Analyze/catalog/frameworks/cis-azure.json
|
{
"key": "CIS Azure", "order": 2, "name": "CIS Microsoft Azure Foundations Benchmark", "shortName": "CIS Azure 6.0.0", "version": "6.0.0", "publisher": "Center for Internet Security (CIS)", "type": "benchmark", "url": "https://www.cisecurity.org/benchmark/azure", "download": "https://learn.cisecurity.org/benchmarks", "retrieved": "2026-09-20", "mapping": "native", "note": "Each test implements the audit procedure of the recommendation it is mapped to. Recommendations that CIS itself marks Manual have no test.", "controls": { "2.1.1": {"title":"Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DBX-001"]}, "2.1.2": {"title":"Ensure that network security groups are configured for Databricks subnets","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DBX-006"]}, "2.1.3": {"title":"Ensure that traffic is encrypted between cluster worker nodes","level":"L2","assessment":"Manual","applicability":"manual"}, "2.1.4": {"title":"Ensure that users and groups are synced from Microsoft Entra ID to Azure Databricks","level":"L1","assessment":"Manual","applicability":"manual"}, "2.1.5": {"title":"Ensure that Unity Catalog is configured for Azure Databricks","level":"L1","assessment":"Manual","applicability":"manual"}, "2.1.6": {"title":"Ensure that usage is restricted and expiry is enforced for Databricks personal access tokens","level":"L1","assessment":"Manual","applicability":"manual"}, "2.1.7": {"title":"Ensure that diagnostic log delivery is configured for Azure Databricks","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DBX-005"]}, "2.1.8": {"title":"Ensure critical data is encrypted with customer managed keys (CMK)","level":"L2","assessment":"Manual","applicability":"manual"}, "2.1.9": {"title":"Ensure 'No Public IP' is set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DBX-002"]}, "2.1.10": {"title":"Ensure 'Allow Public Network Access' is set to 'Disabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DBX-003"]}, "2.1.11": {"title":"Ensure private endpoints are used to access Azure Databricks workspaces","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DBX-004"]}, "2.1.12": {"title":"Ensure Azure Databricks groups are reviewed periodically","level":"L1","assessment":"Manual","applicability":"manual"}, "3.1.1": {"title":"Ensure only MFA enabled identities can access privileged Virtual Machine","level":"L2","assessment":"Manual","applicability":"manual"}, "5.1.1": {"title":"Ensure that 'security defaults' is enabled in Microsoft Entra ID","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-026"]}, "5.1.2": {"title":"Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'","level":"L1","assessment":"Manual","applicability":"manual"}, "5.1.3": {"title":"Ensure that 'Multifactor authentication' is 'enabled' for all users","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-027"]}, "5.1.4": {"title":"Ensure that 'Allow users to remember multifactor authentication on devices they trust' is disabled","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.1": {"title":"Ensure that Azure admin accounts are not used for daily operations","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.2": {"title":"Ensure that guest users are reviewed on a regular basis","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-IAM-004","AZ-IAM-005"]}, "5.3.3": {"title":"Ensure that use of the 'User Access Administrator' role is restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-009"]}, "5.3.4": {"title":"Ensure that all 'privileged' role assignments are periodically reviewed","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.5": {"title":"Ensure disabled user accounts do not have read, write, or owner permissions","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-006"]}, "5.3.6": {"title":"Ensure 'Tenant Creator' role assignments are periodically reviewed","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.7": {"title":"Ensure all non-privileged role assignments are periodically reviewed","level":"L1","assessment":"Manual","applicability":"manual"}, "5.4": {"title":"Ensure that no custom subscription administrator roles exist","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-008"]}, "5.5": {"title":"Ensure that a custom role is assigned permissions for administering resource locks","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-GOV-005"]}, "5.6": {"title":"Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-GOV-011"]}, "5.7": {"title":"Ensure there are between 2 and 3 subscription owners","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-001"]}, "6.1.1.1": {"title":"Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-001"]}, "6.1.1.2": {"title":"Ensure Diagnostic Setting captures appropriate categories","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-002"]}, "6.1.1.3": {"title":"Ensure the storage account containing the container with activity logs is encrypted with customer-managed key (CMK)","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.1.4": {"title":"Ensure that logging for Azure Key Vault is 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-014"]}, "6.1.1.5": {"title":"Ensure that Network Security Group Flow logs are captured and sent to Log Analytics","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-LOG-023"]}, "6.1.1.6": {"title":"Ensure that virtual network flow logs are captured and sent to Log Analytics","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-LOG-018","AZ-LOG-020"]}, "6.1.1.7": {"title":"Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Graph activity logs to an appropriate destination","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.1.8": {"title":"Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Entra activity logs to an appropriate destination","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.1.9": {"title":"Ensure that Intune logs are captured and sent to Log Analytics","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.2.1": {"title":"Ensure that Activity Log Alert exists for Create Policy Assignment","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-003"]}, "6.1.2.2": {"title":"Ensure that Activity Log Alert exists for Delete Policy Assignment","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-004"]}, "6.1.2.3": {"title":"Ensure that Activity Log Alert exists for Create or Update Network Security Group","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-005"]}, "6.1.2.4": {"title":"Ensure that Activity Log Alert exists for Delete Network Security Group","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-006"]}, "6.1.2.5": {"title":"Ensure that Activity Log Alert exists for Create or Update Security Solution","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-007"]}, "6.1.2.6": {"title":"Ensure that Activity Log Alert exists for Delete Security Solution","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-008"]}, "6.1.2.7": {"title":"Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-009"]}, "6.1.2.8": {"title":"Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-010"]}, "6.1.2.9": {"title":"Ensure that Activity Log Alert exists for Create or Update Public IP Address rule","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-011"]}, "6.1.2.10": {"title":"Ensure that Activity Log Alert exists for Delete Public IP Address rule","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-012"]}, "6.1.2.11": {"title":"Ensure that an Activity Log Alert exists for Service Health","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-013"]}, "6.1.3.1": {"title":"Ensure Application Insights are configured","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-021"]}, "6.1.4": {"title":"Ensure that Azure Monitor resource logging is enabled for all services that support it","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-LOG-015"]}, "6.1.5": {"title":"Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored","level":"L2","assessment":"Manual","applicability":"manual"}, "6.2": {"title":"Ensure that resource locks are set for mission-critical Azure resources","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-GOV-004","AZ-LOG-026"]}, "7.1": {"title":"Ensure that RDP access from the Internet is evaluated and restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-001"]}, "7.2": {"title":"Ensure that SSH access from the Internet is evaluated and restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-002"]}, "7.3": {"title":"Ensure that UDP access from the Internet is evaluated and restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-003"]}, "7.4": {"title":"Ensure that HTTP(S) access from the Internet is evaluated and restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-004"]}, "7.5": {"title":"Ensure that network security group flow log retention days is set to greater than or equal to 90","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-022"]}, "7.6": {"title":"Ensure that Network Watcher is 'Enabled' for Azure regions that are in use","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-017"]}, "7.7": {"title":"Ensure that Public IP addresses are evaluated on a periodic basis","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-GOV-007"]}, "7.8": {"title":"Ensure that virtual network flow log retention days is set to greater than or equal to 90","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-019"]}, "7.9": {"title":"Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-NET-021"]}, "7.10": {"title":"Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-012"]}, "7.11": {"title":"Ensure subnets are associated with network security groups","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-006"]}, "7.12": {"title":"Ensure the SSL policy's 'Min protocol version' is set to 'TLSv1_2' or higher on Azure Application Gateway","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-013"]}, "7.13": {"title":"Ensure 'HTTP2' is set to 'Enabled' on Azure Application Gateway","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-014"]}, "7.14": {"title":"Ensure request body inspection is enabled in Azure Web Application Firewall policy on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-016"]}, "7.15": {"title":"Ensure bot protection is enabled in Azure Web Application Firewall policy on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-017"]}, "7.16": {"title":"Ensure Azure Network Security Perimeter is used to secure Azure platform-as-a-service resources","level":"L2","assessment":"Manual","applicability":"manual"}, "8.1.1.1": {"title":"Ensure Microsoft Defender CSPM is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-001"]}, "8.1.2.1": {"title":"Ensure Microsoft Defender for APIs is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-012"]}, "8.1.3.1": {"title":"Ensure that Defender for Servers is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-002"]}, "8.1.3.2": {"title":"Ensure that 'Vulnerability assessment for machines' component status is set to 'On'","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-DEF-017"]}, "8.1.3.3": {"title":"Ensure that 'Endpoint protection' component status is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-014"]}, "8.1.3.4": {"title":"Ensure that 'Agentless scanning for machines' component status is set to 'On'","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-DEF-015"]}, "8.1.3.5": {"title":"Ensure that 'File Integrity Monitoring' component status is set to 'On'","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-DEF-016"]}, "8.1.4.1": {"title":"Ensure that Microsoft Defender for Containers is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-003"]}, "8.1.5.1": {"title":"Ensure that Microsoft Defender for Storage is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-004"]}, "8.1.5.2": {"title":"Ensure Advanced Threat Protection alerts for storage accounts are monitored","level":"L2","assessment":"Manual","applicability":"manual"}, "8.1.6.1": {"title":"Ensure that Microsoft Defender for App Services is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-005"]}, "8.1.7.1": {"title":"Ensure that Microsoft Defender for Azure Cosmos DB is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-006"]}, "8.1.7.2": {"title":"Ensure that Microsoft Defender for Open-Source Relational Databases is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-007"]}, "8.1.7.3": {"title":"Ensure that Microsoft Defender for (Managed Instance) Azure SQL Databases is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-008"]}, "8.1.7.4": {"title":"Ensure that Microsoft Defender for SQL Servers on Machines is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-009"]}, "8.1.8.1": {"title":"Ensure that Microsoft Defender for Key Vault is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-010"]}, "8.1.9.1": {"title":"Ensure that Microsoft Defender for Resource Manager is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-011"]}, "8.1.10": {"title":"Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-VM-005"]}, "8.1.11": {"title":"Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-GOV-001","AZ-GOV-002"]}, "8.1.12": {"title":"Ensure that 'All users with the following roles' is set to 'Owner'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-019"]}, "8.1.13": {"title":"Ensure 'Additional email addresses' is configured with a security contact email","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-018"]}, "8.1.14": {"title":"Ensure that 'Notify about alerts with the following severity (or higher)' is enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-020"]}, "8.1.15": {"title":"Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-021"]}, "8.1.16": {"title":"Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled","level":"L2","assessment":"Manual","applicability":"manual"}, "8.2.1": {"title":"Ensure That Microsoft Defender for IoT Hub Is Set To 'On'","level":"L2","assessment":"Manual","applicability":"manual"}, "8.3.1": {"title":"Ensure that the expiration date is set for all keys in RBAC key vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-005"]}, "8.3.2": {"title":"Ensure that the expiration date is set for all keys in non-RBAC key vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-010"]}, "8.3.3": {"title":"Ensure that the expiration date is set for all secrets in RBAC key vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-006"]}, "8.3.4": {"title":"Ensure that the expiration date is set for all secrets in non-RBAC key vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-011"]}, "8.3.5": {"title":"Ensure 'Purge protection' is enabled for all key vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-001"]}, "8.3.6": {"title":"Ensure that Role Based Access Control for Azure Key Vault is enabled","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-002"]}, "8.3.7": {"title":"Ensure public network access is disabled for Azure Key Vault","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-003"]}, "8.3.8": {"title":"Ensure private endpoints are used to access Azure Key Vault","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-004"]}, "8.3.9": {"title":"Ensure automatic key rotation is enabled within Azure Key Vault","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-007"]}, "8.3.10": {"title":"Ensure that Azure Key Vault Managed HSM is used when required","level":"L2","assessment":"Manual","applicability":"manual"}, "8.3.11": {"title":"Ensure certificate 'Validity Period (in months)' is less than or equal to '12'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-008"]}, "8.4.1": {"title":"Ensure an Azure Bastion Host exists","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-011"]}, "8.5": {"title":"Ensure Azure DDoS Network Protection is enabled on virtual networks","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-010"]}, "9.1.1": {"title":"Ensure soft delete for Azure File Shares is enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-017"]}, "9.1.2": {"title":"Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-018"]}, "9.1.3": {"title":"Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-019"]}, "9.2.1": {"title":"Ensure that soft delete for blobs on Azure Blob Storage storage accounts is enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-014"]}, "9.2.2": {"title":"Ensure that soft delete for containers on Azure Blob Storage storage accounts is enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-015"]}, "9.2.3": {"title":"Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-016"]}, "9.3.1.1": {"title":"Ensure that 'Enable key rotation reminders' is enabled for each storage account","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-012"]}, "9.3.1.2": {"title":"Ensure that storage account access keys are periodically regenerated","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-013"]}, "9.3.1.3": {"title":"Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-005"]}, "9.3.2.1": {"title":"Ensure private endpoints are used to access storage accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-008"]}, "9.3.2.2": {"title":"Ensure that 'Public Network Access' is 'Disabled' for storage accounts","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-006"]}, "9.3.2.3": {"title":"Ensure default network access rule for storage accounts is set to deny","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-007"]}, "9.3.3.1": {"title":"Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-011"]}, "9.3.4": {"title":"Ensure that 'Secure transfer required' is set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-001"]}, "9.3.5": {"title":"Ensure 'Allow trusted Microsoft services to access this storage account' is enabled for storage account access","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-009"]}, "9.3.6": {"title":"Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-002"]}, "9.3.7": {"title":"Ensure 'Cross Tenant Replication' is not enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-010"]}, "9.3.8": {"title":"Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-003"]}, "9.3.9": {"title":"Ensure Azure Resource Manager Delete locks are applied to Azure Storage Accounts","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-025"]}, "9.3.10": {"title":"Ensure Azure Resource Manager ReadOnly locks are considered for Azure Storage Accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-026"]}, "9.3.11": {"title":"Ensure redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-022"]} } } |