage":"partial","tests":["AZ-NET-019"]}, "9.3": {"title":"Control 9: Email and Web Browser Protections","coverage":"partial","tests":["AZ-NET-019"]}, "9.4": {"title":"Control 9: Email and Web Browser Protections","applicability":"notApplicable"}, "9.5": {"title":"Control 9: Email and Web Browser Protections","applicability":"notApplicable"}, "9.6": {"title":"Control 9: Email and Web Browser Protections","applicability":"notApplicable"}, "9.7": {"title":"Control 9: Email and Web Browser Protections","applicability":"notApplicable"}, "10.1": {"title":"Control 10: Malware Defenses","coverage":"full","tests":["AZ-DEF-014","AZ-DFA-001","AZ-VM-006"]}, "10.2": {"title":"Control 10: Malware Defenses","coverage":"partial","tests":["AZ-DFA-001"]}, "10.3": {"title":"Control 10: Malware Defenses","applicability":"notApplicable"}, "10.4": {"title":"Control 10: Malware Defenses","applicability":"notApplicable"}, "10.5": {"title":"Control 10: Malware Defenses","coverage":"partial","tests":["AZ-VM-003"]}, "10.6": {"title":"Control 10: Malware Defenses","coverage":"partial","tests":["AZ-DEF-014"]}, "10.7": {"title":"Control 10: Malware Defenses","coverage":"partial","tests":["AZ-VM-006"]}, "11.1": {"title":"Control 11: Data Recovery","applicability":"notApplicable"}, "11.2": {"title":"Control 11: Data Recovery","coverage":"partial","tests":["AZ-BCK-004","AZ-BCK-007","AZ-BCK-008","AZ-BCK-009","AZ-STG-014","AZ-STG-015","AZ-STG-016","AZ-STG-017","AZ-STG-022","AZ-VM-010"]}, "11.3": {"title":"Control 11: Data Recovery","coverage":"partial","tests":["AZ-BCK-001","AZ-BCK-002","AZ-BCK-003","AZ-BCK-005","AZ-GOV-004"]}, "11.4": {"title":"Control 11: Data Recovery","coverage":"partial","tests":["AZ-BCK-002"]}, "11.5": {"title":"Control 11: Data Recovery","coverage":"partial","tests":["AZ-BCK-010"]}, "12.1": {"title":"Control 12: Network Infrastructure Management","applicability":"manual"}, "12.2": {"title":"Control 12: Network Infrastructure Management","coverage":"partial","tests":["AZ-ACI-001","AZ-ACR-003","AZ-ADX-001","AZ-AI-002","AZ-AI-005","AZ-AI-007","AZ-AKS-003","AZ-AKS-007","AZ-APP-008","AZ-AVD-001","AZ-BOT-001","AZ-CAPP-002","AZ-COS-002","AZ-DB-001","AZ-DB-002","AZ-DBX-001","AZ-DBX-002","AZ-DBX-003","AZ-DBX-004","AZ-DBX-006","AZ-KV-003","AZ-KV-004","AZ-NET-001","AZ-NET-002","AZ-NET-003","AZ-NET-004","AZ-NET-005","AZ-NET-006","AZ-NET-008","AZ-NET-009","AZ-PAAS-001","AZ-SQL-005","AZ-STG-006","AZ-STG-007","AZ-STG-008","AZ-STG-009","AZ-VM-011","AZ-VM-012"]}, "12.3": {"title":"Control 12: Network Infrastructure Management","applicability":"manual"}, "12.4": {"title":"Control 12: Network Infrastructure Management","applicability":"manual"}, "12.5": {"title":"Control 12: Network Infrastructure Management","coverage":"partial","tests":["AZ-NET-021"]}, "12.6": {"title":"Control 12: Network Infrastructure Management","applicability":"manual"}, "12.7": {"title":"Control 12: Network Infrastructure Management","applicability":"notApplicable"}, "12.8": {"title":"Control 12: Network Infrastructure Management","applicability":"notApplicable"}, "13.1": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-DEF-023","AZ-LOG-003","AZ-LOG-004","AZ-LOG-005","AZ-LOG-006","AZ-LOG-007","AZ-LOG-008","AZ-LOG-009","AZ-LOG-010","AZ-LOG-011","AZ-LOG-012"]}, "13.2": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-DEF-002"]}, "13.3": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-NET-020"]}, "13.4": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-AI-003","AZ-AI-006","AZ-AKS-007","AZ-DBX-001","AZ-DBX-006","AZ-NET-006","AZ-NET-007","AZ-NET-009","AZ-SYN-001"]}, "13.5": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-IAM-030"]}, "13.6": {"title":"Control 13: Network Monitoring and Defense","coverage":"full","tests":["AZ-LOG-017","AZ-LOG-018","AZ-LOG-020","AZ-LOG-023"]}, "13.7": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-DEF-002"]}, "13.8": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-NET-020"]}, "13.9": {"title":"Control 13: Network Monitoring and Defense","applicability":"notApplicable"}, "13.10": {"title":"Control 13: Network Monitoring and Defense","coverage":"partial","tests":["AZ-NET-012","AZ-NET-015","AZ-NET-016","AZ-NET-017","AZ-NET-018"]}, "13.11": {"title":"Control 13: Network Monitoring and Defense","applicability":"notApplicable"}, "14.1": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.2": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.3": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.4": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.5": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.6": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.7": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.8": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "14.9": {"title":"Control 14: Security Awareness and Skills Training","applicability":"notApplicable"}, "15.1": {"title":"Control 15: Service Provider Management","coverage":"partial","tests":["AZ-IAM-025"]}, "15.2": {"title":"Control 15: Service Provider Management","applicability":"notApplicable"}, "15.3": {"title":"Control 15: Service Provider Management","applicability":"notApplicable"}, "15.4": {"title":"Control 15: Service Provider Management","applicability":"notApplicable"}, "15.5": {"title":"Control 15: Service Provider Management","applicability":"notApplicable"}, "15.6": {"title":"Control 15: Service Provider Management","applicability":"notApplicable"}, "15.7": {"title":"Control 15: Service Provider Management","applicability":"notApplicable"}, "16.1": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.2": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.3": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.4": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.5": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.6": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.7": {"title":"Control 16: Application Software Security","coverage":"partial","tests":["AZ-GOV-001"]}, "16.8": {"title":"Control 16: Application Software Security","applicability":"manual"}, "16.9": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.10": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.11": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.12": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.13": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "16.14": {"title":"Control 16: Application Software Security","applicability":"notApplicable"}, "17.1": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.2": {"title":"Control 17: Incident Response Management","coverage":"partial","tests":["AZ-DEF-018"]}, "17.3": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.4": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.5": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.6": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.7": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.8": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "17.9": {"title":"Control 17: Incident Response Management","applicability":"notApplicable"}, "18.1": {"title":"Control 18: Penetration Testing","applicability":"notApplicable"}, "18.2": {"title":"Control 18: Penetration Testing","applicability":"manual"}, "18.3": {"title":"Control 18: Penetration Testing","applicability":"manual"}, "18.4": {"title":"Control 18: Penetration Testing","applicability":"manual"}, "18.5": {"title":"Control 18: Penetration Testing","applicability":"manual"} } } |