Analyze/catalog/frameworks/cis-azure.json
|
{
"key": "CIS Azure", "order": 2, "name": "CIS Microsoft Azure Foundations Benchmark", "shortName": "CIS Azure 7.0.0", "version": "7.0.0", "publisher": "Center for Internet Security (CIS)", "type": "benchmark", "url": "https://www.cisecurity.org/benchmark/azure", "download": "https://learn.cisecurity.org/benchmarks", "retrieved": "2026-11-05", "mapping": "native", "note": "Each test implements the audit procedure of the recommendation it is mapped to. Recommendations that CIS itself marks Manual have no test unless a test evidences them. Since 7.0.0 the storage, compute, database and Databricks recommendations are in the CIS service benchmarks (CIS Azure Storage, Compute and Database; the AI and ML Services benchmark is not yet published for download).", "controls": { "5.1.1": {"title":"Ensure that 'security defaults' is Enabled in Microsoft Entra ID","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-026"]}, "5.1.2": {"title":"Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'","level":"L1","assessment":"Manual","applicability":"manual"}, "5.1.3": {"title":"Ensure that 'Per-user MFA' Status is 'Enabled' or 'Enforced' for All Users","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-IAM-037"]}, "5.1.4": {"title":"Ensure that 'Allow users to remember multifactor authentication on devices they trust' is Disabled","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.1": {"title":"Ensure that Azure Admin Accounts Are Not Used for Daily Operations","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.2": {"title":"Ensure that Guest Users are Reviewed on a Regular Basis","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-IAM-004","AZ-IAM-005"]}, "5.3.3": {"title":"Ensure That Use of the 'User Access Administrator' Role is Restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-009"]}, "5.3.4": {"title":"Ensure that All 'Privileged' Role Assignments are Periodically Reviewed","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.5": {"title":"Ensure Disabled User Accounts do not Have Read, Write, or Owner Permissions","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-IAM-006"]}, "5.3.6": {"title":"Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed","level":"L1","assessment":"Manual","applicability":"manual"}, "5.3.7": {"title":"Ensure All Non-privileged Role Assignments are Periodically Reviewed","level":"L1","assessment":"Manual","applicability":"manual"}, "5.4": {"title":"Ensure that No Custom Subscription Administrator Roles Exist","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-008"]}, "5.5": {"title":"Ensure that a Dedicated Role is Assigned Permissions for Administering Resource Locks","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-GOV-005"]}, "5.6": {"title":"Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-GOV-011"]}, "5.7": {"title":"Ensure there are between 2 and 3 Subscription Owners","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-001"]}, "5.8": {"title":"Ensure the default management group for new subscriptions is not the root management group","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-GOV-015"]}, "5.9": {"title":"Ensure creating management groups requires write permission on the root management group","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-GOV-016"]}, "5.10": {"title":"Ensure Emergency Access Accounts Can Regain Azure Resource Access","level":"L1","assessment":"Manual","applicability":"manual"}, "5.11": {"title":"Ensure Service Principals Holding Azure Role Assignments Do Not Use Client Secrets","level":"L2","assessment":"Automated","coverage":"partial","tests":["AZ-IAM-013"]}, "5.12": {"title":"Ensure Role Assignment Management is Delegated with the 'Role Based Access Control Administrator' Role and Conditions","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-IAM-036"]}, "6.1.1.1": {"title":"Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-001"]}, "6.1.1.2": {"title":"Ensure Diagnostic Setting Captures Appropriate Categories","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-002"]}, "6.1.1.3": {"title":"Ensure the Storage Account Containing the Container with Activity Logs is Encrypted with Customer-managed Key (CMK)","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.1.4": {"title":"Ensure that Logging for Azure Key Vault is 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-014"]}, "6.1.1.5": {"title":"Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics (LEGACY)","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-LOG-023"]}, "6.1.1.6": {"title":"Ensure that Virtual Network Flow Logs are Captured and Sent to Log Analytics","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-LOG-018","AZ-LOG-020"]}, "6.1.1.7": {"title":"Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Graph Activity Logs to an Appropriate Destination","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.1.8": {"title":"Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Entra Activity Logs to an Appropriate Destination","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.1.9": {"title":"Ensure that Intune Logs are Captured and Sent to Log Analytics","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.2.1": {"title":"Ensure that Activity Log Alert Exists for Create Policy Assignment","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-003"]}, "6.1.2.2": {"title":"Ensure that Activity Log Alert exists for Delete Policy Assignment","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-004"]}, "6.1.2.3": {"title":"Ensure that Activity Log Alert Exists for Create or Update Network Security Group","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-005"]}, "6.1.2.4": {"title":"Ensure that Activity Log Alert Exists for Delete Network Security Group","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-006"]}, "6.1.2.5": {"title":"Ensure that Activity Log Alert Exists for Create or Update Security Solution","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-007"]}, "6.1.2.6": {"title":"Ensure that Activity Log Alert Exists for Delete Security Solution","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-008"]}, "6.1.2.7": {"title":"Ensure that Activity Log Alert Exists for Create or Update SQL Server Firewall Rule","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-009"]}, "6.1.2.8": {"title":"Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-010"]}, "6.1.2.9": {"title":"Ensure that Activity Log Alert Exists for Create or Update Public IP Address","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-011"]}, "6.1.2.10": {"title":"Ensure that Activity Log Alert Exists for Delete Public IP Address","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-012"]}, "6.1.2.11": {"title":"Ensure that an Activity Log Alert Exists for Service Health","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-013"]}, "6.1.2.12": {"title":"Ensure that Activity Log Alert Exists for Create Role Assignment","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-027"]}, "6.1.2.13": {"title":"Ensure that Activity Log Alert Exists for Delete Role Assignment","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-030"]}, "6.1.2.14": {"title":"Ensure that Activity Log Alert Exists for Create or Update Policy Exemption","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-031"]}, "6.1.2.15": {"title":"Ensure that Activity Log Alert Exists for Delete Diagnostic Setting","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-025"]}, "6.1.2.16": {"title":"Ensure that Activity Log Alert Exists for Delete Resource Lock","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-028"]}, "6.1.2.17": {"title":"Ensure that Activity Log Alert Exists for Update Key Vault Access Policy","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-032"]}, "6.1.3.1": {"title":"Ensure Application Insights are Configured","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-021"]}, "6.1.4": {"title":"Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-BATCH-005","AZ-COS-008","AZ-LOG-015"]}, "6.1.5": {"title":"Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA","level":"L2","assessment":"Manual","applicability":"manual"}, "6.1.6": {"title":"Ensure that 'Public Network Access' for Ingestion and Queries is 'Disabled' for Log Analytics Workspaces","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-034"]}, "6.2": {"title":"Ensure that Resource Locks are set for Mission-Critical Azure Resources","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-GOV-004","AZ-LOG-026"]}, "7.1.1": {"title":"Ensure that RDP Access from the Internet is Evaluated and Restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-001"]}, "7.1.2": {"title":"Ensure that WinRM Access from the Internet is Evaluated and Restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-029"]}, "7.1.3": {"title":"Ensure that HTTP(S) access from the Internet is evaluated and restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-004"]}, "7.1.4": {"title":"Ensure that UDP Port Access from the Internet is Evaluated and Restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-003"]}, "7.1.5": {"title":"Ensure that SSH Access from the Internet is Evaluated and Restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-002"]}, "7.1.6": {"title":"Ensure that Database Port Access from the Internet is Evaluated and Restricted","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-030"]}, "7.2.1": {"title":"Ensure 'HTTP2' is Set to 'Enabled' on Azure Application Gateway","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-014"]}, "7.2.2": {"title":"Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-013"]}, "7.2.3": {"title":"Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_3' on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-031"]}, "7.2.4": {"title":"Ensure Bot Protection is Enabled in Azure Web Application Firewall Policy on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-017"],"scope":"Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"}, "7.2.5": {"title":"Ensure Request Body Inspection is Enabled in Azure Web Application Firewall policy on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-016"],"scope":"Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"}, "7.2.6": {"title":"Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Application Gateway","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-012"]}, "7.3": {"title":"Ensure that Public IP Addresses are Evaluated on a Periodic Basis","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-GOV-007"]}, "7.4": {"title":"Ensure Subnets Are Associated with Network Security Groups","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-006"]}, "7.5": {"title":"Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-017"]}, "7.6": {"title":"Ensure that Virtual Network Flow Log Retention Days is Set to Greater than or Equal to 90","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-019"]}, "7.7": {"title":"Ensure 'Authentication type' is Set to 'Microsoft Entra ID' Only for Azure VPN Gateway Point-to-Site Configuration","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-021"]}, "7.8": {"title":"Ensure that Network Security Groups override the default 'VirtualNetwork' allow rules","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-032"]}, "7.9": {"title":"Ensure Azure Network Security Perimeter is Used to Secure Azure Platform-as-a-service Resources","level":"L2","assessment":"Manual","applicability":"manual"}, "7.10": {"title":"Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Front Door","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-018"]}, "7.11": {"title":"Ensure 'Default outbound access' is Set to 'Disabled' for Virtual Network Subnets","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-007"]}, "7.12": {"title":"Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90 (LEGACY)","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-LOG-022"]}, "8.1.1.1": {"title":"Ensure Microsoft Defender CSPM is Set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-001"]}, "8.1.2.1": {"title":"Ensure Microsoft Defender for APIs is Set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-012"]}, "8.1.3.1": {"title":"Ensure that Defender for Servers is Set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-002"]}, "8.1.3.2": {"title":"Ensure that 'Vulnerability assessment for machines' Component Status is set to 'On'","level":"L2","assessment":"Manual","coverage":"full","tests":["AZ-DEF-017"]}, "8.1.3.3": {"title":"Ensure that 'Endpoint protection' Component Status is set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-014"]}, "8.1.3.4": {"title":"Ensure that 'Agentless scanning for machines' Component Status is Set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-015"]}, "8.1.3.5": {"title":"Ensure that 'File Integrity Monitoring' Component Status is Set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-016"]}, "8.1.4.1": {"title":"Ensure That Microsoft Defender for Containers Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-003"]}, "8.1.5.1": {"title":"Ensure That Microsoft Defender for Storage Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-004"]}, "8.1.6.1": {"title":"Ensure That Microsoft Defender for App Services Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-005"]}, "8.1.7.1": {"title":"Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-006"]}, "8.1.7.2": {"title":"Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-007"]}, "8.1.7.3": {"title":"Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-008"]}, "8.1.7.4": {"title":"Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-009"]}, "8.1.8.1": {"title":"Ensure That Microsoft Defender for Key Vault Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-010"]}, "8.1.9.1": {"title":"Ensure That Microsoft Defender for Resource Manager Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-011"]}, "8.1.10.1": {"title":"Ensure That Microsoft Defender for AI Services Is Set To 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-013"]}, "8.1.10.2": {"title":"Ensure that 'Suspicious prompt evidence' Component Status is Set to 'On'","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-DEF-026"]}, "8.1.11": {"title":"Ensure that Microsoft Defender for Cloud is Configured to Check VM Operating Systems for Updates","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-VM-005"]}, "8.1.12": {"title":"Ensure Continuous Export of Microsoft Defender for Cloud alerts is configured to a SIEM","level":"L2","assessment":"Manual","coverage":"partial","tests":["AZ-DEF-023"]}, "8.1.13": {"title":"Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled'","level":"L1","assessment":"Manual","coverage":"full","tests":["AZ-GOV-001","AZ-GOV-002"]}, "8.1.14": {"title":"Ensure that Microsoft Defender for Cloud Sends Security Alert Emails to Users with the 'Owner' Role","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-019"]}, "8.1.15": {"title":"Ensure 'Additional email addresses' is Configured with a Security Contact Email","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-018"]}, "8.1.16": {"title":"Ensure that 'Notify about alerts with the following severity (or higher)' is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-020"]}, "8.1.17": {"title":"Ensure that 'Notify about attack paths with the following risk level (or higher)' is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-DEF-021"]}, "8.1.18": {"title":"Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is Enabled","level":"L2","assessment":"Manual","applicability":"manual"}, "8.2.1": {"title":"Ensure That Microsoft Defender for IoT Hub Is Set To 'On'","level":"L2","assessment":"Manual","applicability":"manual"}, "8.3.1.1": {"title":"Ensure that Azure Key Vault Managed HSM is Used when Required","level":"L2","assessment":"Manual","applicability":"manual"}, "8.3.1.2": {"title":"Ensure that Logging for Azure Key Vault Managed HSM is 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-LOG-033"]}, "8.3.1.3": {"title":"Ensure Keys in Azure Key Vault Premium are HSM-Protected","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-016"]}, "8.3.1.4": {"title":"Ensure 'Purge protection' is Set to 'Enabled' for Azure Key Vault Managed HSM","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-012"]}, "8.3.1.5": {"title":"Ensure 'Public Network Access' is 'Disabled' for Azure Key Vault Managed HSM","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-013"]}, "8.3.1.6": {"title":"Ensure Private Endpoints are Used to Access Azure Key Vault Managed HSM","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-014"]}, "8.3.2": {"title":"Ensure that the Expiration Date is Set for all Keys in Key Vaults using RBAC","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-005"]}, "8.3.3": {"title":"Ensure that the Expiration Date is set for All Keys in Key Vaults using access policies (legacy)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-010"]}, "8.3.4": {"title":"Ensure that the Expiration Date is set for All Secrets in Key Vaults using RBAC","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-006"]}, "8.3.5": {"title":"Ensure that the Expiration Date is set for All Secrets in Key Vaults using access policies (legacy)","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-011"]}, "8.3.6": {"title":"Ensure Certificate 'Validity Period (in months)' is Less Than or Equal to '12'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-008"]}, "8.3.7": {"title":"Ensure Automatic Key Rotation is Enabled within Azure Key Vault","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-007"]}, "8.3.8": {"title":"Ensure 'Purge protection' is Set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-001"]}, "8.3.9": {"title":"Ensure that Role Based Access Control for Azure Key Vault is Enabled","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-002"]}, "8.3.10": {"title":"Ensure the Default Network Access Rule for Key Vaults is Set to Deny","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-015"]}, "8.3.11": {"title":"Ensure Public Network Access is Disabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-KV-003"]}, "8.3.12": {"title":"Ensure Private Endpoints are Used to Access Azure Key Vault","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-KV-004"]}, "8.4.1": {"title":"Ensure an Azure Bastion Host Exists","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-011"]}, "8.4.2": {"title":"Ensure 'Shareable Link' is Disabled on Azure Bastion Hosts","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-027"]}, "8.5": {"title":"Ensure Azure DDoS Protection is Enabled on Public IP Addresses","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-NET-033"]}, "8.6": {"title":"Ensure Azure DDoS Network Protection is Enabled on Virtual Networks","level":"L2","assessment":"Automated","coverage":"full","tests":["AZ-NET-010"]}, "9.1.1": {"title":"Ensure That Soft Delete for Blobs on Azure Blob Storage Storage Accounts is Enabled","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-014"]}, "9.2.1.1": {"title":"Ensure that 'Public Network Access' is 'Disabled' for Storage Accounts","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-006"]}, "9.2.1.2": {"title":"Ensure Default Network Access Rule for Storage Accounts is Set to Deny","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-007"]}, "9.2.2.1": {"title":"Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is Set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-011"]}, "9.2.3": {"title":"Ensure that 'Secure transfer required' is Set to 'Enabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-001"]}, "9.2.4": {"title":"Ensure the 'Minimum TLS version' for Storage Accounts is Set to 'Version 1.2'","level":"L1","assessment":"Automated","coverage":"partial","tests":["AZ-STG-002"]}, "9.2.5": {"title":"Ensure that 'Allow Blob anonymous access' is Set to 'Disabled'","level":"L1","assessment":"Automated","coverage":"full","tests":["AZ-STG-003"]} } } |