Analyze/catalog/frameworks/cis-azure-storage.json
|
{
"key": "CIS Azure Storage", "order": 5, "name": "CIS Microsoft Azure Storage Services Benchmark", "shortName": "CIS Azure Storage 2.0.0", "version": "2.0.0", "publisher": "Center for Internet Security (CIS)", "type": "benchmark", "url": "https://www.cisecurity.org/benchmark/azure", "download": "https://learn.cisecurity.org/benchmarks", "retrieved": "2026-11-05", "mapping": "native", "note": "Each test implements the audit procedure of the recommendation it is mapped to; partial marks where the test differs from the audit. Recommendations about SAS tokens as they are generated cannot be read from configuration and have no test.", "controls": { "3.1.1": {"title":"Ensure soft delete on Backup vaults is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-013"]}, "3.1.2": {"title":"Ensure immutability for Backup vaults is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-014"]}, "3.1.3": {"title":"Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-015"]}, "3.1.4": {"title":"Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-016"]}, "3.1.5": {"title":"Ensure 'Cross Region Restore' is set to 'Enabled' on Backup vaults","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-017"]}, "3.1.6": {"title":"Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Backup vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-018"]}, "3.2.1": {"title":"Ensure soft delete on Recovery Services vaults is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-001"]}, "3.2.2": {"title":"Ensure immutability for Recovery Services vaults is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-002"]}, "3.2.3": {"title":"Ensure backup data in Recovery Services vaults is encrypted using customer-managed keys (CMK)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-019"]}, "3.2.4": {"title":"Ensure 'Use infrastructure encryption for this vault' is enabled on Recovery Services vaults","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-020"]}, "3.2.5": {"title":"Ensure public network access on Recovery Services vaults is Disabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-021"]}, "3.2.6": {"title":"Ensure 'Cross Region Restore' is set to 'Enabled' on Recovery Services vaults","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-009"]}, "3.2.7": {"title":"Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Recovery Services vaults","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-BCK-005"]}, "3.2.8": {"title":"Ensure private endpoints are configured for Recovery Services Vaults","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-BCK-022"]}, "4.1": {"title":"Ensure 'Key encryption key' is set to a customer-managed key for Azure Managed Lustre file systems","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-034"]}, "7.1.1": {"title":"Ensure root squash for NFS file shares is configured (Microsoft.FileShares)","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-STG-028"]}, "7.1.2": {"title":"Ensure encryption in transit is required for File Shares (Microsoft.FileShares)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-029"]}, "7.1.3": {"title":"Ensure 'Public Endpoint Access' for File Shares is restricted to selected virtual networks (Microsoft.FileShares)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-030"]}, "7.1.4": {"title":"Ensure 'Public Endpoint Access' is set to 'Disabled' for File Shares (Microsoft.FileShares)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-031"]}, "7.1.5": {"title":"Ensure private endpoints are configured for File Shares (Microsoft.FileShares)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-032"]}, "7.2.1": {"title":"Ensure soft delete for Azure File Shares is Enabled (Classic File Shares)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-017"]}, "7.2.2": {"title":"Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares (Classic File Shares)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-019"]}, "7.2.3": {"title":"Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares (Classic File Shares)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-018"]}, "7.2.4": {"title":"Ensure root squash for NFS file shares is configured (Classic File Shares)","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-STG-033"]}, "9.1": {"title":"Ensure 'Encryption key source' is set to 'Customer Managed Key' for Azure NetApp Files accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-035"]}, "10.1": {"title":"Ensure 'Allowed Protocols' for shared access signature (SAS) tokens is set to 'HTTPS Only'","level":"L1","assessment":"Manual","applicability":"manual"}, "10.2": {"title":"Ensure that shared access signature (SAS) tokens expire within an hour","level":"L2","assessment":"Manual","applicability":"manual"}, "10.3": {"title":"Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-STG-014"]}, "10.4": {"title":"Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens","level":"L1","assessment":"Manual","applicability":"manual"}, "10.5": {"title":"Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts","level":"L2","assessment":"Automated","coverage":"partial","tests":["AZ-STG-016"]}, "10.6": {"title":"Ensure locked immutability policies are used for containers storing business-critical blob data","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-036"]}, "11.1": {"title":"Ensure double encryption is used for Azure Data Box in high-security environments","level":"L2","assessment":"Manual","applicability":"manual"}, "14.1": {"title":"Ensure 'Public network access' is set to 'Disabled' on Azure Elastic SAN","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-037"]}, "14.2": {"title":"Ensure customer-managed keys (CMK) are used to encrypt data at rest on Azure Elastic SAN volume groups","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-038"]}, "15.1": {"title":"Ensure 'Allowed Protocols' for shared access signature (SAS) tokens is set to 'HTTPS Only'","level":"L1","assessment":"Manual","applicability":"manual"}, "15.2": {"title":"Ensure that shared access signature (SAS) tokens expire within an hour","level":"L2","assessment":"Manual","applicability":"manual"}, "15.3": {"title":"Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens","level":"L1","assessment":"Manual","applicability":"manual"}, "16.1.1": {"title":"Ensure that 'Enable key rotation reminders' is enabled for each Storage Account","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-STG-012"]}, "16.1.2": {"title":"Ensure 'Allowed Protocols' for shared access signature (SAS) tokens is set to 'HTTPS Only'","level":"L1","assessment":"Manual","applicability":"manual"}, "16.1.3": {"title":"Ensure that Storage Account Access Keys are Periodically Regenerated","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-STG-013"]}, "16.1.4": {"title":"Ensure that a shared access signature (SAS) expiration policy is configured","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-024"]}, "16.1.5": {"title":"Ensure the shared access signature (SAS) expiration policy action is set to 'Block'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-039"]}, "16.1.6": {"title":"Ensure that shared access signature (SAS) tokens expire within an hour","level":"L2","assessment":"Manual","applicability":"manual"}, "16.1.7": {"title":"Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-005"]}, "16.1.8": {"title":"Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK)","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-STG-021"]}, "16.2.1": {"title":"Ensure Private Endpoints are used to access Storage Accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-008"]}, "16.2.2": {"title":"Ensure that 'Public Network Access' is 'Disabled' for storage accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-006"]}, "16.2.3": {"title":"Ensure Default Network Access Rule for Storage Accounts is Set to Deny","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-STG-007"]}, "16.4": {"title":"Ensure that 'Secure transfer required' is set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-001"]}, "16.5": {"title":"Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'Enabled'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-020"]}, "16.6": {"title":"Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-009"]}, "16.7": {"title":"Ensure Soft Delete is Enabled for Azure Containers and Blob Storage","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-014","AZ-STG-015"]}, "16.8": {"title":"Ensure storage logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-040"]}, "16.9": {"title":"Ensure storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-041"]}, "16.10": {"title":"Ensure storage logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-042"]}, "16.11": {"title":"Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-STG-002"]}, "16.12": {"title":"Ensure 'Cross Tenant Replication' is not enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-010"]}, "16.13": {"title":"Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-003"]}, "16.14": {"title":"Ensure Azure Resource Manager Delete locks are applied to Azure Storage Accounts","level":"L1","assessment":"Manual","coverage":"partial","tests":["AZ-STG-025"]}, "16.15": {"title":"Ensure Azure Resource Manager ReadOnly locks are considered for Azure Storage Accounts","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-STG-026"]}, "16.16": {"title":"Ensure Redundancy is set to a geo-redundant option on critical Azure Storage Accounts","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-STG-022"]}, "17.1": {"title":"Ensure that shared access signature (SAS) tokens expire within an hour","level":"L2","assessment":"Manual","applicability":"manual"}, "17.2": {"title":"Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens","level":"L1","assessment":"Manual","applicability":"manual"}, "17.3": {"title":"Ensure Storage Explorer is using the latest version","level":"L1","assessment":"Manual","applicability":"notApplicable"} } } |