Analyze/catalog/frameworks/cis-azure-compute.json
|
{
"key": "CIS Azure Compute", "order": 3, "name": "CIS Microsoft Azure Compute Services Benchmark", "shortName": "CIS Azure Compute 2.0.0", "version": "2.0.0", "publisher": "Center for Internet Security (CIS)", "type": "benchmark", "url": "https://www.cisecurity.org/benchmark/azure", "download": "https://learn.cisecurity.org/benchmarks", "retrieved": "2026-11-05", "mapping": "native", "note": "Each test implements the audit procedure of the recommendation it is mapped to. CIS numbers App Service settings separately for web apps, web app slots, function apps and function app slots; those recommendations are judged only on the findings for their kind of resource (scope). Recommendations that CIS itself marks Manual have no test, except where an existing test reads what the audit asks.", "controls": { "2.1.1": {"title":"Ensure 'Java version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.1.2": {"title":"Ensure 'Python version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.1.3": {"title":"Ensure 'PHP version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.1.4": {"title":"Ensure 'Basic Authentication Publishing Credentials' are 'Disabled'","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-004"]}, "2.1.5": {"title":"Ensure 'FTP State' is set to 'FTPS only' or 'Disabled'","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-003"]}, "2.1.6": {"title":"Ensure 'HTTP version' is set to '2.0' (if in use)","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-016"]}, "2.1.7": {"title":"Ensure 'HTTPS Only' is set to 'On'","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-001"]}, "2.1.8": {"title":"Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-002"]}, "2.1.9": {"title":"Ensure end-to-end TLS encryption is enabled","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-017"]}, "2.1.10": {"title":"Ensure 'Remote debugging' is set to 'Off'","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-005"]}, "2.1.11": {"title":"Ensure incoming client certificates are enabled and required (if in use)","level":"L2","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-018"]}, "2.1.12": {"title":"Ensure 'App Service authentication' is set to 'Enabled'","level":"L2","assessment":"Automated","scope":"webApps","coverage":"partial","tests":["AZ-APP-019"]}, "2.1.13": {"title":"Ensure managed identities are configured","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-006"]}, "2.1.14": {"title":"Ensure public network access is disabled","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-020"]}, "2.1.15": {"title":"Ensure App Service plan SKU supports private endpoints","level":"L2","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-021"]}, "2.1.16": {"title":"Ensure private endpoints are used to access App Service apps","level":"L2","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-022"]}, "2.1.17": {"title":"Ensure private endpoints used to access App Service apps use private DNS zones","level":"L2","assessment":"Manual","applicability":"manual"}, "2.1.18": {"title":"Ensure app is integrated with a virtual network","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-023"]}, "2.1.19": {"title":"Ensure configuration is routed through the virtual network integration","level":"L2","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-024"]}, "2.1.20": {"title":"Ensure all traffic is routed through the virtual network","level":"L1","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-025"]}, "2.1.21": {"title":"Ensure cross-origin resource sharing does not allow all origins","level":"L2","assessment":"Automated","scope":"webApps","coverage":"full","tests":["AZ-APP-007"]}, "2.2.1": {"title":"Ensure 'Java version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.2.2": {"title":"Ensure 'Python version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.2.3": {"title":"Ensure 'PHP version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.2.4": {"title":"Ensure 'Basic Authentication Publishing Credentials' are 'Disabled'","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-004"]}, "2.2.5": {"title":"Ensure 'FTP state' is set to 'FTPS only' or 'Disabled'","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-003"]}, "2.2.6": {"title":"Ensure 'HTTP version' is set to '2.0' (if in use)","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-016"]}, "2.2.7": {"title":"Ensure 'HTTPS Only' is set to 'On'","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-001"]}, "2.2.8": {"title":"Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-002"]}, "2.2.9": {"title":"Ensure end-to-end TLS encryption is enabled","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-017"]}, "2.2.10": {"title":"Ensure 'Remote debugging' is set to 'Off'","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-005"]}, "2.2.11": {"title":"Ensure incoming client certificates are enabled and required (if in use)","level":"L2","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-018"]}, "2.2.12": {"title":"Ensure managed identities are configured","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-006"]}, "2.2.13": {"title":"Ensure public network access is disabled","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-020"]}, "2.2.14": {"title":"Ensure deployment slot is integrated with a virtual network","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-023"]}, "2.2.15": {"title":"Ensure configuration is routed through the virtual network integration","level":"L2","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-024"]}, "2.2.16": {"title":"Ensure all traffic is routed through the virtual network","level":"L1","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-025"]}, "2.2.17": {"title":"Ensure cross-origin resource sharing does not allow all origins","level":"L2","assessment":"Automated","scope":"webAppSlots","coverage":"full","tests":["AZ-APP-007"]}, "2.3.1": {"title":"Ensure 'Java version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.3.2": {"title":"Ensure 'Python version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.3.3": {"title":"Ensure 'Basic Authentication Publishing Credentials' are 'Disabled'","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-004"]}, "2.3.4": {"title":"Ensure 'FTP state' is set to 'FTPS only' or 'Disabled'","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-003"]}, "2.3.5": {"title":"Ensure 'HTTP version' is set to '2.0' (if in use)","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-016"]}, "2.3.6": {"title":"Ensure 'HTTPS Only' is set to 'On'","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-001"]}, "2.3.7": {"title":"Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-002"]}, "2.3.8": {"title":"Ensure end-to-end TLS encryption is enabled","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-017"]}, "2.3.9": {"title":"Ensure 'Remote debugging' is set to 'Off'","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-005"]}, "2.3.10": {"title":"Ensure incoming client certificates are enabled and required (if in use)","level":"L2","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-018"]}, "2.3.11": {"title":"Ensure 'App Service authentication' is set to 'Enabled'","level":"L2","assessment":"Automated","scope":"functionApps","coverage":"partial","tests":["AZ-APP-019"]}, "2.3.12": {"title":"Ensure managed identities are configured","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-006"]}, "2.3.13": {"title":"Ensure public network access is disabled","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-020"]}, "2.3.14": {"title":"Ensure function app is integrated with a virtual network","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-023"]}, "2.3.15": {"title":"Ensure configuration is routed through the virtual network integration","level":"L2","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-024"]}, "2.3.16": {"title":"Ensure all traffic is routed through the virtual network","level":"L1","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-025"]}, "2.3.17": {"title":"Ensure cross-origin resource sharing does not allow all origins","level":"L2","assessment":"Automated","scope":"functionApps","coverage":"full","tests":["AZ-APP-007"]}, "2.4.1": {"title":"Ensure 'Java version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.4.2": {"title":"Ensure 'Python version' is currently supported (if in use)","level":"L1","assessment":"Manual","applicability":"manual"}, "2.4.3": {"title":"Ensure 'Basic Authentication Publishing Credentials' are 'Disabled'","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-004"]}, "2.4.4": {"title":"Ensure 'FTP state' is set to 'FTPS only' or 'Disabled'","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-003"]}, "2.4.5": {"title":"Ensure 'HTTP version' is set to '2.0' (if in use)","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-016"]}, "2.4.6": {"title":"Ensure 'HTTPS Only' is set to 'On'","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-001"]}, "2.4.7": {"title":"Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-002"]}, "2.4.8": {"title":"Ensure end-to-end TLS encryption is enabled","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-017"]}, "2.4.9": {"title":"Ensure 'Remote debugging' is set to 'Off'","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-005"]}, "2.4.10": {"title":"Ensure incoming client certificates are enabled and required (if in use)","level":"L2","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-018"]}, "2.4.11": {"title":"Ensure managed identities are configured","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-006"]}, "2.4.12": {"title":"Ensure public network access is disabled","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-020"]}, "2.4.13": {"title":"Ensure deployment slot is integrated with a virtual network","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-023"]}, "2.4.14": {"title":"Ensure configuration is routed through the virtual network integration","level":"L2","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-024"]}, "2.4.15": {"title":"Ensure all traffic is routed through the virtual network","level":"L1","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-025"]}, "2.4.16": {"title":"Ensure cross-origin resource sharing does not allow all origins","level":"L2","assessment":"Automated","scope":"functionAppSlots","coverage":"full","tests":["AZ-APP-007"]}, "2.5": {"title":"Ensure Azure Key Vaults are Used to Store Secrets","level":"L2","assessment":"Manual","applicability":"manual"}, "2.6": {"title":"Ensure App Service Environment is deployed with an internal load balancer","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-APP-026"]}, "2.7": {"title":"Ensure App Service Environment is provisioned with v3 or higher","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-APP-027"]}, "2.8": {"title":"Ensure App Service Environment has internal encryption enabled","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-APP-028"]}, "2.9": {"title":"Ensure App Service Environment has TLS 1.0 and 1.1 disabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-APP-029"]}, "2.10": {"title":"Ensure App Service Environment has TLS cipher suite ordering configured","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-APP-030"]}, "3.1": {"title":"Ensure Private Virtual Networks are used for Container Instances","level":"L1","assessment":"Manual","coverage":"partial","tests":["AZ-ACI-001"]}, "3.2": {"title":"Ensure a Managed Identity is used for interactions with other Azure services","level":"L1","assessment":"Manual","applicability":"manual"}, "3.3": {"title":"Ensure the principle of least privilege is used when assigning roles to a Managed Identity","level":"L1","assessment":"Manual","applicability":"manual"}, "4.1": {"title":"Ensure SSL is configured for CycleCloud","level":"L1","assessment":"Manual","applicability":"manual"}, "15.1": {"title":"Ensure Batch account is set to use customer-managed keys to encrypt data","level":"L2","assessment":"Manual","applicability":"manual"}, "15.2": {"title":"Ensure Batch pools disk encryption is set enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BATCH-001"]}, "15.3": {"title":"Ensure local authentication methods for accounts are disabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BATCH-002"]}, "15.4": {"title":"Ensure Private endpoints are considered for Batch accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BATCH-003"]}, "15.5": {"title":"Ensure public network access is disabled for Batch accounts","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BATCH-004"]}, "15.6": {"title":"Ensure private DNS zones for private endpoints that connect to Batch accounts are configured.","level":"L2","assessment":"Manual","applicability":"manual"}, "15.7": {"title":"Ensure Diagnostics settings logs for Batch accounts are enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BATCH-005"]}, "20.1": {"title":"Ensure Virtual Machines are utilizing Managed Disks","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-VM-001"]}, "20.2": {"title":"Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-VM-018"]}, "20.3": {"title":"Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-VM-019"]}, "20.4": {"title":"Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-VM-011"]}, "20.5": {"title":"Ensure that 'Enable Data Access Authentication Mode' is 'Checked'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-VM-020"]}, "20.6": {"title":"Ensure that Only Approved Extensions Are Installed","level":"L1","assessment":"Manual","applicability":"manual"}, "20.7": {"title":"Ensure that Endpoint Protection for all Virtual Machines is installed","level":"L2","assessment":"Manual","applicability":"manual"}, "20.8": {"title":"[Legacy] Ensure that VHDs are Encrypted","level":"L2","assessment":"Manual","applicability":"manual"}, "20.9": {"title":"Ensure only MFA enabled identities can access privileged Virtual Machine","level":"L2","assessment":"Manual","applicability":"manual"}, "20.10": {"title":"Ensure Trusted Launch is enabled on Virtual Machines","level":"L1","assessment":"Automated","scope":"Microsoft.Compute/virtualMachines","coverage":"partial","tests":["AZ-VM-003"]}, "20.11": {"title":"Ensure that encryption at host is enabled","level":"L1","assessment":"Automated","scope":"Microsoft.Compute/virtualMachines","coverage":"partial","tests":["AZ-VM-002"]} } } |