{
    "A maximum of 3 owners should be designated for your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Protect and limit highly privileged users",
                "requirement_id": "PA-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Separate user functionality from system management functionality.",
                "requirement_id": "SC.3.181"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "The information system employs replay-resistant authentication mechanisms such as nonce, one-time passwords, or time stamps to secure network access for privileged accounts; and, for hardware token-based authentication, employs mechanisms that satisfy minimum token requirements discussed in NIST SP 800-63-2, Electronic Authentication Guideline.",
                "requirement_id": "ID : 11112.01q2Organizational.67 - 01.q"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Organization of information security",
                "requirement": "Segregation of Duties",
                "requirement_id": "A.6.1.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Separate the duties of individuals to reduce the risk of malevolent activity without collusion.",
                "requirement_id": "3.1.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Least Privilege | Review of User Privileges",
                "requirement_id": "AC-6 (7)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.32 System User Identification",
                "requirement_id": "AC-2"
            }
        },
        "description": "It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json",
        "github_version": "3.0.0",
        "name": "A maximum of 3 owners should be designated for your subscription",
        "policy_id": "4f11b553-d42e-4e3a-89be-32ca364cad4c",
        "service_name": "Security Center"
    },
    "A vulnerability assessment solution should be enabled on your virtual machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Perform software vulnerability assessments",
                "requirement_id": "PV-6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Assessment",
                "requirement": "Remediate vulnerabilities in accordance with risk assessments.",
                "requirement_id": "RM.2.143"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "A technical vulnerability management program is in place to monitor, assess, rank, and remediate vulnerabilities identified in systems.",
                "requirement_id": "ID : 0711.10m2Organizational.23 - 10.m"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Management of technical vulnerabilities",
                "requirement_id": "A.12.6.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Flaw Remediation",
                "requirement_id": "SI-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json",
        "github_version": "3.0.0",
        "name": "A vulnerability assessment solution should be enabled on your virtual machines",
        "policy_id": "501541f7-f7e7-4cd6-868c-4190fdad3ac9",
        "service_name": "Security Center"
    },
    "API App should only be accessible over HTTPS": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",
                "requirement_id": "ID : 0949.09y2Organizational.5 - 09.y"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "3.13.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection",
                "requirement_id": "SC-8 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Software security",
                "requirement": "14.5.8 Web applications",
                "requirement_id": "SS-8"
            }
        },
        "description": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json",
        "github_version": "1.0.0",
        "name": "API App should only be accessible over HTTPS",
        "policy_id": "b7ddfbdc-1260-477d-91fd-98bd9be789a6",
        "service_name": "App Service"
    },
    "API Management services should use a virtual network": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            }
        },
        "description": "Azure Virtual Network deployment provides enhanced security, isolation and allows you to place your API Management service in a non-internet routable network that you control access to. These networks can then be connected to your on-premises networks using various VPN technologies, which enables access to your backend services within the network and/or on-premises. The developer portal and API gateway, can be configured to be accessible either from the Internet or only within the virtual network.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20Management/ApiManagement_VNETEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "API Management services should use a virtual network",
        "policy_id": "ef619a2c-cc4d-4d03-b2ba-8c94a834d85b",
        "service_name": "API Management"
    },
    "Activity log should be retained for at least one year": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.6.13 Event log archives",
                "requirement_id": "AC-15"
            }
        },
        "description": "This policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLogRetention_365orGreater.json",
        "github_version": "1.0.0",
        "name": "Activity log should be retained for at least one year",
        "policy_id": "b02aacc0-b073-424e-8298-42b22829ee0a",
        "service_name": "Monitoring"
    },
    "Adaptive application controls for defining safe applications should be enabled on your machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Asset Management",
                "requirement": "Use only approved applications in compute resources",
                "requirement_id": "AM-6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.",
                "requirement_id": "CM.3.069"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Operational Software",
                "requirement": "The organization uses its configuration control program to maintain control of all implemented software and its system documentation and archive prior versions of implemented software and associated system documentation.",
                "requirement_id": "ID : 0607.10h2System.23 - 10.h"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Restrictions on software installation",
                "requirement_id": "A.12.6.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Configuration Management",
                "requirement": "Control and monitor user-installed software.",
                "requirement_id": "3.4.9"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Configuration Management",
                "requirement": "User-Installed Software",
                "requirement_id": "CM-11"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Software security",
                "requirement": "14.2.4 Application Whitelisting",
                "requirement_id": "SS-4"
            }
        },
        "description": "Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json",
        "github_version": "3.0.0",
        "name": "Adaptive application controls for defining safe applications should be enabled on your machines",
        "policy_id": "47a6b606-51aa-4496-8bb7-64b11cf66adc",
        "service_name": "Security Center"
    },
    "Adaptive network hardening recommendations should be applied on internet facing virtual machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization ensures the security of information in networks, availability of network services and information services using the network, and the protection of connected services from unauthorized access.",
                "requirement_id": "ID : 0859.09m1Organizational.78 - 09.m"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.",
                "requirement_id": "3.13.5"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Boundary Protection",
                "requirement_id": "SC-7"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.1.13 Limiting network access",
                "requirement_id": "NS-2"
            }
        },
        "description": "Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json",
        "github_version": "3.0.0",
        "name": "Adaptive network hardening recommendations should be applied on internet facing virtual machines",
        "policy_id": "08e6af2d-db70-460a-bfe9-d5bd474ba9d6",
        "service_name": "Security Center"
    },
    "Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "IA.2.081"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "3.5.10"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",
        "effects": "modify",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json",
        "github_version": "1.0.0",
        "name": "Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity",
        "policy_id": "497dff13-db2a-4c0f-8603-28fa3b331ab6",
        "service_name": "Guest Configuration"
    },
    "Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "IA.2.081"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "3.5.10"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",
        "effects": "modify",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json",
        "github_version": "1.0.0",
        "name": "Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities",
        "policy_id": "3cf2ab00-13f1-4d0c-8971-2ac904541a7e",
        "service_name": "Guest Configuration"
    },
    "Advanced data security should be enabled on SQL Managed Instance": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'",
                "requirement_id": "4.2.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "3.14.6"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Information System Monitoring",
                "requirement_id": "SI-4"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Audit each SQL Managed Instance without advanced data security.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json",
        "github_version": "1.0.1",
        "name": "Advanced data security should be enabled on SQL Managed Instance",
        "policy_id": "abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9",
        "service_name": "SQL"
    },
    "Advanced data security should be enabled on your SQL servers": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'",
                "requirement_id": "4.2.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "3.14.6"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Information System Monitoring",
                "requirement_id": "SI-4"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Audit SQL servers without Advanced Data Security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json",
        "github_version": "2.0.0",
        "name": "Advanced data security should be enabled on your SQL servers",
        "policy_id": "abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9",
        "service_name": "SQL"
    },
    "All Internet traffic should be routed via your deployed Azure Firewall": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Deploy intrusion detection/intrusion prevention systems (IDS/IPS)",
                "requirement_id": "NS-5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.4.10 Malicious code counter-measures",
                "requirement_id": "NS-7"
            }
        },
        "description": "Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json",
        "github_version": "3.0.0-preview",
        "name": "All Internet traffic should be routed via your deployed Azure Firewall",
        "policy_id": "fc5e4038-4584-4632-8c85-c0448d374b2c",
        "service_name": "Network"
    },
    "All network ports should be restricted on network security groups associated to your virtual machine": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization monitors for all authorized and unauthorized wireless access to the information system and prohibits installation of wireless access points (WAPs) unless explicitly authorized in writing by the CIO or his/her designated representative.",
                "requirement_id": "ID : 0858.09m1Organizational.4 - 09.m"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Communications security",
                "requirement": "Network controls",
                "requirement_id": "A.13.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.",
                "requirement_id": "3.13.5"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Boundary Protection",
                "requirement_id": "SC-7"
            }
        },
        "description": "Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json",
        "github_version": "3.0.0",
        "name": "All network ports should be restricted on network security groups associated to your virtual machine",
        "policy_id": "9daedab3-fb2d-461e-b861-71790eead4f6",
        "service_name": "Security Center"
    },
    "Allowed locations": {
        "benchmarks": {
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Enterprise systems security",
                "requirement": "22.1.22 Offshore Services",
                "requirement_id": "ESS-2"
            }
        },
        "description": "This policy enables you to restrict the locations your organization can specify when deploying resources. Use to enforce your geo-compliance requirements. Excludes resource groups, Microsoft.AzureActiveDirectory/b2cDirectories, and resources that use the 'global' region.",
        "effects": "deny",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/AllowedLocations_Deny.json",
        "github_version": "1.0.0",
        "name": "Allowed locations",
        "policy_id": "e56962a6-4747-49cd-b67b-bf8b01975c4c",
        "service_name": "General"
    },
    "Allowed locations for resource groups": {
        "benchmarks": {
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Enterprise systems security",
                "requirement": "22.1.22 Offshore Services",
                "requirement_id": "ESS-2"
            }
        },
        "description": "This policy enables you to restrict the locations your organization can create resource groups in. Use to enforce your geo-compliance requirements.",
        "effects": "deny",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/ResourceGroupAllowedLocations_Deny.json",
        "github_version": "1.0.0",
        "name": "Allowed locations for resource groups",
        "policy_id": "e765b5de-1225-4ba3-bd56-1ac6695af988",
        "service_name": "General"
    },
    "Allowlist rules in your adaptive application control policy should be updated": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",
                "requirement_id": "CM.3.068"
            }
        },
        "description": "Monitor for changes in behavior on groups of machines configured for auditing by Azure Security Center's adaptive application controls. Security Center uses machine learning to analyze the running processes on your machines and suggest a list of known-safe applications. These are presented as recommended apps to allow in adaptive application control policies.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControlsUpdate_Audit.json",
        "github_version": "3.0.0",
        "name": "Allowlist rules in your adaptive application control policy should be updated",
        "policy_id": "123a3936-f020-408a-ba0c-47873faf1534",
        "service_name": "Security Center"
    },
    "An Azure Active Directory administrator should be provisioned for SQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Standardize Azure Active Directory as the central identity and authentication system",
                "requirement_id": "IM-1"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that Azure Active Directory Admin is configured",
                "requirement_id": "4.4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Separate user functionality from system management functionality.",
                "requirement_id": "SC.3.181"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Management of privileged access rights",
                "requirement_id": "A.9.2.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management | Role-Based Schemes",
                "requirement_id": "AC-2 (7)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json",
        "github_version": "1.0.0",
        "name": "An Azure Active Directory administrator should be provisioned for SQL servers",
        "policy_id": "1f314764-cb73-4fc9-b863-8eca98ac36e9",
        "service_name": "SQL"
    },
    "An activity log alert should exist for specific Administrative operations": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule",
                "requirement_id": "5.2.9"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Administrator and Operator Logs",
                "requirement": "An intrusion detection system managed outside of the control of system and network administrators is used to monitor system and network administration activities for compliance.",
                "requirement_id": "ID : 1271.09ad1System.1 - 09.ad"
            }
        },
        "description": "This policy audits specific Administrative operations with no activity log alerts configured.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json",
        "github_version": "1.0.0",
        "name": "An activity log alert should exist for specific Administrative operations",
        "policy_id": "b954148f-4c11-4c38-8221-be76711e194a",
        "service_name": "Monitoring"
    },
    "An activity log alert should exist for specific Policy operations": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Activity Log Alert exists for Delete Policy Assignment",
                "requirement_id": "5.2.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            }
        },
        "description": "This policy audits specific Policy operations with no activity log alerts configured.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json",
        "github_version": "3.0.0",
        "name": "An activity log alert should exist for specific Policy operations",
        "policy_id": "c5447c04-a4d7-4ba8-a263-c9ee321a6858",
        "service_name": "Monitoring"
    },
    "An activity log alert should exist for specific Security operations": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Activity Log Alert exists for Delete Security Solution",
                "requirement_id": "5.2.8"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            }
        },
        "description": "This policy audits specific Security operations with no activity log alerts configured.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json",
        "github_version": "1.0.0",
        "name": "An activity log alert should exist for specific Security operations",
        "policy_id": "3b980d31-7904-4bb7-8575-5665739a8052",
        "service_name": "Monitoring"
    },
    "App Configuration should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your app configuration instances instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/appconfig/private-endpoint .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Configuration/PrivateLink_Audit.json",
        "github_version": "1.0.2",
        "name": "App Configuration should use private link",
        "policy_id": "ca610c1d-041c-4332-9d88-7ed3094967c7",
        "service_name": "App Configuration"
    },
    "App Service should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "To identify and authenticate devices on local and/or wide area networks, including wireless networks,  the information system uses either a (i) shared known information solution or (ii) an organizational authentication solution, the exact selection and strength of which is dependent on the security categorization of the information system.",
                "requirement_id": "ID : 0861.09m2Organizational.67 - 09.m"
            }
        },
        "description": "This policy audits any App Service not configured to use a virtual network service endpoint.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_AppService_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "App Service should use a virtual network service endpoint",
        "policy_id": "2d21331d-a4c2-4def-a9ad-ee4e1e023beb",
        "service_name": "Network"
    },
    "Audit Dependency agent deployment - VM Image (OS) unlisted": {
        "benchmarks": {
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Clock Synchronization",
                "requirement_id": "A.12.4.4"
            }
        },
        "description": "Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_Audit.json",
        "github_version": "1.0.1",
        "name": "Audit Dependency agent deployment - VM Image (OS) unlisted",
        "policy_id": "11ac78e3-31bc-4f0c-8434-37ab963cea07",
        "service_name": "Monitoring"
    },
    "Audit Dependency agent deployment in virtual machine scale sets - VM Image (OS) unlisted": {
        "benchmarks": {
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Clock Synchronization",
                "requirement_id": "A.12.4.4"
            }
        },
        "description": "Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_VMSS_Audit.json",
        "github_version": "1.0.1",
        "name": "Audit Dependency agent deployment in virtual machine scale sets - VM Image (OS) unlisted",
        "policy_id": "e2dd799a-a932-4e9d-ac17-d473bc3c6c10",
        "service_name": "Monitoring"
    },
    "Audit Linux machines that allow remote connections from accounts without passwords": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Monitor and control remote access sessions.",
                "requirement_id": "AC.2.013"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Access to networks and network services",
                "requirement_id": "A.9.1.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Monitor and control remote access sessions.",
                "requirement_id": "3.1.12"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Remote Access | Automated Monitoring / Control",
                "requirement_id": "AC-17 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.32 System User Identification",
                "requirement_id": "AC-2"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Linux machines that allow remote connections from accounts without passwords",
        "policy_id": "ea53dbee-c6c9-4f0e-9f9e-de0039b78023",
        "service_name": "Guest Configuration"
    },
    "Audit Linux machines that do not have the passwd file permissions set to 0644": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",
                "requirement_id": "IA.1.077"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Management of secret authentication information of users",
                "requirement_id": "A.9.2.4"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "3.5.10"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management",
                "requirement_id": "IA-5"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that do not have the passwd file permissions set to 0644",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword121_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Linux machines that do not have the passwd file permissions set to 0644",
        "policy_id": "e6955644-301c-44b5-a4c4-528577de6861",
        "service_name": "Guest Configuration"
    },
    "Audit Linux machines that have accounts without passwords": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Enforce a minimum password complexity and change of characters when new passwords are created.",
                "requirement_id": "IA.2.078"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Access to networks and network services",
                "requirement_id": "A.9.1.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Enforce a minimum password complexity and change of characters when new passwords are created.",
                "requirement_id": "3.5.7"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management",
                "requirement_id": "IA-5"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.32 System User Identification",
                "requirement_id": "AC-2"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Linux machines that have accounts without passwords",
        "policy_id": "f6ec09a3-78bf-4f8f-99dc-6c77182d0f99",
        "service_name": "Guest Configuration"
    },
    "Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Clock Synchronization",
                "requirement_id": "A.12.4.4"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",
                "requirement_id": "3.3.2"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Information System Monitoring",
                "requirement_id": "SI-4"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.6.7 Content of system management logs",
                "requirement_id": "AC-14"
            }
        },
        "description": "Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json",
        "github_version": "1.0.1",
        "name": "Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted",
        "policy_id": "5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138",
        "service_name": "Monitoring"
    },
    "Audit Log Analytics workspace for VM - Report Mismatch": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",
                "requirement_id": "3.3.2"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Information System Monitoring",
                "requirement_id": "SI-4"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.6.7 Content of system management logs",
                "requirement_id": "AC-14"
            }
        },
        "description": "Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.",
        "effects": "audit",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json",
        "github_version": "1.0.1",
        "name": "Audit Log Analytics workspace for VM - Report Mismatch",
        "policy_id": "f47b5582-33ec-4c5c-87c0-b010a6b2e917",
        "service_name": "Monitoring"
    },
    "Audit VMs that do not use managed disks": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Virtual Machines",
                "requirement": "Ensure Virtual Machines are utilizing Managed Disks",
                "requirement_id": "7.1"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Access to networks and network services",
                "requirement_id": "A.9.1.2"
            }
        },
        "description": "This policy audits VMs that do not use managed disks",
        "effects": "audit",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VMRequireManagedDisk_Audit.json",
        "github_version": "1.0.0",
        "name": "Audit VMs that do not use managed disks",
        "policy_id": "06a78e20-9358-41c9-923c-fb736d382a4d",
        "service_name": "Compute"
    },
    "Audit Windows machines missing any of specified members in the Administrators group": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Separate the duties of individuals to reduce the risk of malevolent activity without collusion.",
                "requirement_id": "AC.3.017"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "Where tokens are provided for multi-factor authentication, in-person verification is required prior to granting access.",
                "requirement_id": "ID : 1127.01q2System.3 - 01.q"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Separate the duties of individuals to reduce the risk of malevolent activity without collusion.",
                "requirement_id": "3.1.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Least Privilege | Review of User Privileges",
                "requirement_id": "AC-6 (7)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.3.5 Use of Privileged Accounts",
                "requirement_id": "AC-9"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines missing any of specified members in the Administrators group",
        "policy_id": "30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines on which the Log Analytics agent is not connected as expected": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Monitoring System Use",
                "requirement": "Alerts are generated for technical personnel to analyze and investigate suspicious activity or suspected violations.",
                "requirement_id": "ID : 1217.09ab3System.3 - 09.ab"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the agent is not installed, or if it is installed but the COM object AgentConfigManager.MgmtSvcCfg returns that it is registered to a workspace other than the ID specified in the policy parameter.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsLogAnalyticsAgentConnection_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines on which the Log Analytics agent is not connected as expected",
        "policy_id": "6265018c-d7e2-432f-a75d-094d5f6f4465",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that allow re-use of the previous 24 passwords": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Prohibit password reuse for a specified number of generations.",
                "requirement_id": "IA.2.079"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Password management system",
                "requirement_id": "A.9.4.3"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Prohibit password reuse for a specified number of generations.",
                "requirement_id": "3.5.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that allow re-use of the previous 24 passwords",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEnforce_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that allow re-use of the previous 24 passwords",
        "policy_id": "5b054a0d-39e2-4d53-bea3-9734cad2c69b",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that do not contain the specified certificates in Trusted Root": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "Protocols used to communicate between all involved parties are secured using cryptographic techniques (e.g., SSL).",
                "requirement_id": "ID : 0945.09y1Organizational.3 - 09.y"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the machine Trusted Root certificate store (Cert:\\LocalMachine\\Root) does not contain one or more of the certificates listed by the policy parameter.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsCertificateInTrustedRoot_AINE.json",
        "github_version": "1.0.1",
        "name": "Audit Windows machines that do not contain the specified certificates in Trusted Root",
        "policy_id": "934345e1-4dfb-4c70-90d7-41990dc9608b",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that do not have a maximum password age of 70 days": {
        "benchmarks": {
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Password management system",
                "requirement_id": "A.9.4.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have a maximum password age of 70 days",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsMaximumPassword_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that do not have a maximum password age of 70 days",
        "policy_id": "4ceb8dc2-559c-478b-a15b-733fbf1e3738",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that do not have a minimum password age of 1 day": {
        "benchmarks": {
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Password management system",
                "requirement_id": "A.9.4.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have a minimum password age of 1 day",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsMinimumPassword_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that do not have a minimum password age of 1 day",
        "policy_id": "237b38db-ca4d-4259-9e47-7882441ca2c0",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that do not have the password complexity setting enabled": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Enforce a minimum password complexity and change of characters when new passwords are created.",
                "requirement_id": "IA.2.078"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Password management system",
                "requirement_id": "A.9.4.3"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Enforce a minimum password complexity and change of characters when new passwords are created.",
                "requirement_id": "3.5.7"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have the password complexity setting enabled",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordComplexity_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that do not have the password complexity setting enabled",
        "policy_id": "bf16e0bb-31e1-4646-8202-60a235cc7e74",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that do not restrict the minimum password length to 14 characters": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Enforce a minimum password complexity and change of characters when new passwords are created.",
                "requirement_id": "IA.2.078"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Password management system",
                "requirement_id": "A.9.4.3"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Enforce a minimum password complexity and change of characters when new passwords are created.",
                "requirement_id": "3.5.7"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not restrict the minimum password length to 14 characters",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordLength_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that do not restrict the minimum password length to 14 characters",
        "policy_id": "a2d0e922-65d0-40c4-8f87-ea6da2d307a2",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that do not store passwords using reversible encryption": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "3.5.10"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that do not store passwords using reversible encryption",
        "policy_id": "da0f98fe-a24b-4ad5-af69-bd0400233661",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that have extra accounts in the Administrators group": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "Users who performed privileged functions (e.g., system administration) use separate accounts when performing those privileged functions.",
                "requirement_id": "ID : 1123.01q1System.2 - 01.q"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.3.5 Use of Privileged Accounts",
                "requirement_id": "AC-9"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains members that are not listed in the policy parameter.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembers_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that have extra accounts in the Administrators group",
        "policy_id": "3d2a3320-2a72-4c67-ac5f-caa40fbee2b2",
        "service_name": "Guest Configuration"
    },
    "Audit Windows machines that have the specified members in the Administrators group": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Separate user functionality from system management functionality.",
                "requirement_id": "SC.3.181"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "Multi-factor authentication methods are used in accordance with organizational policy, (e.g., for remote network access).",
                "requirement_id": "ID : 1125.01q2System.1 - 01.q"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Separate the duties of individuals to reduce the risk of malevolent activity without collusion.",
                "requirement_id": "3.1.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Least Privilege | Review of User Privileges",
                "requirement_id": "AC-6 (7)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.3.5 Use of Privileged Accounts",
                "requirement_id": "AC-9"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json",
        "github_version": "1.0.0",
        "name": "Audit Windows machines that have the specified members in the Administrators group",
        "policy_id": "69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f",
        "service_name": "Guest Configuration"
    },
    "Audit diagnostic setting": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Protect audit information and audit logging tools from unauthorized access, modification, and deletion.",
                "requirement_id": "AU.3.049"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender.",
                "requirement_id": "ID : 1210.09aa3System.3 - 09.aa"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Clock Synchronization",
                "requirement_id": "A.12.4.4"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Alert in the event of an audit logging process failure.",
                "requirement_id": "3.3.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Audit and Accountability",
                "requirement": "Audit Generation",
                "requirement_id": "AU-12"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Audit diagnostic setting for selected resource types",
        "effects": "AuditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json",
        "github_version": "1.0.0",
        "name": "Audit diagnostic setting",
        "policy_id": "7f89b1eb-583c-429a-8828-af049802c1d9",
        "service_name": "Monitoring"
    },
    "Audit usage of custom RBAC rules": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Follow just enough administration (least privilege principle)",
                "requirement_id": "PA-7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.",
                "requirement_id": "AC.3.018"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation of Duties",
                "requirement": "No single person is able to access, modify, or use information systems without authorization or detection.",
                "requirement_id": "ID : 1230.09c2Organizational.1 - 09.c"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Management of privileged access rights",
                "requirement_id": "A.9.2.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management | Role-Based Schemes",
                "requirement_id": "AC-2 (7)"
            }
        },
        "description": "Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json",
        "github_version": "1.0.0",
        "name": "Audit usage of custom RBAC rules",
        "policy_id": "a451c1ef-c6ca-483d-87ed-f49761e3ffb5",
        "service_name": "General"
    },
    "Audit virtual machines without disaster recovery configured": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Recovery",
                "requirement": "Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",
                "requirement_id": "RE.3.139"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Business Continuity and Risk Assessment",
                "requirement": "Business continuity risk assessments (i) are carried out annually with full involvement from owners of business resources and processes; (ii) consider all business processes and is not limited to the information assets, but includes the results specific to information security; and (iii) identifies, quantifies, and prioritizes risks against key business objectives and criteria relevant to the organization, including critical resources, impacts of disruptions, allowable outage times, and recovery priorities.",
                "requirement_id": "ID : 1638.12b2Organizational.345 - 12.b"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Contingency Planning",
                "requirement": "Alternate Processing Site",
                "requirement_id": "CP-7"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Enterprise systems security",
                "requirement": "22.1.26 Backup, Recovery Archiving and Data Remanence",
                "requirement_id": "ESS-3"
            }
        },
        "description": "Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json",
        "github_version": "1.0.0",
        "name": "Audit virtual machines without disaster recovery configured",
        "policy_id": "0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56",
        "service_name": "Compute"
    },
    "Auditing on SQL server should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that 'Auditing' is set to 'On'",
                "requirement_id": "4.1.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Security Assessment",
                "requirement": "Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.",
                "requirement_id": "CA.3.161"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "The organization verifies every ninety (90) days for each extract of covered information recorded that the data is erased or its use is still required.",
                "requirement_id": "ID : 1211.09aa3System.4 - 09.aa"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Clock Synchronization",
                "requirement_id": "A.12.4.4"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Alert in the event of an audit logging process failure.",
                "requirement_id": "3.3.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Audit and Accountability",
                "requirement": "Audit Generation",
                "requirement_id": "AU-12"
            }
        },
        "description": "Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json",
        "github_version": "2.0.0",
        "name": "Auditing on SQL server should be enabled",
        "policy_id": "a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9",
        "service_name": "SQL"
    },
    "Authentication should be enabled on your API app": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure App Service Authentication is set on Azure App Service",
                "requirement_id": "9.1"
            }
        },
        "description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the API app, or authenticate those that have tokens before they reach the API app",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Authentication_ApiApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Authentication should be enabled on your API app",
        "policy_id": "c4ebc54a-46e1-481a-bee2-d4411e95d828",
        "service_name": "App Service"
    },
    "Authentication should be enabled on your Function app": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure App Service Authentication is set on Azure App Service",
                "requirement_id": "9.1"
            }
        },
        "description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the Function app, or authenticate those that have tokens before they reach the Function app",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Authentication_functionapp_Audit.json",
        "github_version": "1.0.0",
        "name": "Authentication should be enabled on your Function app",
        "policy_id": "c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8",
        "service_name": "App Service"
    },
    "Authentication should be enabled on your web app": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure App Service Authentication is set on Azure App Service",
                "requirement_id": "9.1"
            }
        },
        "description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the web app, or authenticate those that have tokens before they reach the web app",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Authentication_WebApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Authentication should be enabled on your web app",
        "policy_id": "95bccee9-a7f8-4bec-9ee9-62c3473701fc",
        "service_name": "App Service"
    },
    "Authorized IP ranges should be defined on Kubernetes Services": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            }
        },
        "description": "Restrict access to the Kubernetes Service Management API by granting API access only to IP addresses in specific ranges. It is recommended to limit access to authorized IP ranges to ensure that only applications from allowed networks can access the cluster.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableIpRanges_KubernetesService_Audit.json",
        "github_version": "2.0.1",
        "name": "Authorized IP ranges should be defined on Kubernetes Services",
        "policy_id": "0e246bcf-5f6f-4f87-bc6f-775d4712c7ea",
        "service_name": "Security Center"
    },
    "Auto provisioning of the Log Analytics agent should be enabled on your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Centralize security log management and analysis",
                "requirement_id": "LT-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that 'Automatic provisioning of monitoring agent' is set to 'On'",
                "requirement_id": "2.11"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Monitoring System Use",
                "requirement": "Monitoring includes inbound and outbound communications and file integrity monitoring.",
                "requirement_id": "ID : 1220.09ab3System.56 - 09.ab"
            }
        },
        "description": "To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Automatic_provisioning_log_analytics_monitoring_agent.json",
        "github_version": "1.0.1",
        "name": "Auto provisioning of the Log Analytics agent should be enabled on your subscription",
        "policy_id": "475aae12-b88a-4572-8b36-9b712b2b3a17",
        "service_name": "Security Center"
    },
    "Automation account variables should be encrypted": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            }
        },
        "description": "It is important to enable encryption of Automation account variable assets when storing sensitive data",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json",
        "github_version": "1.1.0",
        "name": "Automation account variables should be encrypted",
        "policy_id": "3657f5a0-770e-44a3-b44e-9431ba1e9735",
        "service_name": "Automation"
    },
    "Azure API for FHIR should use a customer-managed key to encrypt data at rest": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Use a customer-managed key to control the encryption at rest of the data stored in Azure API for FHIR when this is a regulatory or compliance requirement. Customer-managed keys also deliver double encryption by adding a second layer of encryption on top of the default one done with service-managed keys.",
        "effects": "audit, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_EnableByok_Audit.json",
        "github_version": "1.0.1",
        "name": "Azure API for FHIR should use a customer-managed key to encrypt data at rest",
        "policy_id": "051cba44-2429-45b9-9649-46cec11c7119",
        "service_name": "API for FHIR"
    },
    "Azure Backup should be enabled for Virtual Machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Encrypt backup data",
                "requirement_id": "BR-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Recovery",
                "requirement": "Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",
                "requirement_id": "RE.3.139"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Back-up",
                "requirement": "Workforce members roles and responsibilities in the data backup process are identified and communicated to the workforce; in particular, Bring Your Own Device (BYOD) users are required to perform backups of organizational and/or client data on their devices.",
                "requirement_id": "ID : 1699.09l1Organizational.10 - 09.l"
            }
        },
        "description": "Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json",
        "github_version": "1.0.1",
        "name": "Azure Backup should be enabled for Virtual Machines",
        "policy_id": "013e242c-8828-4970-87b3-ab247555486d",
        "service_name": "Backup"
    },
    "Azure Cache for Redis should reside within a virtual network": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Connect private networks together",
                "requirement_id": "NS-2"
            }
        },
        "description": "Azure Virtual Network deployment provides enhanced security and isolation for your Azure Cache for Redis, as well as subnets, access control policies, and other features to further restrict access.When an Azure Cache for Redis instance is configured with a virtual network, it is not publicly addressable and can only be accessed from virtual machines and applications within the virtual network.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_CacheInVnet_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Cache for Redis should reside within a virtual network",
        "policy_id": "7d092e0a-7acd-40d2-a975-dca21cae48c4",
        "service_name": "Cache"
    },
    "Azure Cosmos DB accounts should have firewall rules": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            }
        },
        "description": "Firewall rules should be defined on your Azure Cosmos DB accounts to prevent traffic from unauthorized sources. Accounts that have at least one IP rule defined with the virtual network filter enabled are deemed compliant. Accounts disabling public access are also deemed compliant.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/Cosmos_NetworkRulesExist_Audit.json",
        "github_version": "1.0.1",
        "name": "Azure Cosmos DB accounts should have firewall rules",
        "policy_id": "862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb",
        "service_name": "Cosmos DB"
    },
    "Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            }
        },
        "description": "Use customer-managed keys to manage the encryption at rest of your Azure Cosmos DB. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/cosmosdb-cmk .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/Cosmos_CMK_Deny.json",
        "github_version": "1.0.2",
        "name": "Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest",
        "policy_id": "1f905d99-2ab7-462c-a6b0-f709acca6c8f",
        "service_name": "Cosmos DB"
    },
    "Azure DDoS Protection Standard should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Denial of Service Protection",
                "requirement_id": "SC-5"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.3.19 Content of a Denial of Service (DoS) response plan",
                "requirement_id": "NS-5"
            }
        },
        "description": "DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableDDoSProtection_Audit.json",
        "github_version": "3.0.0",
        "name": "Azure DDoS Protection Standard should be enabled",
        "policy_id": "a7aca53f-2ed4-4466-a25e-0b45ade68efd",
        "service_name": "Security Center"
    },
    "Azure Data Box jobs should enable double encryption for data at rest on the device": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "Enable a second layer of software-based encryption for data at rest on the device. The device is already protected via Advanced Encryption Standard 256-bit encryption for data at rest. This option adds a second layer of data encryption.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Box/DataBox_DoubleEncryption_Audit.json",
        "github_version": "1.0.0",
        "name": "Azure Data Box jobs should enable double encryption for data at rest on the device",
        "policy_id": "c349d81b-9985-44ae-a8da-ff98d108ede8",
        "service_name": "Data Box"
    },
    "Azure Data Explorer encryption at rest should use a customer-managed key": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Enabling encryption at rest using a customer-managed key on your Azure Data Explorer cluster provides additional control over the key being used by the encryption at rest. This feature is oftentimes applicable to customers with special compliance requirements and requires a Key Vault to managing the keys.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_CMK.json",
        "github_version": "1.0.0",
        "name": "Azure Data Explorer encryption at rest should use a customer-managed key",
        "policy_id": "81e74cea-30fd-40d5-802f-d72103c2aaaa",
        "service_name": "Azure Data Explorer"
    },
    "Azure Defender for App Service should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for App Service",
                "requirement_id": "2.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Defender for App Service should be enabled",
        "policy_id": "2913021d-f2fd-4f3d-b958-22354e2bdbcb",
        "service_name": "Security Center"
    },
    "Azure Defender for Azure SQL Database servers should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for Azure SQL database servers",
                "requirement_id": "2.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json",
        "github_version": "1.0.2",
        "name": "Azure Defender for Azure SQL Database servers should be enabled",
        "policy_id": "7fe3b40f-802b-4cdd-8bd4-fd799c948cc2",
        "service_name": "Security Center"
    },
    "Azure Defender for Key Vault should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for Key Vault",
                "requirement_id": "2.8"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Defender for Key Vault should be enabled",
        "policy_id": "0e6763cc-5078-4e64-889d-ff4d9a839047",
        "service_name": "Security Center"
    },
    "Azure Defender for Kubernetes should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for Kubernetes",
                "requirement_id": "2.6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Defender for Kubernetes should be enabled",
        "policy_id": "523b5cd1-3e23-492f-a539-13118b6d1e3a",
        "service_name": "Security Center"
    },
    "Azure Defender for SQL servers on machines should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for SQL servers on machines",
                "requirement_id": "2.4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json",
        "github_version": "1.0.2",
        "name": "Azure Defender for SQL servers on machines should be enabled",
        "policy_id": "6581d072-105e-4418-827f-bd446d56421b",
        "service_name": "Security Center"
    },
    "Azure Defender for Storage should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for Storage",
                "requirement_id": "2.5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Defender for Storage should be enabled",
        "policy_id": "308fbb08-4ab8-4e67-9b29-592e93fb94fa",
        "service_name": "Security Center"
    },
    "Azure Defender for container registries should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Detection and analysis - prioritize incidents",
                "requirement_id": "IR-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for Container Registries",
                "requirement_id": "2.7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Defender for container registries should be enabled",
        "policy_id": "c25d9a16-bc35-4e15-a7e5-9db606bf9ed4",
        "service_name": "Security Center"
    },
    "Azure Defender for servers should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Endpoint Security",
                "requirement": "Use Endpoint Detection and Response (EDR)",
                "requirement_id": "ES-1"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that Azure Defender is set to On for Servers",
                "requirement_id": "2.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Defender for servers should be enabled",
        "policy_id": "4da35fc9-c9e7-4960-aec9-797fe7d9051d",
        "service_name": "Security Center"
    },
    "Azure Event Grid domains should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Event Grid domain instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/privateendpoints .",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Grid/Domains_PrivateEndpoint_Audit.json",
        "github_version": "1.0.2",
        "name": "Azure Event Grid domains should use private link",
        "policy_id": "9830b652-8523-49cc-b1b3-e17dce1127ca",
        "service_name": "Event Grid"
    },
    "Azure Event Grid topics should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Event Grid topic instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/privateendpoints .",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Grid/Topics_PrivateEndpoint_Audit.json",
        "github_version": "1.0.2",
        "name": "Azure Event Grid topics should use private link",
        "policy_id": "4b90e17e-8448-49db-875e-bd83fb6f804f",
        "service_name": "Event Grid"
    },
    "Azure Key Vault Managed HSM should have purge protection enabled": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Business Continuity and Risk Assessment",
                "requirement": "Information security aspects of business continuity are (i) based on identifying events (or sequence of events) that can cause interruptions to the organization's critical business processes (e.g., equipment failure, human errors, theft, fire, natural disasters acts of terrorism); (ii) followed by a risk assessment to determine the probability and impact of such interruptions, in terms of time, damage scale and recovery period; (iii) based on the results of the risk assessment, a business continuity strategy is developed to identify the overall approach to business continuity; and (iv) once this strategy has been created, endorsement is provided by management, and a plan created and endorsed to implement this strategy.",
                "requirement_id": "ID : 1635.12b1Organizational.2 - 12.b"
            }
        },
        "description": "Malicious deletion of an Azure Key Vault Managed HSM can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge Azure Key Vault Managed HSM. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted Azure Key Vault Managed HSM. No one inside your organization or Microsoft will be able to purge your Azure Key Vault Managed HSM during the soft delete retention period.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/ManagedHsm_Recoverable_Audit.json",
        "github_version": "1.0.0",
        "name": "Azure Key Vault Managed HSM should have purge protection enabled",
        "policy_id": "c39ba22d-4428-4149-b981-70acb31fc383",
        "service_name": "Key Vault"
    },
    "Azure Machine Learning workspaces should be encrypted with a customer-managed key": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            }
        },
        "description": "Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/azureml-workspaces-cmk .",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json",
        "github_version": "1.0.3",
        "name": "Azure Machine Learning workspaces should be encrypted with a customer-managed key",
        "policy_id": "ba769a63-b8cc-4b2d-abf6-ac33c7204be8",
        "service_name": "Machine Learning"
    },
    "Azure Machine Learning workspaces should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Azure Machine Learning workspaces instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/azureml-workspaces-privatelink .",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_PrivateLinkEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "Azure Machine Learning workspaces should use private link",
        "policy_id": "40cec1dd-a100-4920-b15b-3024fe8901ab",
        "service_name": "Machine Learning"
    },
    "Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Monitoring System Use",
                "requirement": "The information system is able to automatically process audit records for events of interest based on selectable criteria.",
                "requirement_id": "ID : 1219.09ab3System.10 - 09.ab"
            }
        },
        "description": "This policy ensures that a log profile collects logs for categories 'write,' 'delete,' and 'action'",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllCategories.json",
        "github_version": "1.0.0",
        "name": "Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'",
        "policy_id": "1a4e592a-6a6e-44a5-9814-e36264ca96e7",
        "service_name": "Monitoring"
    },
    "Azure Monitor should collect activity logs from all regions": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Monitoring System Use",
                "requirement": "Monitoring includes privileged operations, authorized access or unauthorized access attempts, including attempts to access deactivated accounts, and system alerts or failures.",
                "requirement_id": "ID : 1214.09ab2System.3456 - 09.ab"
            }
        },
        "description": "This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json",
        "github_version": "1.0.0",
        "name": "Azure Monitor should collect activity logs from all regions",
        "policy_id": "41388f1c-2db0-4c25-95b2-35d7f5ccbfa9",
        "service_name": "Monitoring"
    },
    "Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "Azure Policy Add-on for Kubernetes service (AKS) extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA), to apply at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_AzurePolicyAddOn_Audit.json",
        "github_version": "1.0.2",
        "name": "Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters",
        "policy_id": "0a15ec92-a229-4763-bb14-0ea34a568f8d",
        "service_name": "Kubernetes"
    },
    "Azure SignalR Service should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your SignalR resources instead of the entire service, you'll also be protected against data leakage risks .Learn more at: https://aka.ms/asrs/privatelink .",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SignalR/SignalR_PrivateEndpointEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "Azure SignalR Service should use private link",
        "policy_id": "53503636-bcc9-4748-9663-5348217f160f",
        "service_name": "SignalR"
    },
    "Azure Spring Cloud should use network injection": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Connect private networks together",
                "requirement_id": "NS-2"
            }
        },
        "description": "Azure Spring Cloud instances should use virtual network injection for the following purposes: 1. Isolate Azure Spring Cloud from Internet. 2. Enable Azure Spring Cloud to interact with systems in either on premises data centers or Azure service in other virtual networks. 3. Empower customers to control inbound and outbound network communications for Azure Spring Cloud.",
        "effects": "Audit, Disabled, Deny",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Platform/Spring_VNETEnabled_Audit.json",
        "github_version": "1.0.0",
        "name": "Azure Spring Cloud should use network injection",
        "policy_id": "af35e2a4-ef96-44e7-a9ae-853dd97032c4",
        "service_name": "App Platform"
    },
    "Azure Stream Analytics jobs should use customer-managed keys to encrypt data": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Use customer-managed keys when you want to securely store any metadata and private data assets of your Stream Analytics jobs in your storage account. This gives you total control over how your Stream Analytics data is encrypted.",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Stream%20Analytics/StreamAnalytics_CMK_Audit.json",
        "github_version": "1.0.0",
        "name": "Azure Stream Analytics jobs should use customer-managed keys to encrypt data",
        "policy_id": "87ba29ef-1ab3-4d82-b763-87fcd4f531f7",
        "service_name": "Stream Analytics"
    },
    "Azure Synapse workspaces should use customer-managed keys to encrypt data at rest": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Use customer-managed keys to control the encryption at rest of the data stored in Azure Synapse workspaces. Customer-managed keys deliver double encryption by adding a second layer of encryption on top of the default encryption with service-managed keys.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Synapse/SynapseWorkspaceCMK_Audit.json",
        "github_version": "1.0.0",
        "name": "Azure Synapse workspaces should use customer-managed keys to encrypt data at rest",
        "policy_id": "f7d52b2d-e161-4dfa-a82b-55e564167385",
        "service_name": "Synapse"
    },
    "Azure subscriptions should have a log profile for Activity Log": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.6.6 Maintaining System Management Logs",
                "requirement_id": "AC-13"
            }
        },
        "description": "This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json",
        "github_version": "1.0.0",
        "name": "Azure subscriptions should have a log profile for Activity Log",
        "policy_id": "7796937f-307b-4598-941c-67d3a05ebfe7",
        "service_name": "Monitoring"
    },
    "Both operating systems and data disks in Azure Kubernetes Service clusters should be encrypted by customer-managed keys": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Encrypting OS and data disks using customer-managed keys provides more control and greater flexibility in key management. This is a common requirement in many regulatory and industry compliance standards.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_CMK_Deny.json",
        "github_version": "1.0.0",
        "name": "Both operating systems and data disks in Azure Kubernetes Service clusters should be encrypted by customer-managed keys",
        "policy_id": "7d7be79c-23ba-4033-84dd-45e2a5ccdd67",
        "service_name": "Kubernetes"
    },
    "Bring your own key data protection should be enabled for MySQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            }
        },
        "description": "Use customer-managed keys to manage the encryption at rest of your MySQL servers. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableByok_Audit.json",
        "github_version": "1.0.3",
        "name": "Bring your own key data protection should be enabled for MySQL servers",
        "policy_id": "83cef61d-dbd1-4b20-a4fc-5fbc7da10833",
        "service_name": "SQL"
    },
    "Bring your own key data protection should be enabled for PostgreSQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            }
        },
        "description": "Use customer-managed keys to manage the encryption at rest of your PostgreSQL servers. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableByok_Audit.json",
        "github_version": "1.0.3",
        "name": "Bring your own key data protection should be enabled for PostgreSQL servers",
        "policy_id": "18adea5e-f416-4d0f-8aa8-d24321e3e274",
        "service_name": "SQL"
    },
    "CORS should not allow every domain to access your API for FHIR": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API for FHIR. To protect your API for FHIR, remove access for all domains and explicitly define the domains allowed to connect.",
        "effects": "audit, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_RestrictCORSAccess_Audit.json",
        "github_version": "1.0.0",
        "name": "CORS should not allow every domain to access your API for FHIR",
        "policy_id": "0fea8f8a-4169-495d-8307-30ec335f387d",
        "service_name": "API for FHIR"
    },
    "CORS should not allow every resource to access your API App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "The organization establishes terms and conditions, consistent with any trust relationship established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to (i) access the information system from external information systems; and (ii) process, store or transmit organization-controlled information using external information systems.",
                "requirement_id": "ID : 0911.09s1Organizational.2 - 09.s"
            }
        },
        "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json",
        "github_version": "1.0.0",
        "name": "CORS should not allow every resource to access your API App",
        "policy_id": "358c20a6-3f9e-4f0e-97ff-c6ce485e2aac",
        "service_name": "App Service"
    },
    "CORS should not allow every resource to access your Function Apps": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "Cloud service providers use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.",
                "requirement_id": "ID : 0960.09sCSPOrganizational.1 - 09.s"
            }
        },
        "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json",
        "github_version": "1.0.0",
        "name": "CORS should not allow every resource to access your Function Apps",
        "policy_id": "0820b7b9-23aa-4725-a1ce-ae4558f718e5",
        "service_name": "App Service"
    },
    "CORS should not allow every resource to access your Web Applications": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "The information system prohibits remote activation of collaborative computing devices and provides an explicit indication of use to users physically present at the devices.",
                "requirement_id": "ID : 0916.09s2Organizational.4 - 09.s"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Control the flow of CUI in accordance with approved authorizations.",
                "requirement_id": "3.1.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Information Flow Enforcement",
                "requirement_id": "AC-4"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Software security",
                "requirement": "14.5.8 Web applications",
                "requirement_id": "SS-8"
            }
        },
        "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json",
        "github_version": "1.0.0",
        "name": "CORS should not allow every resource to access your Web Applications",
        "policy_id": "5744710e-cc2f-4ee8-8809-3b11e89f4bc9",
        "service_name": "App Service"
    },
    "Certificates using RSA cryptography should have the specified minimum key size": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            }
        },
        "description": "Manage your organizational compliance requirements by specifying a minimum key size for RSA certificates stored in your key vault.",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Certificates_RSA_MinimumKeySize.json",
        "github_version": "2.0.0-preview",
        "name": "Certificates using RSA cryptography should have the specified minimum key size",
        "policy_id": "cee51871-e572-4576-855c-047c820360f0",
        "service_name": "Key Vault"
    },
    "Cognitive Services accounts should enable data encryption": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Protect sensitive data",
                "requirement_id": "DP-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "This policy audits any Cognitive Services account not using data encryption. For each Cognitive Services account with storage, should enable data encryption with either customer managed or Microsoft managed key.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_Encryption_Audit.json",
        "github_version": "1.0.0",
        "name": "Cognitive Services accounts should enable data encryption",
        "policy_id": "2bdd0062-9d75-436e-89df-487dd8e4b3c7",
        "service_name": "Cognitive Services"
    },
    "Cognitive Services accounts should enable data encryption with a customer-managed key": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more about customer-managed keys at https://go.microsoft.com/fwlink/?linkid=2121321 .",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_CustomerManagedKey_Audit.json",
        "github_version": "1.0.3",
        "name": "Cognitive Services accounts should enable data encryption with a customer-managed key",
        "policy_id": "67121cc7-ff39-4ab8-b7e3-95b84dab487d",
        "service_name": "Cognitive Services"
    },
    "Cognitive Services accounts should restrict network access": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json",
        "github_version": "1.0.0",
        "name": "Cognitive Services accounts should restrict network access",
        "policy_id": "037eea7a-bd0a-46c5-9a66-03aea78705d3",
        "service_name": "Cognitive Services"
    },
    "Cognitive Services accounts should use customer owned storage or enable data encryption.": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            }
        },
        "description": "This policy audits any Cognitive Services account not using customer owned storage nor data encryption. For each Cognitive Services account with storage, use either customer owned storage or enable data encryption.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_BYOX_Audit.json",
        "github_version": "1.0.0",
        "name": "Cognitive Services accounts should use customer owned storage or enable data encryption.",
        "policy_id": "11566b39-f7f7-4b82-ab06-68d8700eb0a4",
        "service_name": "Cognitive Services"
    },
    "Connection throttling should be enabled for PostgreSQL database servers": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server",
                "requirement_id": "4.3.6"
            }
        },
        "description": "This policy helps audit any PostgreSQL databases in your environment without Connection throttling enabled. This setting enables temporary connection throttling per IP for too many invalid password login failures.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_ConnectionThrottling_Enabled_Audit.json",
        "github_version": "1.0.0",
        "name": "Connection throttling should be enabled for PostgreSQL database servers",
        "policy_id": "5345bb39-67dc-4960-a1bf-427e16b9a0bd",
        "service_name": "SQL"
    },
    "Container Registry should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "Authoritative DNS servers are segregated into internal and external roles.",
                "requirement_id": "ID : 0871.09m3Organizational.22 - 09.m"
            }
        },
        "description": "This policy audits any Container Registry not configured to use a virtual network service endpoint.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json",
        "github_version": "1.0.0-preview",
        "name": "Container Registry should use a virtual network service endpoint",
        "policy_id": "c4857be7-912a-4c75-87e6-e30292bcdf78",
        "service_name": "Network"
    },
    "Container registries should be encrypted with a customer-managed key": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Use customer-managed keys to manage the encryption at rest of the contents of your registries. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/acr/CMK .",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_CMKEncryptionEnabled_Audit.json",
        "github_version": "1.1.2",
        "name": "Container registries should be encrypted with a customer-managed key",
        "policy_id": "5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580",
        "service_name": "Container Registry"
    },
    "Container registries should not allow unrestricted network access": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json",
        "github_version": "1.0.1",
        "name": "Container registries should not allow unrestricted network access",
        "policy_id": "d0793b48-0edc-4296-a390-4c75d1bdfd71",
        "service_name": "Container Registry"
    },
    "Container registries should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network.By mapping private endpoints to your container registries instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/acr/private-link .",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_PrivateEndpointEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "Container registries should use private link",
        "policy_id": "e8eef0a8-67cf-4eb4-9386-14b0e78733d4",
        "service_name": "Container Registry"
    },
    "Cosmos DB should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "Usage restrictions and implementation guidance are formally defined for VoIP, including the authorization and monitoring of the service.",
                "requirement_id": "ID : 0864.09m2Organizational.12 - 09.m"
            }
        },
        "description": "This policy audits any Cosmos DB not configured to use a virtual network service endpoint.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_CosmosDB_Audit.json",
        "github_version": "1.0.0",
        "name": "Cosmos DB should use a virtual network service endpoint",
        "policy_id": "e0a2b1a3-f7f9-4569-807f-2a9edebdf4d9",
        "service_name": "Network"
    },
    "Custom subscription owner roles should not exist": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Follow just enough administration (least privilege principle)",
                "requirement_id": "PA-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure that no custom subscription owner roles are created",
                "requirement_id": "1.21"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation of Duties",
                "requirement": "The organization identifies duties that require separation and defines information system access authorizations to support separation of duties; and incompatible duties are segregated across multiple users to minimize the opportunity for misuse or fraud.",
                "requirement_id": "ID : 1278.09c2Organizational.56 - 09.c"
            }
        },
        "description": "This policy ensures that no custom subscription owner roles exist.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/CustomSubscription_OwnerRole_Audit.json",
        "github_version": "2.0.0",
        "name": "Custom subscription owner roles should not exist",
        "policy_id": "10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9",
        "service_name": "General"
    },
    "Deploy Advanced Threat Protection for Cosmos DB Accounts": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Incident Response",
                "requirement": "Detect and report events.",
                "requirement_id": "IR.2.093"
            }
        },
        "description": "This policy enables Advanced Threat Protection across Cosmos DB accounts.",
        "effects": "DeployIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/CosmosDbAdvancedThreatProtection_Deploy.json",
        "github_version": "1.0.0",
        "name": "Deploy Advanced Threat Protection for Cosmos DB Accounts",
        "policy_id": "b5f04e03-92a3-4b09-9410-2cc5e5047656",
        "service_name": "Cosmos DB"
    },
    "Deploy Advanced Threat Protection on Storage Accounts": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Incident Response",
                "requirement": "Detect and report events.",
                "requirement_id": "IR.2.093"
            }
        },
        "description": "This policy enables Advanced Threat Protection on Storage Accounts.",
        "effects": "DeployIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAdvancedThreatProtection_Deploy.json",
        "github_version": "1.0.0",
        "name": "Deploy Advanced Threat Protection on Storage Accounts",
        "policy_id": "361c2074-3595-4e5d-8cab-4f21dffc835c",
        "service_name": "Storage"
    },
    "Deploy Dependency agent for Windows virtual machine scale sets": {
        "benchmarks": {
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.3.10 Antivirus scans",
                "requirement_id": "DM-4"
            }
        },
        "description": "Deploy Dependency agent for Windows virtual machine scale sets if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. Note: if your scale set upgradePolicy is set to Manual, you need to apply the extension to the all virtual machines in the set by calling upgrade on them. In CLI this would be az vmss update-instances.",
        "effects": "deployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VMSS_Deploy.json",
        "github_version": "1.3.0",
        "name": "Deploy Dependency agent for Windows virtual machine scale sets",
        "policy_id": "3be22e3b-d919-47aa-805e-8985dbeb0ad9",
        "service_name": "Monitoring"
    },
    "Deploy Dependency agent for Windows virtual machines": {
        "benchmarks": {
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.3.5 Use of Privileged Accounts",
                "requirement_id": "AC-9"
            }
        },
        "description": "Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.",
        "effects": "deployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VM_Deploy.json",
        "github_version": "1.3.0",
        "name": "Deploy Dependency agent for Windows virtual machines",
        "policy_id": "1c210e94-a481-4beb-95fa-1571b434fb04",
        "service_name": "Monitoring"
    },
    "Deploy Diagnostic Settings for Network Security Groups": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization formally manages equipment on the network, including equipment in user areas.",
                "requirement_id": "ID : 0860.09m1Organizational.9 - 09.m"
            }
        },
        "description": "This policy automatically deploys diagnostic settings to network security groups. A storage account with name '{storagePrefixParameter}{NSGLocation}' will be automatically created.",
        "effects": "deployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForNSG_Deploy.json",
        "github_version": "1.0.0",
        "name": "Deploy Diagnostic Settings for Network Security Groups",
        "policy_id": "c9c29499-c1d1-4195-99bd-2ec9e3a9dc89",
        "service_name": "Monitoring"
    },
    "Deploy default Microsoft IaaSAntimalware extension for Windows Server": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Controls Against Malicious Code",
                "requirement": "Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",
                "requirement_id": "ID : 0201.09j1Organizational.124 - 09.j"
            }
        },
        "description": "This policy deploys a Microsoft IaaSAntimalware extension with a default configuration when a VM is not configured with the antimalware extension.",
        "effects": "deployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VMAntimalwareExtension_Deploy.json",
        "github_version": "1.0.0",
        "name": "Deploy default Microsoft IaaSAntimalware extension for Windows Server",
        "policy_id": "2835b622-407b-4114-9198-6f7064cbe0dc",
        "service_name": "Compute"
    },
    "Deploy network watcher when virtual networks are created": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation in Networks",
                "requirement": "Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",
                "requirement_id": "ID : 0894.01m2Organizational.7 - 01.m"
            }
        },
        "description": "This policy creates a network watcher resource in regions with virtual networks. You need to ensure existence of a resource group named networkWatcherRG, which will be used to deploy network watcher instances.",
        "effects": "DeployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Deploy.json",
        "github_version": "1.0.0",
        "name": "Deploy network watcher when virtual networks are created",
        "policy_id": "a9b99dd8-06c5-4317-8629-9d86a3c6e7d9",
        "service_name": "Network"
    },
    "Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Authorize remote execution of privileged commands and remote access to security-relevant information.",
                "requirement_id": "AC.3.021"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Management of secret authentication information of users",
                "requirement_id": "A.9.2.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.32 System User Identification",
                "requirement_id": "AC-2"
            }
        },
        "description": "This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",
        "effects": "deployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json",
        "github_version": "1.0.0",
        "name": "Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs",
        "policy_id": "331e8ea8-378a-410f-a2e5-ae22f38bb0da",
        "service_name": "Guest Configuration"
    },
    "Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "IA.2.081"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "3.5.10"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Authenticator Management | Password-Based Authentication",
                "requirement_id": "IA-5 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Cryptography",
                "requirement": "17.4.16 Using TLS",
                "requirement_id": "CR-6"
            }
        },
        "description": "This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",
        "effects": "deployIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json",
        "github_version": "1.0.0",
        "name": "Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs",
        "policy_id": "385f5831-96d4-41db-9a3c-cd3af78aaae6",
        "service_name": "Guest Configuration"
    },
    "Deprecated accounts should be removed from your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Review and reconcile user access regularly",
                "requirement_id": "PA-3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",
                "requirement_id": "AC.1.001"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Removal or adjustment of access rights",
                "requirement_id": "A.9.2.6"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",
                "requirement_id": "3.1.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management",
                "requirement_id": "AC-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.46 Suspension of access",
                "requirement_id": "AC-5"
            }
        },
        "description": "Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json",
        "github_version": "3.0.0",
        "name": "Deprecated accounts should be removed from your subscription",
        "policy_id": "6b1cbf55-e8b6-442f-ba4c-7246b6381474",
        "service_name": "Security Center"
    },
    "Deprecated accounts with owner permissions should be removed from your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Review and reconcile user access regularly",
                "requirement_id": "PA-3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Separate user functionality from system management functionality.",
                "requirement_id": "SC.3.181"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Privilege Management",
                "requirement": "Elevated privileges are assigned to a different user ID from those used for normal business use, all users access privileged services in a single role, and such privileged access is minimized.",
                "requirement_id": "ID : 1147.01c2System.456 - 01.c"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Removal or adjustment of access rights",
                "requirement_id": "A.9.2.6"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",
                "requirement_id": "3.1.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management",
                "requirement_id": "AC-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.46 Suspension of access",
                "requirement_id": "AC-5"
            }
        },
        "description": "Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "Deprecated accounts with owner permissions should be removed from your subscription",
        "policy_id": "ebb62a0c-3560-49e1-89ed-27e074e9f8ad",
        "service_name": "Security Center"
    },
    "Diagnostic logs in App Services should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "The information system generates audit records containing the following detailed information: (i) filename accessed; (ii) program or command used to initiate the event; and (iii) source and destination addresses.",
                "requirement_id": "ID : 1209.09aa3System.2 - 09.aa"
            }
        },
        "description": "Audit enabling of diagnostic logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditLoggingMonitoring_Audit.json",
        "github_version": "2.0.0",
        "name": "Diagnostic logs in App Services should be enabled",
        "policy_id": "b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0",
        "service_name": "App Service"
    },
    "Disconnections should be logged for PostgreSQL database servers.": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server",
                "requirement_id": "4.3.5"
            }
        },
        "description": "This policy helps audit any PostgreSQL databases in your environment without log_disconnections enabled.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableLogDisconnections_Audit.json",
        "github_version": "1.0.0",
        "name": "Disconnections should be logged for PostgreSQL database servers.",
        "policy_id": "eb6f77b9-bd53-4e35-a23d-7f65d5f0e446",
        "service_name": "SQL"
    },
    "Disk encryption should be applied on virtual machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Virtual Machines",
                "requirement": "Ensure that 'OS and Data' disks are encrypted with CMK",
                "requirement_id": "7.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Management of Removable Media",
                "requirement": "The organization protects and controls media containing sensitive information during transport outside of controlled areas.",
                "requirement_id": "ID : 0302.09o2Organizational.1 - 09.o"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "3.13.16"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Protection of Information at Rest | Cryptographic Protection",
                "requirement_id": "SC-28 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json",
        "github_version": "2.0.0",
        "name": "Disk encryption should be applied on virtual machines",
        "policy_id": "0961003e-5a0a-4549-abde-af6a37f2724d",
        "service_name": "Security Center"
    },
    "Disk encryption should be enabled on Azure Data Explorer": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "Enabling disk encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_disk_encrypted.json",
        "github_version": "2.0.0",
        "name": "Disk encryption should be enabled on Azure Data Explorer",
        "policy_id": "f4b53539-8df9-40e4-86c6-6b607703bd4e",
        "service_name": "Azure Data Explorer"
    },
    "Do not allow privileged containers in Kubernetes cluster": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy does not allow privileged containers creation in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerNoPrivilege.json",
        "github_version": "5.0.1",
        "name": "Do not allow privileged containers in Kubernetes cluster",
        "policy_id": "95edb821-ddaf-4404-9732-666045e056b4",
        "service_name": "Kubernetes"
    },
    "Double encryption should be enabled on Azure Data Explorer": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "Enabling double encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. When double encryption has been enabled, data in the storage account is encrypted twice, once at the service level and once at the infrastructure level, using two different encryption algorithms and two different keys.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_doubleEncryption.json",
        "github_version": "2.0.0",
        "name": "Double encryption should be enabled on Azure Data Explorer",
        "policy_id": "ec068d99-e9c7-401f-8cef-5bdde4e6ccf1",
        "service_name": "Azure Data Explorer"
    },
    "Email notification for high severity alerts should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Preparation - setup incident notification",
                "requirement_id": "IR-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure that 'Notify about alerts with the following severity' is set to 'High'",
                "requirement_id": "2.14"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Incident Response",
                "requirement": "Detect and report events.",
                "requirement_id": "IR.2.093"
            }
        },
        "description": "To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, enable email notifications for high severity alerts in Security Center.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification.json",
        "github_version": "1.0.1",
        "name": "Email notification for high severity alerts should be enabled",
        "policy_id": "6e2593d9-add6-4083-9c9b-4b7d2188c899",
        "service_name": "Security Center"
    },
    "Email notification to subscription owner for high severity alerts should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Preparation - setup incident notification",
                "requirement_id": "IR-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "3.14.6"
            }
        },
        "description": "To ensure your subscription owners are notified when there is a potential security breach in their subscription, set email notifications to subscription owners for high severity alerts in Security Center.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification_to_subscription_owner.json",
        "github_version": "2.0.0",
        "name": "Email notification to subscription owner for high severity alerts should be enabled",
        "policy_id": "0b15565f-aa9e-48ba-8619-45960f2c314d",
        "service_name": "Security Center"
    },
    "Endpoint protection solution should be installed on virtual machine scale sets": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Endpoint Security",
                "requirement": "Ensure anti-malware software and signatures are updated",
                "requirement_id": "ES-3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Provide protection from malicious code at appropriate locations within organizational information systems.",
                "requirement_id": "SI.1.211"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Controls Against Malicious Code",
                "requirement": "Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",
                "requirement_id": "ID : 0201.09j1Organizational.124 - 09.j"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Provide protection from malicious code at designated locations within organizational systems.",
                "requirement_id": "3.14.2"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Malicious Code Protection | Central Management",
                "requirement_id": "SI-3 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.3.10 Antivirus scans",
                "requirement_id": "DM-4"
            }
        },
        "description": "Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json",
        "github_version": "3.0.0",
        "name": "Endpoint protection solution should be installed on virtual machine scale sets",
        "policy_id": "26a828e1-e88f-464e-bbb3-c134a282b9de",
        "service_name": "Security Center"
    },
    "Enforce SSL connection should be enabled for MySQL database servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server",
                "requirement_id": "4.3.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "Where a trusted authority is used (e.g., for the purposes of issuing and maintaining digital signatures and/or digital certificates), security is integrated and embedded throughout the entire end-to-end certificate/signature management process.",
                "requirement_id": "ID : 0948.09y2Organizational.3 - 09.y"
            }
        },
        "description": "Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json",
        "github_version": "1.0.1",
        "name": "Enforce SSL connection should be enabled for MySQL database servers",
        "policy_id": "e802a67a-daf5-4436-9ea6-f6d821dd0c5d",
        "service_name": "SQL"
    },
    "Enforce SSL connection should be enabled for PostgreSQL database servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server",
                "requirement_id": "4.3.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The organization ensures the storage of the transaction details are located outside of any publicly accessible environments (e.g., on a storage platform existing on the organization's intranet) and not retained and exposed on a storage medium directly accessible from the Internet.",
                "requirement_id": "ID : 0947.09y2Organizational.2 - 09.y"
            }
        },
        "description": "Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json",
        "github_version": "1.0.1",
        "name": "Enforce SSL connection should be enabled for PostgreSQL database servers",
        "policy_id": "d158790f-bfb0-486c-8631-2dc6b4e8e6af",
        "service_name": "SQL"
    },
    "Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On'": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'",
                "requirement_id": "9.4"
            }
        },
        "description": "Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_ClientCert.json",
        "github_version": "1.0.0",
        "name": "Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On'",
        "policy_id": "0c192fe8-9cbb-4516-85b3-0ade8bd03886",
        "service_name": "App Service"
    },
    "Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On'": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'",
                "requirement_id": "9.4"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "The organization limits the use of organization-controlled portable storage media by authorized individuals on external information systems.",
                "requirement_id": "ID : 0915.09s2Organizational.2 - 09.s"
            }
        },
        "description": "Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_ClientCert.json",
        "github_version": "1.0.0",
        "name": "Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On'",
        "policy_id": "5bb220d9-2698-4ee4-8404-b9c30c9df609",
        "service_name": "App Service"
    },
    "Ensure container CPU and memory resource limits do not exceed the specified limits in Kubernetes cluster": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy ensures container CPU and memory resource limits are defined and do not exceed the specified limits in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerResourceLimits.json",
        "github_version": "5.0.1",
        "name": "Ensure container CPU and memory resource limits do not exceed the specified limits in Kubernetes cluster",
        "policy_id": "e345eecc-fa47-480f-9e88-67dcc122b164",
        "service_name": "Kubernetes"
    },
    "Ensure containers listen only on allowed ports in Kubernetes cluster": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy enforces containers to listen only on allowed ports in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerAllowedPorts.json",
        "github_version": "5.0.1",
        "name": "Ensure containers listen only on allowed ports in Kubernetes cluster",
        "policy_id": "440b515e-a580-421e-abeb-b159a61ddcbc",
        "service_name": "Kubernetes"
    },
    "Ensure only allowed container images in Kubernetes cluster": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy ensures only allowed container images are running in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerAllowedImages.json",
        "github_version": "5.0.1",
        "name": "Ensure only allowed container images in Kubernetes cluster",
        "policy_id": "febd0533-8e55-448f-b837-bd0e06f16469",
        "service_name": "Kubernetes"
    },
    "Ensure services listen only on allowed ports in Kubernetes cluster": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy enforces services to listen only on allowed ports in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ServiceAllowedPorts.json",
        "github_version": "5.0.1",
        "name": "Ensure services listen only on allowed ports in Kubernetes cluster",
        "policy_id": "233a2a17-77ca-4fb1-9b6b-69223d272a44",
        "service_name": "Kubernetes"
    },
    "Ensure that 'HTTP Version' is the latest, if used to run the API app": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'HTTP Version' is the latest, if used to run the web app",
                "requirement_id": "9.9"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_HTTP_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'HTTP Version' is the latest, if used to run the API app",
        "policy_id": "991310cd-e9f3-47bc-b7b6-f57b557d07db",
        "service_name": "App Service"
    },
    "Ensure that 'HTTP Version' is the latest, if used to run the Function app": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'HTTP Version' is the latest, if used to run the web app",
                "requirement_id": "9.9"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_HTTP_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'HTTP Version' is the latest, if used to run the Function app",
        "policy_id": "e2c1c086-2d84-4019-bff3-c44ccd95113c",
        "service_name": "App Service"
    },
    "Ensure that 'HTTP Version' is the latest, if used to run the Web app": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'HTTP Version' is the latest, if used to run the web app",
                "requirement_id": "9.9"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_HTTP_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'HTTP Version' is the latest, if used to run the Web app",
        "policy_id": "8c122334-9d20-4eb8-89ea-ac9a705b74ae",
        "service_name": "App Service"
    },
    "Ensure that 'Java version' is the latest, if used as a part of the API app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'Java version' is the latest, if used to run the web app",
                "requirement_id": "9.8"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for Java either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_java_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'Java version' is the latest, if used as a part of the API app",
        "policy_id": "88999f4c-376a-45c8-bcb3-4058f713cf39",
        "service_name": "App Service"
    },
    "Ensure that 'Java version' is the latest, if used as a part of the Function app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'Java version' is the latest, if used to run the web app",
                "requirement_id": "9.8"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_java_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'Java version' is the latest, if used as a part of the Function app",
        "policy_id": "9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc",
        "service_name": "App Service"
    },
    "Ensure that 'Java version' is the latest, if used as a part of the Web app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'Java version' is the latest, if used to run the web app",
                "requirement_id": "9.8"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_java_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'Java version' is the latest, if used as a part of the Web app",
        "policy_id": "496223c3-ad65-4ecd-878a-bae78737e9ed",
        "service_name": "App Service"
    },
    "Ensure that 'PHP version' is the latest, if used as a part of the API app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'PHP version' is the latest, if used to run the web app",
                "requirement_id": "9.6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_PHP_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'PHP version' is the latest, if used as a part of the API app",
        "policy_id": "1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba",
        "service_name": "App Service"
    },
    "Ensure that 'PHP version' is the latest, if used as a part of the WEB app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'PHP version' is the latest, if used to run the web app",
                "requirement_id": "9.6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_PHP_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'PHP version' is the latest, if used as a part of the WEB app",
        "policy_id": "7261b898-8a84-4db8-9e04-18527132abb3",
        "service_name": "App Service"
    },
    "Ensure that 'Python version' is the latest, if used as a part of the API app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'Python version' is the latest, if used to run the web app",
                "requirement_id": "9.7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_python_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'Python version' is the latest, if used as a part of the API app",
        "policy_id": "74c3584d-afae-46f7-a20a-6f8adba71a16",
        "service_name": "App Service"
    },
    "Ensure that 'Python version' is the latest, if used as a part of the Function app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'Python version' is the latest, if used to run the web app",
                "requirement_id": "9.7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_python_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'Python version' is the latest, if used as a part of the Function app",
        "policy_id": "7238174a-fd10-4ef0-817e-fc820a951d73",
        "service_name": "App Service"
    },
    "Ensure that 'Python version' is the latest, if used as a part of the Web app": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that 'Python version' is the latest, if used to run the web app",
                "requirement_id": "9.7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_python_Latest.json",
        "github_version": "2.0.0",
        "name": "Ensure that 'Python version' is the latest, if used as a part of the Web app",
        "policy_id": "7008174a-fd10-4ef0-817e-fc820a951d73",
        "service_name": "App Service"
    },
    "Event Hub should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization builds a firewall configuration that restricts connections between un-trusted networks and any system components in the covered information environment; and any changes to the firewall configuration are updated in the network diagram.",
                "requirement_id": "ID : 0863.09m2Organizational.910 - 09.m"
            }
        },
        "description": "This policy audits any Event Hub not configured to use a virtual network service endpoint.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_EventHub_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "Event Hub should use a virtual network service endpoint",
        "policy_id": "d63edb4a-c612-454d-b47d-191a724fcbf0",
        "service_name": "Network"
    },
    "External accounts with owner permissions should be removed from your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Review and reconcile user access regularly",
                "requirement_id": "PA-3"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure guest users are reviewed on a monthly basis",
                "requirement_id": "1.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Separate user functionality from system management functionality.",
                "requirement_id": "SC.3.181"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Privilege Management",
                "requirement": "The organization promotes the development and use of programs that avoid the need to run with elevated privileges and system routines to avoid the need to grant privileges to users.",
                "requirement_id": "ID : 1146.01c2System.23 - 01.c"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Review of user access rights",
                "requirement_id": "A.9.2.5"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",
                "requirement_id": "3.1.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management",
                "requirement_id": "AC-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Product Security",
                "requirement": "12.4.4 Patching vulnerabilities in products",
                "requirement_id": "PRS-5"
            }
        },
        "description": "External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "External accounts with owner permissions should be removed from your subscription",
        "policy_id": "f8456c1c-aa66-4dfb-861a-25d127b775c9",
        "service_name": "Security Center"
    },
    "External accounts with read permissions should be removed from your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Review and reconcile user access regularly",
                "requirement_id": "PA-3"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure guest users are reviewed on a monthly basis",
                "requirement_id": "1.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Employ the principle of least privilege, including for specific security functions and privileged accounts.",
                "requirement_id": "AC.2.007"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",
                "requirement_id": "3.1.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management",
                "requirement_id": "AC-2"
            }
        },
        "description": "External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "External accounts with read permissions should be removed from your subscription",
        "policy_id": "5f76cf89-fbf2-47fd-a3f4-b891fa780b60",
        "service_name": "Security Center"
    },
    "External accounts with write permissions should be removed from your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Review and reconcile user access regularly",
                "requirement_id": "PA-3"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure guest users are reviewed on a monthly basis",
                "requirement_id": "1.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Employ the principle of least privilege, including for specific security functions and privileged accounts.",
                "requirement_id": "AC.2.007"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Review of user access rights",
                "requirement_id": "A.9.2.5"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",
                "requirement_id": "3.1.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management",
                "requirement_id": "AC-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Product Security",
                "requirement": "12.4.4 Patching vulnerabilities in products",
                "requirement_id": "PRS-5"
            }
        },
        "description": "External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "External accounts with write permissions should be removed from your subscription",
        "policy_id": "5c607a2e-c700-4744-8254-d77e7c9eb5e4",
        "service_name": "Security Center"
    },
    "FTPS only should be required in your API App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure FTP deployments are disabled",
                "requirement_id": "9.10"
            }
        },
        "description": "Enable FTPS enforcement for enhanced security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_ApiApp_Audit.json",
        "github_version": "2.0.0",
        "name": "FTPS only should be required in your API App",
        "policy_id": "9a1b8c48-453a-4044-86c3-d8bfd823e4f5",
        "service_name": "App Service"
    },
    "FTPS only should be required in your Function App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure FTP deployments are disabled",
                "requirement_id": "9.10"
            }
        },
        "description": "Enable FTPS enforcement for enhanced security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_FunctionApp_Audit.json",
        "github_version": "2.0.0",
        "name": "FTPS only should be required in your Function App",
        "policy_id": "399b2637-a50f-4f95-96f8-3a145476eb15",
        "service_name": "App Service"
    },
    "FTPS should be required in your Web App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure FTP deployments are disabled",
                "requirement_id": "9.10"
            }
        },
        "description": "Enable FTPS enforcement for enhanced security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_WebApp_Audit.json",
        "github_version": "2.0.0",
        "name": "FTPS should be required in your Web App",
        "policy_id": "4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b",
        "service_name": "App Service"
    },
    "Firewall should be enabled on Key Vault": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            }
        },
        "description": "Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json",
        "github_version": "1.0.2-preview",
        "name": "Firewall should be enabled on Key Vault",
        "policy_id": "55615ac9-af46-4a59-874e-391cc3dfb490",
        "service_name": "Key Vault"
    },
    "Flow log should be configured for every network security group": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            }
        },
        "description": "Audit for network security groups to verify if flow log resource is configured. Flow log allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions and more.",
        "effects": "audit",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_FlowLog_Audit.json",
        "github_version": "1.0.0",
        "name": "Flow log should be configured for every network security group",
        "policy_id": "c251913d-7d24-4958-af87-478ed3b9ba41",
        "service_name": "Network"
    },
    "Function App should only be accessible over HTTPS": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",
                "requirement_id": "ID : 0949.09y2Organizational.5 - 09.y"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "3.13.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection",
                "requirement_id": "SC-8 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Software security",
                "requirement": "14.5.8 Web applications",
                "requirement_id": "SS-8"
            }
        },
        "description": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json",
        "github_version": "1.0.0",
        "name": "Function App should only be accessible over HTTPS",
        "policy_id": "6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab",
        "service_name": "App Service"
    },
    "Function apps should have 'Client Certificates (Incoming client certificates)' enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'",
                "requirement_id": "9.4"
            }
        },
        "description": "Client certificates allow for the app to request a certificate for incoming requests. Only clients with valid certificates will be able to reach the app.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_ClientCert.json",
        "github_version": "1.0.1",
        "name": "Function apps should have 'Client Certificates (Incoming client certificates)' enabled",
        "policy_id": "eaebaea7-8013-4ceb-9d14-7eb32271373c",
        "service_name": "App Service"
    },
    "Gateway subnets should not be configured with a network security group": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation in Networks",
                "requirement": "Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",
                "requirement_id": "ID : 0894.01m2Organizational.7 - 01.m"
            }
        },
        "description": "This policy denies if a gateway subnet is configured with a network security group. Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.",
        "effects": "deny",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroupOnGatewaySubnet_Deny.json",
        "github_version": "1.0.0",
        "name": "Gateway subnets should not be configured with a network security group",
        "policy_id": "35f9c03a-cc27-418e-9c0c-539ff999d010",
        "service_name": "Network"
    },
    "Geo-redundant backup should be enabled for Azure Database for MariaDB": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Encrypt backup data",
                "requirement_id": "BR-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Recovery",
                "requirement": "Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",
                "requirement_id": "RE.3.139"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Back-up",
                "requirement": "The organization tests backup information following each backup to verify media reliability and information integrity, and at least annually thereafter.",
                "requirement_id": "ID : 1627.09l3Organizational.6 - 09.l"
            }
        },
        "description": "Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json",
        "github_version": "1.0.1",
        "name": "Geo-redundant backup should be enabled for Azure Database for MariaDB",
        "policy_id": "0ec47710-77ff-4a3d-9181-6aa50af424d0",
        "service_name": "SQL"
    },
    "Geo-redundant backup should be enabled for Azure Database for MySQL": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Encrypt backup data",
                "requirement_id": "BR-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Recovery",
                "requirement": "Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",
                "requirement_id": "RE.3.139"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Back-up",
                "requirement": "The integrity and security of the backup copies are maintained to ensure future availability, and any potential accessibility problems with the backup copies are identified and mitigated in the event of an area-wide disaster.",
                "requirement_id": "ID : 1622.09l2Organizational.23 - 09.l"
            }
        },
        "description": "Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json",
        "github_version": "1.0.1",
        "name": "Geo-redundant backup should be enabled for Azure Database for MySQL",
        "policy_id": "82339799-d096-41ae-8538-b108becf0970",
        "service_name": "SQL"
    },
    "Geo-redundant backup should be enabled for Azure Database for PostgreSQL": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Encrypt backup data",
                "requirement_id": "BR-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Recovery",
                "requirement": "Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",
                "requirement_id": "RE.3.139"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Back-up",
                "requirement": "The organization ensures a current, retrievable copy of covered information is available before movement of servers.",
                "requirement_id": "ID : 1626.09l3Organizational.5 - 09.l"
            }
        },
        "description": "Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json",
        "github_version": "1.0.1",
        "name": "Geo-redundant backup should be enabled for Azure Database for PostgreSQL",
        "policy_id": "48af4db5-9b8b-401c-8e74-076be876a430",
        "service_name": "SQL"
    },
    "Guest Configuration extension should be installed on your machines": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Authorize remote execution of privileged commands and remote access to security-relevant information.",
                "requirement_id": "AC.3.021"
            }
        },
        "description": "To ensure secure configurations of in-guest settings of your machine, install the Guest Configuration extension. In-guest settings that the extension monitors include the configuration of the operating system, application configuration or presence, and environment settings. Once installed, in-guest policies will be available such as 'Windows Exploit guard should be enabled'. Learn more at https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_GCExtOnVm.json",
        "github_version": "1.0.1",
        "name": "Guest Configuration extension should be installed on your machines",
        "policy_id": "ae89ebca-1c92-4898-ac2c-9f63decb045c",
        "service_name": "Security Center"
    },
    "IP Forwarding on your virtual machine should be disabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            }
        },
        "description": "Enabling IP forwarding on a virtual machine's NIC allows the machine to receive traffic addressed to other destinations. IP forwarding is rarely required (e.g., when using the VM as a network virtual appliance), and therefore, this should be reviewed by the network security team.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_IPForwardingOnVirtualMachines_Audit.json",
        "github_version": "3.0.0",
        "name": "IP Forwarding on your virtual machine should be disabled",
        "policy_id": "bd352bd5-2853-4985-bf0d-73806b4a5744",
        "service_name": "Security Center"
    },
    "Infrastructure encryption should be enabled for Azure Database for MySQL servers": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "Enable infrastructure encryption for Azure Database for MySQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_InfrastructureEncryption_Audit.json",
        "github_version": "1.0.0",
        "name": "Infrastructure encryption should be enabled for Azure Database for MySQL servers",
        "policy_id": "3a58212a-c829-4f13-9872-6371df2fd0b4",
        "service_name": "SQL"
    },
    "Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "Enable infrastructure encryption for Azure Database for PostgreSQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_InfrastructureEncryption_Audit.json",
        "github_version": "1.0.0",
        "name": "Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers",
        "policy_id": "24fba194-95d6-48c0-aea7-f65bf859c598",
        "service_name": "SQL"
    },
    "Internet-facing virtual machines should be protected with network security groups": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Connection Control",
                "requirement": "The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.",
                "requirement_id": "ID : 0814.01n1Organizational.12 - 01.n"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.",
                "requirement_id": "3.13.5"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.1.13 Limiting network access",
                "requirement_id": "NS-2"
            }
        },
        "description": "Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json",
        "github_version": "3.0.0",
        "name": "Internet-facing virtual machines should be protected with network security groups",
        "policy_id": "f6de0be7-9a8a-4b8a-b349-43cf02d22f7c",
        "service_name": "Security Center"
    },
    "Key Vault keys should have an expiration date": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Other Security Considerations",
                "requirement": "Ensure that the expiration date is set on all keys",
                "requirement_id": "8.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            }
        },
        "description": "Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. It is a recommended security practice to set expiration dates on cryptographic keys.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_ExpirationSet.json",
        "github_version": "1.0.1-preview",
        "name": "Key Vault keys should have an expiration date",
        "policy_id": "152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0",
        "service_name": "Key Vault"
    },
    "Key Vault secrets should have an expiration date": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Other Security Considerations",
                "requirement": "Ensure that the expiration date is set on all Secrets",
                "requirement_id": "8.2"
            }
        },
        "description": "Secrets should have a defined expiration date and not be permanent. Secrets that are valid forever provide a potential attacker with more time to compromise them. It is a recommended security practice to set expiration dates on secrets.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Secrets_ExpirationSet.json",
        "github_version": "1.0.1-preview",
        "name": "Key Vault secrets should have an expiration date",
        "policy_id": "98728c90-32c7-4049-8429-847dc0f4fe37",
        "service_name": "Key Vault"
    },
    "Key Vault should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization (i) authorizes connections from the information system to other information systems outside of the organization through the use of interconnection security agreements or other formal agreement; (ii) documents each connection, the interface characteristics, security requirements, and the nature of the information communicated; (iii) employs a deny all, permit by exception policy for allowing connections from the information system to other information systems outside of the organization; and (iv) applies a default-deny rule that drops all traffic via host-based firewalls or port filtering tools on its endpoints (workstations, servers, etc.), except those services and ports that are explicitly allowed.",
                "requirement_id": "ID : 0865.09m2Organizational.13 - 09.m"
            }
        },
        "description": "This policy audits any Key Vault not configured to use a virtual network service endpoint.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_KeyVault_Audit.json",
        "github_version": "1.0.0",
        "name": "Key Vault should use a virtual network service endpoint",
        "policy_id": "ea4d6841-2173-4317-9747-ff522a45120f",
        "service_name": "Network"
    },
    "Key vaults should have purge protection enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Mitigate risk of lost keys",
                "requirement_id": "BR-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Other Security Considerations",
                "requirement": "Ensure the key vault is recoverable",
                "requirement_id": "8.4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Business Continuity and Risk Assessment",
                "requirement": "Information security aspects of business continuity are (i) based on identifying events (or sequence of events) that can cause interruptions to the organization's critical business processes (e.g., equipment failure, human errors, theft, fire, natural disasters acts of terrorism); (ii) followed by a risk assessment to determine the probability and impact of such interruptions, in terms of time, damage scale and recovery period; (iii) based on the results of the risk assessment, a business continuity strategy is developed to identify the overall approach to business continuity; and (iv) once this strategy has been created, endorsement is provided by management, and a plan created and endorsed to implement this strategy.",
                "requirement_id": "ID : 1635.12b1Organizational.2 - 12.b"
            }
        },
        "description": "Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_Recoverable_Audit.json",
        "github_version": "1.1.1",
        "name": "Key vaults should have purge protection enabled",
        "policy_id": "0b60c0b2-2dc2-4e1c-b5c9-abbed971de53",
        "service_name": "Key Vault"
    },
    "Key vaults should have soft delete enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Mitigate risk of lost keys",
                "requirement_id": "BR-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            }
        },
        "description": "Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of a key vault can lead to permanent data loss. Soft delete allows you to recover an accidentally deleted key vault for a configurable retention period.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_SoftDeleteMustBeEnabled_Audit.json",
        "github_version": "1.0.2",
        "name": "Key vaults should have soft delete enabled",
        "policy_id": "1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d",
        "service_name": "Key Vault"
    },
    "Keys should be the specified cryptographic type RSA or EC": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            }
        },
        "description": "Some applications require the use of keys backed by a specific cryptographic type. Enforce a particular cryptographic key type, RSA or EC, in your environment.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_AllowedKeyTypes.json",
        "github_version": "1.0.0-preview",
        "name": "Keys should be the specified cryptographic type RSA or EC",
        "policy_id": "75c4f823-d65c-4f29-a733-01d0077fdbcb",
        "service_name": "Key Vault"
    },
    "Keys using RSA cryptography should have a specified minimum key size": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            }
        },
        "description": "Set the minimum allowed key size for use with your key vaults. Use of RSA keys with small key sizes is not a secure practice and doesn't meet many industry certification requirements.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_RSA_MinimumKeySize.json",
        "github_version": "1.0.0-preview",
        "name": "Keys using RSA cryptography should have a specified minimum key size",
        "policy_id": "82067dbb-e53b-4e06-b631-546d197452d9",
        "service_name": "Key Vault"
    },
    "Keys using elliptic curve cryptography should have the specified curve names": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Establish and manage cryptographic keys for cryptography employed in organizational systems.",
                "requirement_id": "SC.3.187"
            }
        },
        "description": "Keys backed by elliptic curve cryptography can have different curve names. Some applications are only compatible with specific elliptic curve keys. Enforce the types of elliptic curve keys that are allowed to be created in your environment.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_EC_AllowedCurveNames.json",
        "github_version": "1.0.0-preview",
        "name": "Keys using elliptic curve cryptography should have the specified curve names",
        "policy_id": "ff25f3c8-b739-4538-9d07-3d6d25cfb255",
        "service_name": "Key Vault"
    },
    "Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            }
        },
        "description": "Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UpgradeVersion_KubernetesService_Audit.json",
        "github_version": "1.0.2",
        "name": "Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version",
        "policy_id": "fb893a29-21bb-418c-a157-e99480ec364c",
        "service_name": "Security Center"
    },
    "Kubernetes cluster containers should not share host process ID or host IPC namespace": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy blocks pod containers from sharing the host process ID namespace and host IPC namespace in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc/ .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/BlockHostNamespace.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster containers should not share host process ID or host IPC namespace",
        "policy_id": "47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8",
        "service_name": "Kubernetes"
    },
    "Kubernetes cluster containers should only use allowed AppArmor profiles": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy ensures containers only use allowed AppArmor profiles in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/EnforceAppArmorProfile.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster containers should only use allowed AppArmor profiles",
        "policy_id": "511f5417-5d12-434d-ab2e-816901e72a5e",
        "service_name": "Kubernetes"
    },
    "Kubernetes cluster containers should only use allowed capabilities": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy ensures containers only use allowed capabilities in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerAllowedCapabilities.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster containers should only use allowed capabilities",
        "policy_id": "c26596ff-4d70-4e6a-9a30-c2506bd2f80c",
        "service_name": "Kubernetes"
    },
    "Kubernetes cluster containers should run with a read only root file system": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy ensures containers run with a read only root file system in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc/ .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ReadOnlyRootFileSystem.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster containers should run with a read only root file system",
        "policy_id": "df49d893-a74c-421d-bc95-c663042e5b80",
        "service_name": "Kubernetes"
    },
    "Kubernetes cluster pod hostPath volumes should only use allowed host paths": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy ensures pod hostPath volumes can only use allowed host paths in a Kubernetes Cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AllowedHostPaths.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster pod hostPath volumes should only use allowed host paths",
        "policy_id": "098fc59e-46c7-4d99-9b16-64990e543d75",
        "service_name": "Kubernetes"
    },
    "Kubernetes cluster pods and containers should only run with approved user and group IDs": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy controls the user, primary group, supplemental group and file system group IDs that pods and containers can use to run in a Kubernetes Cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AllowedUsersGroups.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster pods and containers should only run with approved user and group IDs",
        "policy_id": "f06ddb64-5fa3-4b77-b166-acb36f7f6042",
        "service_name": "Kubernetes"
    },
    "Kubernetes cluster pods should only use approved host network and port range": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json",
        "github_version": "2.0.1",
        "name": "Kubernetes cluster pods should only use approved host network and port range",
        "policy_id": "82985f06-dc18-4a48-bc1c-b9f4f0098cfe",
        "service_name": "Kubernetes"
    },
    "Kubernetes clusters should be accessible only over HTTPS": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            }
        },
        "description": "Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. For more info, visit https://aka.ms/kubepolicydoc",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/IngressHttpsOnly.json",
        "github_version": "5.0.2",
        "name": "Kubernetes clusters should be accessible only over HTTPS",
        "policy_id": "1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d",
        "service_name": "Kubernetes"
    },
    "Kubernetes clusters should not allow container privilege escalation": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            }
        },
        "description": "This policy does not allow containers to use privilege escalation in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerNoPrivilegeEscalation.json",
        "github_version": "2.0.1",
        "name": "Kubernetes clusters should not allow container privilege escalation",
        "policy_id": "1c6e92c9-99f0-4e55-9cf2-0c234dc48f99",
        "service_name": "Kubernetes"
    },
    "Latest TLS version should be used in your API App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure web app is using the latest version of TLS encryption",
                "requirement_id": "9.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",
                "requirement_id": "ID : 0949.09y2Organizational.5 - 09.y"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Cryptography",
                "requirement": "17.4.16 Using TLS",
                "requirement_id": "CR-6"
            }
        },
        "description": "Upgrade to the latest TLS version",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Latest TLS version should be used in your API App",
        "policy_id": "8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e",
        "service_name": "App Service"
    },
    "Latest TLS version should be used in your Function App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure web app is using the latest version of TLS encryption",
                "requirement_id": "9.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",
                "requirement_id": "ID : 0949.09y2Organizational.5 - 09.y"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Cryptography",
                "requirement": "17.4.16 Using TLS",
                "requirement_id": "CR-6"
            }
        },
        "description": "Upgrade to the latest TLS version",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Latest TLS version should be used in your Function App",
        "policy_id": "f9d614c5-c173-4d56-95a7-b4437057d193",
        "service_name": "App Service"
    },
    "Latest TLS version should be used in your Web App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure web app is using the latest version of TLS encryption",
                "requirement_id": "9.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",
                "requirement_id": "ID : 0949.09y2Organizational.5 - 09.y"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Cryptography",
                "requirement": "17.4.16 Using TLS",
                "requirement_id": "CR-6"
            }
        },
        "description": "Upgrade to the latest TLS version",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Latest TLS version should be used in your Web App",
        "policy_id": "f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b",
        "service_name": "App Service"
    },
    "Linux machines should meet requirements for the Azure security baseline": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.",
                "requirement_id": "CM.2.061"
            }
        },
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines should meet the requirements for the Azure security baseline",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AzureLinuxBaseline_AINE.json",
        "github_version": "1.1.0-preview",
        "name": "Linux machines should meet requirements for the Azure security baseline",
        "policy_id": "fc9b3da7-8347-4380-8e70-0a0361d8dedd",
        "service_name": "Guest Configuration"
    },
    "Log Analytics agent health issues should be resolved on your machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Centralize security log management and analysis",
                "requirement_id": "LT-5"
            }
        },
        "description": "Security Center uses the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA). To make sure your virtual machines are successfully monitored, you need to make sure the agent is installed on the virtual machines and properly collects security events to the configured workspace.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ResolveLaHealthIssues.json",
        "github_version": "1.0.0",
        "name": "Log Analytics agent health issues should be resolved on your machines",
        "policy_id": "d62cfe2b-3ab0-4d41-980d-76803b58ca65",
        "service_name": "Security Center"
    },
    "Log Analytics agent should be installed on your Linux Azure Arc machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Centralize security log management and analysis",
                "requirement_id": "LT-5"
            }
        },
        "description": "This policy audits Linux Azure Arc machines if the Log Analytics agent is not installed.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Arc_Linux_LogAnalytics_Audit.json",
        "github_version": "1.0.0-preview",
        "name": "Log Analytics agent should be installed on your Linux Azure Arc machines",
        "policy_id": "842c54e8-c2f9-4d79-ae8d-38d8b8019373",
        "service_name": "Monitoring"
    },
    "Log Analytics agent should be installed on your Windows Azure Arc machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Centralize security log management and analysis",
                "requirement_id": "LT-5"
            }
        },
        "description": "This policy audits Windows Azure Arc machines if the Log Analytics agent is not installed.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Arc_Windows_LogAnalytics_Audit.json",
        "github_version": "1.0.0-preview",
        "name": "Log Analytics agent should be installed on your Windows Azure Arc machines",
        "policy_id": "d69b1763-b96d-40b8-a2d9-ca31e9fd0d3e",
        "service_name": "Monitoring"
    },
    "Log Analytics agent should be installed on your virtual machine for Azure Security Center monitoring": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Centralize security log management and analysis",
                "requirement_id": "LT-5"
            }
        },
        "description": "This policy audits any Windows/Linux virtual machines (VMs) if the Log Analytics agent is not installed which Security Center uses to monitor for security vulnerabilities and threats",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_InstallLaAgentOnVm.json",
        "github_version": "1.0.0",
        "name": "Log Analytics agent should be installed on your virtual machine for Azure Security Center monitoring",
        "policy_id": "a4fe33eb-e377-4efb-ab31-0784311bc499",
        "service_name": "Security Center"
    },
    "Log Analytics agent should be installed on your virtual machine scale sets for Azure Security Center monitoring": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Centralize security log management and analysis",
                "requirement_id": "LT-5"
            }
        },
        "description": "Security Center collects data from your Azure virtual machines (VMs) to monitor for security vulnerabilities and threats.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_InstallLaAgentOnVmss.json",
        "github_version": "1.0.0",
        "name": "Log Analytics agent should be installed on your virtual machine scale sets for Azure Security Center monitoring",
        "policy_id": "a3a6ea0c-e018-4933-9ef0-5aaa1501449b",
        "service_name": "Security Center"
    },
    "Log checkpoints should be enabled for PostgreSQL database servers": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server",
                "requirement_id": "4.3.3"
            }
        },
        "description": "This policy helps audit any PostgreSQL databases in your environment without log_checkpoints setting enabled.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableLogCheckpoint_Audit.json",
        "github_version": "1.0.0",
        "name": "Log checkpoints should be enabled for PostgreSQL database servers",
        "policy_id": "eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d",
        "service_name": "SQL"
    },
    "Log connections should be enabled for PostgreSQL database servers": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server",
                "requirement_id": "4.3.4"
            }
        },
        "description": "This policy helps audit any PostgreSQL databases in your environment without log_connections setting enabled.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableLogConnections_Audit.json",
        "github_version": "1.0.0",
        "name": "Log connections should be enabled for PostgreSQL database servers",
        "policy_id": "eb6f77b9-bd53-4e35-a23d-7f65d5f0e442",
        "service_name": "SQL"
    },
    "Long-term geo-redundant backup should be enabled for Azure SQL Databases": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Backup and Recovery",
                "requirement": "Encrypt backup data",
                "requirement_id": "BR-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Recovery",
                "requirement": "Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",
                "requirement_id": "RE.3.139"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Back-up",
                "requirement": "Automated tools are used to track all backups.",
                "requirement_id": "ID : 1621.09l2Organizational.1 - 09.l"
            }
        },
        "description": "This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json",
        "github_version": "2.0.0",
        "name": "Long-term geo-redundant backup should be enabled for Azure SQL Databases",
        "policy_id": "d38fc420-0735-4ef3-ac11-c806f651a570",
        "service_name": "SQL"
    },
    "MFA should be enabled accounts with write permissions on your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Use strong authentication controls for all Azure Active Directory based access",
                "requirement_id": "IM-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure that multi-factor authentication is enabled for all privileged users",
                "requirement_id": "1.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "Non-organizational users (all information system users other than organizational users, such as patients, customers, contractors, or foreign nationals), or processes acting on behalf of non-organizational users, determined to need access to information residing on the organization's information systems, are uniquely identified and authenticated.",
                "requirement_id": "ID : 11110.01q1Organizational.6 - 01.q"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Secure log-on procedures",
                "requirement_id": "A.9.4.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.",
                "requirement_id": "3.5.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts",
                "requirement_id": "IA-2 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.7.34 System Architecture and Security Controls",
                "requirement_id": "AC-17"
            }
        },
        "description": "Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "MFA should be enabled accounts with write permissions on your subscription",
        "policy_id": "9297c21d-2ed6-4474-b48f-163f75654ce3",
        "service_name": "Security Center"
    },
    "MFA should be enabled on accounts with owner permissions on your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Use strong authentication controls for all Azure Active Directory based access",
                "requirement_id": "IM-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure that multi-factor authentication is enabled for all privileged users",
                "requirement_id": "1.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "The organization ensures that redundant user IDs are not issued to other users and that all users are uniquely identified and authenticated for both local and remote access to information systems.",
                "requirement_id": "ID : 11109.01q1Organizational.57 - 01.q"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Secure log-on procedures",
                "requirement_id": "A.9.4.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.",
                "requirement_id": "3.5.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts",
                "requirement_id": "IA-2 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.7.34 System Architecture and Security Controls",
                "requirement_id": "AC-17"
            }
        },
        "description": "Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "MFA should be enabled on accounts with owner permissions on your subscription",
        "policy_id": "aa633080-8b72-40c4-a2d7-d00c03e80bed",
        "service_name": "Security Center"
    },
    "MFA should be enabled on accounts with read permissions on your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Use strong authentication controls for all Azure Active Directory based access",
                "requirement_id": "IM-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Identity and Access Management",
                "requirement": "Ensure that multi-factor authentication is enabled for all non-privileged users",
                "requirement_id": "1.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "When PKI-based authentication is used, the information system validates certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; enforces access to the corresponding private key; maps the identity to the corresponding account of the individual or group; and implements a local cache of revocation data to support path discovery and validation in case of an inability to access revocation information via the network.",
                "requirement_id": "ID : 11111.01q2System.4 - 01.q"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Secure log-on procedures",
                "requirement_id": "A.9.4.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.",
                "requirement_id": "3.5.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Identification and Authentication",
                "requirement": "Identification and Authentication (Organizational Users) | Network Access to Non-Privileged Accounts",
                "requirement_id": "IA-2 (2)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.7.34 System Architecture and Security Controls",
                "requirement_id": "AC-17"
            }
        },
        "description": "Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json",
        "github_version": "3.0.0",
        "name": "MFA should be enabled on accounts with read permissions on your subscription",
        "policy_id": "e3576e28-8b17-4677-84c3-db2990658d64",
        "service_name": "Security Center"
    },
    "Managed identity should be used in your API App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Manage application identities securely and automatically",
                "requirement_id": "IM-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that Register with Azure Active Directory is enabled on App Service",
                "requirement_id": "9.5"
            }
        },
        "description": "Use a managed identity for enhanced authentication security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_ApiApp_Audit.json",
        "github_version": "2.0.0",
        "name": "Managed identity should be used in your API App",
        "policy_id": "c4d441f8-f9d9-4a9e-9cef-e82117cb3eef",
        "service_name": "App Service"
    },
    "Managed identity should be used in your Function App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Manage application identities securely and automatically",
                "requirement_id": "IM-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that Register with Azure Active Directory is enabled on App Service",
                "requirement_id": "9.5"
            }
        },
        "description": "Use a managed identity for enhanced authentication security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_FunctionApp_Audit.json",
        "github_version": "2.0.0",
        "name": "Managed identity should be used in your Function App",
        "policy_id": "0da106f2-4ca3-48e8-bc85-c638fe6aea8f",
        "service_name": "App Service"
    },
    "Managed identity should be used in your Web App": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Manage application identities securely and automatically",
                "requirement_id": "IM-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure that Register with Azure Active Directory is enabled on App Service",
                "requirement_id": "9.5"
            }
        },
        "description": "Use a managed identity for enhanced authentication security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_WebApp_Audit.json",
        "github_version": "2.0.0",
        "name": "Managed identity should be used in your Web App",
        "policy_id": "2b9ad585-36bc-4615-b300-fd4435808332",
        "service_name": "App Service"
    },
    "Management ports of virtual machines should be protected with just-in-time network access control": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization monitors for all authorized and unauthorized wireless access to the information system and prohibits installation of wireless access points (WAPs) unless explicitly authorized in writing by the CIO or his/her designated representative.",
                "requirement_id": "ID : 0858.09m1Organizational.4 - 09.m"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Boundary Protection | External Telecommunications Services",
                "requirement_id": "SC-7 (4) Ownership : Microsoft"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.2.5 Protecting compartmented information on systems",
                "requirement_id": "AC-7"
            }
        },
        "description": "Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json",
        "github_version": "3.0.0",
        "name": "Management ports of virtual machines should be protected with just-in-time network access control",
        "policy_id": "b0f33259-77d7-4c9e-aac6-3aabcfae693c",
        "service_name": "Security Center"
    },
    "Management ports should be closed on your virtual machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Remote Diagnostic and Configuration Port Protection",
                "requirement": "Controls for the access to diagnostic and configuration ports include the use of a key lock and the implementation of supporting procedures to control physical access to the port.",
                "requirement_id": "ID : 1193.01l2Organizational.13 - 01.l"
            }
        },
        "description": "Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OpenManagementPortsOnVirtualMachines_Audit.json",
        "github_version": "3.0.0",
        "name": "Management ports should be closed on your virtual machines",
        "policy_id": "22730e10-96f6-4aac-ad84-9383d35b5917",
        "service_name": "Security Center"
    },
    "Microsoft Antimalware for Azure should be configured to automatically update protection signatures": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",
                "requirement_id": "SI.1.213"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Controls Against Malicious Code",
                "requirement": "Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",
                "requirement_id": "ID : 0201.09j1Organizational.124 - 09.j"
            }
        },
        "description": "This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_AntiMalwareAutoUpdate_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "Microsoft Antimalware for Azure should be configured to automatically update protection signatures",
        "policy_id": "c43e4a30-77cb-48ab-a4dd-93f175c63b57",
        "service_name": "Compute"
    },
    "Microsoft IaaSAntimalware extension should be deployed on Windows servers": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",
                "requirement_id": "SI.1.213"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Provide protection from malicious code at designated locations within organizational systems.",
                "requirement_id": "3.14.2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Software security",
                "requirement": "14.1.9 Maintaining hardened SOEs",
                "requirement_id": "SS-2"
            }
        },
        "description": "This policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/WindowsServers_AntiMalware_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "Microsoft IaaSAntimalware extension should be deployed on Windows servers",
        "policy_id": "9b597639-28e4-48eb-b506-56b05d366257",
        "service_name": "Compute"
    },
    "Monitor missing Endpoint Protection in Azure Security Center": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Endpoint Security",
                "requirement": "Ensure anti-malware software and signatures are updated",
                "requirement_id": "ES-3"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Virtual Machines",
                "requirement": "Ensure that the endpoint protection for all Virtual Machines is installed",
                "requirement_id": "7.6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",
                "requirement_id": "SI.1.213"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Controls Against Malicious Code",
                "requirement": "Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",
                "requirement_id": "ID : 0201.09j1Organizational.124 - 09.j"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Management of technical vulnerabilities",
                "requirement_id": "A.12.6.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Provide protection from malicious code at designated locations within organizational systems.",
                "requirement_id": "3.14.2"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Malicious Code Protection | Central Management",
                "requirement_id": "SI-3 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.3.10 Antivirus scans",
                "requirement_id": "DM-4"
            }
        },
        "description": "Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json",
        "github_version": "3.0.0",
        "name": "Monitor missing Endpoint Protection in Azure Security Center",
        "policy_id": "af6cd1bd-1635-48cb-bde7-5b15693900b9",
        "service_name": "Security Center"
    },
    "Network Watcher should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure network activities",
                "requirement_id": "LT-3"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Networking",
                "requirement": "Ensure that Network Watcher is 'Enabled'",
                "requirement_id": "6.5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify unauthorized use of organizational systems.",
                "requirement_id": "SI.2.217"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Security of Network Services",
                "requirement": "The contract with the external/outsourced service provider includes the specification that the service provider is responsible for the protection of covered information shared.",
                "requirement_id": "ID : 0888.09n2Organizational.6 - 09.n"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "3.14.6"
            }
        },
        "description": "Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json",
        "github_version": "1.1.0",
        "name": "Network Watcher should be enabled",
        "policy_id": "b6e2945c-0b7b-40f5-9233-7a5323b5cdc6",
        "service_name": "Network"
    },
    "Network traffic data collection agent should be installed on Linux virtual machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure network activities",
                "requirement_id": "LT-3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Security of Network Services",
                "requirement": "The organization reviews and updates the interconnection security agreements on an ongoing basis verifying enforcement of security requirements.",
                "requirement_id": "ID : 0885.09n2Organizational.3 - 09.n"
            }
        },
        "description": "Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Linux.json",
        "github_version": "1.0.1-preview",
        "name": "Network traffic data collection agent should be installed on Linux virtual machines",
        "policy_id": "04c4380f-3fae-46e8-96c9-30193528f602",
        "service_name": "Monitoring"
    },
    "Network traffic data collection agent should be installed on Windows virtual machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure network activities",
                "requirement_id": "LT-3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Security of Network Services",
                "requirement": "The organization requires external/outsourced service providers to identify the specific functions, ports, and protocols used in the provision of the external/outsourced services.",
                "requirement_id": "ID : 0887.09n2Organizational.5 - 09.n"
            }
        },
        "description": "Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Windows.json",
        "github_version": "1.0.1-preview",
        "name": "Network traffic data collection agent should be installed on Windows virtual machines",
        "policy_id": "2f2ee1de-44aa-4762-b6bd-0893fc3f306d",
        "service_name": "Monitoring"
    },
    "Non-internet-facing virtual machines should be protected with network security groups": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Protect your non-internet-facing virtual machines from potential threats by restricting access with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternalVirtualMachines_Audit.json",
        "github_version": "3.0.0",
        "name": "Non-internet-facing virtual machines should be protected with network security groups",
        "policy_id": "bb91dfba-c30d-4263-9add-9c2384e659a6",
        "service_name": "Security Center"
    },
    "Only approved VM extensions should be installed": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Virtual Machines",
                "requirement": "Ensure that only approved extensions are installed",
                "requirement_id": "7.4"
            }
        },
        "description": "This policy governs the virtual machine extensions that are not approved.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_ApprovedExtensions_Audit.json",
        "github_version": "1.0.0",
        "name": "Only approved VM extensions should be installed",
        "policy_id": "c0e996f8-39cf-4af9-9f45-83fbde810432",
        "service_name": "Compute"
    },
    "Only secure connections to your Azure Cache for Redis should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "SC.3.185"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The organization requires the use of encryption between, and the use of electronic signatures by, each of the parties involved in the transaction.",
                "requirement_id": "ID : 0946.09y2Organizational.14 - 09.y"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Communications security",
                "requirement": "Information transfer policies and procedures",
                "requirement_id": "A.13.2.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "3.13.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection",
                "requirement_id": "SC-8 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json",
        "github_version": "1.0.0",
        "name": "Only secure connections to your Azure Cache for Redis should be enabled",
        "policy_id": "22bee202-a82f-4305-9a2a-6d7f44d4dedb",
        "service_name": "Cache"
    },
    "Private endpoint connections on Azure SQL Database should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Private endpoint connections enforce secure communication by enabling private connectivity to Azure SQL Database.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PrivateEndpoint_Audit.json",
        "github_version": "1.1.0",
        "name": "Private endpoint connections on Azure SQL Database should be enabled",
        "policy_id": "7698e800-9299-47a6-b3b6-5a0fee576eed",
        "service_name": "SQL"
    },
    "Private endpoint should be configured for Key Vault": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Private link provides a way to connect Key Vault to your Azure resources without sending traffic over the public internet. Private link provides defense in depth protection against data exfiltration.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultPrivateEndpointEnabled_Audit.json",
        "github_version": "1.1.0-preview",
        "name": "Private endpoint should be configured for Key Vault",
        "policy_id": "5f0bc445-3935-4915-9981-011aa2b46147",
        "service_name": "Key Vault"
    },
    "Private endpoint should be enabled for MariaDB servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MariaDB. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_EnablePrivateEndPoint_Audit.json",
        "github_version": "1.0.2",
        "name": "Private endpoint should be enabled for MariaDB servers",
        "policy_id": "0a1302fb-a631-4106-9753-f3d494733990",
        "service_name": "SQL"
    },
    "Private endpoint should be enabled for MySQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MySQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnablePrivateEndPoint_Audit.json",
        "github_version": "1.0.2",
        "name": "Private endpoint should be enabled for MySQL servers",
        "policy_id": "7595c971-233d-4bcf-bd18-596129188c49",
        "service_name": "SQL"
    },
    "Private endpoint should be enabled for PostgreSQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for PostgreSQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnablePrivateEndPoint_Audit.json",
        "github_version": "1.0.2",
        "name": "Private endpoint should be enabled for PostgreSQL servers",
        "policy_id": "0564d078-92f5-4f97-8398-b9f58a51f70b",
        "service_name": "SQL"
    },
    "Public network access on Azure SQL Database should be disabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json",
        "github_version": "1.1.0",
        "name": "Public network access on Azure SQL Database should be disabled",
        "policy_id": "1b8ca024-1d5c-4dec-8995-b1a932b41780",
        "service_name": "SQL"
    },
    "Public network access should be disabled for Cognitive Services accounts": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json",
        "github_version": "1.0.0",
        "name": "Public network access should be disabled for Cognitive Services accounts",
        "policy_id": "0725b4dd-7e76-479c-a735-68e7ee23d5ca",
        "service_name": "Cognitive Services"
    },
    "Public network access should be disabled for MariaDB servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json",
        "github_version": "1.0.2",
        "name": "Public network access should be disabled for MariaDB servers",
        "policy_id": "fdccbe47-f3e3-4213-ad5d-ea459b2fa077",
        "service_name": "SQL"
    },
    "Public network access should be disabled for MySQL flexible servers": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json",
        "github_version": "1.0.0",
        "name": "Public network access should be disabled for MySQL flexible servers",
        "policy_id": "c9299215-ae47-4f50-9c54-8a392f68a052",
        "service_name": "SQL"
    },
    "Public network access should be disabled for MySQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json",
        "github_version": "1.0.2",
        "name": "Public network access should be disabled for MySQL servers",
        "policy_id": "d9844e8a-1437-4aeb-a32c-0c992f056095",
        "service_name": "SQL"
    },
    "Public network access should be disabled for PostgreSQL flexible servers": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json",
        "github_version": "1.0.0",
        "name": "Public network access should be disabled for PostgreSQL flexible servers",
        "policy_id": "5e1de0e3-42cb-4ebc-a86d-61d0c619ca48",
        "service_name": "SQL"
    },
    "Public network access should be disabled for PostgreSQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json",
        "github_version": "1.0.2",
        "name": "Public network access should be disabled for PostgreSQL servers",
        "policy_id": "b52376f7-9612-48a1-81cd-1ffe4b61032c",
        "service_name": "SQL"
    },
    "RDP access from the Internet should be blocked": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Networking",
                "requirement": "Ensure that RDP access is restricted from the internet",
                "requirement_id": "6.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Control the flow of CUI in accordance with approved authorizations.",
                "requirement_id": "AC.2.016"
            }
        },
        "description": "This policy audits any network security rule that allows RDP access from Internet",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json",
        "github_version": "2.0.0",
        "name": "RDP access from the Internet should be blocked",
        "policy_id": "e372f825-a257-4fb8-9175-797a8a8627d6",
        "service_name": "Network"
    },
    "Remote debugging should be turned off for API Apps": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",
                "requirement_id": "CM.3.068"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "The organization ensures that communication protection requirements, including the security of exchanges of information, is the subject of policy development and compliance audits.",
                "requirement_id": "ID : 0914.09s1Organizational.6 - 09.s"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Monitor and control remote access sessions.",
                "requirement_id": "3.1.12"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Remote Access | Automated Monitoring / Control",
                "requirement_id": "AC-17 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.2.5 Protecting compartmented information on systems",
                "requirement_id": "AC-7"
            }
        },
        "description": "Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Remote debugging should be turned off for API Apps",
        "policy_id": "e9c8d085-d9cc-4b17-9cdc-059f1f01f19e",
        "service_name": "App Service"
    },
    "Remote debugging should be turned off for Function Apps": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",
                "requirement_id": "CM.3.068"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "Personnel are appropriately trained on leading principles and practices for all types of information exchange (oral, paper and electronic).",
                "requirement_id": "ID : 1325.09s1Organizational.3 - 09.s"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Monitor and control remote access sessions.",
                "requirement_id": "3.1.12"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Remote Access | Automated Monitoring / Control",
                "requirement_id": "AC-17 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.2.5 Protecting compartmented information on systems",
                "requirement_id": "AC-7"
            }
        },
        "description": "Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Remote debugging should be turned off for Function Apps",
        "policy_id": "0e60b895-3786-45da-8377-9c6b4b6ac5f9",
        "service_name": "App Service"
    },
    "Remote debugging should be turned off for Web Applications": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for Azure services",
                "requirement_id": "PV-2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",
                "requirement_id": "CM.3.068"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Information Exchange Policies and Procedures",
                "requirement": "Cryptography is used to protect the confidentiality and integrity of remote access sessions to the internal network and to external systems.",
                "requirement_id": "ID : 0912.09s1Organizational.4 - 09.s"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Monitor and control remote access sessions.",
                "requirement_id": "3.1.12"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Remote Access | Automated Monitoring / Control",
                "requirement_id": "AC-17 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.2.5 Protecting compartmented information on systems",
                "requirement_id": "AC-7"
            }
        },
        "description": "Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json",
        "github_version": "1.0.0",
        "name": "Remote debugging should be turned off for Web Applications",
        "policy_id": "cb510bfd-1cba-4d9f-a230-cb0976f4bb71",
        "service_name": "App Service"
    },
    "Require encryption on Data Lake Store accounts": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Management of Removable Media",
                "requirement": "The organization restricts the use of writable removable media and personally-owned removable media in organizational systems.",
                "requirement_id": "ID : 0304.09o3Organizational.1 - 09.o"
            }
        },
        "description": "This policy ensures encryption is enabled on all Data Lake Store accounts",
        "effects": "deny",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStoreEncryption_Deny.json",
        "github_version": "1.0.0",
        "name": "Require encryption on Data Lake Store accounts",
        "policy_id": "a7ff3161-0087-490a-9ad9-ad6217f4f43a",
        "service_name": "Data Lake"
    },
    "Resource logs in Azure Data Lake Store should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "A secure audit record is created for all activities on the system (create, read, update, delete) involving covered information.",
                "requirement_id": "ID : 1202.09aa1System.1 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStore_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Azure Data Lake Store should be enabled",
        "policy_id": "057ef27e-665e-4328-8ea3-04b3122bd9fb",
        "service_name": "Data Lake"
    },
    "Resource logs in Azure Key Vault Managed HSM should be enabled": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "The organization verifies every ninety (90) days for each extract of covered information recorded that the data is erased or its use is still required.",
                "requirement_id": "ID : 1211.09aa3System.4 - 09.aa"
            }
        },
        "description": "To recreate activity trails for investigation purposes when a security incident occurs or when your network is compromised, you may want to audit by enabling resource logs on Managed HSMs. Please follow the instructions here: https://docs.microsoft.com/azure/key-vault/managed-hsm/logging .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/ManagedHsm_AuditDiagnosticLog_Audit.json",
        "github_version": "1.0.0",
        "name": "Resource logs in Azure Key Vault Managed HSM should be enabled",
        "policy_id": "a2a5b911-5617-447e-a49e-59dbe0e0434b",
        "service_name": "Key Vault"
    },
    "Resource logs in Azure Stream Analytics should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Audit records are retained for 90 days and older audit records are archived for one year.",
                "requirement_id": "ID : 1207.09aa2System.4 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Stream%20Analytics/StreamAnalytics_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Azure Stream Analytics should be enabled",
        "policy_id": "f9be5368-9bf5-4b84-9e0a-7850da98bb46",
        "service_name": "Stream Analytics"
    },
    "Resource logs in Batch accounts should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Logs of messages sent and received are maintained including the date, time, origin and destination of the message, but not its contents.",
                "requirement_id": "ID : 1205.09aa2System.1 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Batch/Batch_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Batch accounts should be enabled",
        "policy_id": "428256e6-1fac-4f48-a757-df34c2b3336d",
        "service_name": "Batch"
    },
    "Resource logs in Data Lake Analytics should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender.",
                "requirement_id": "ID : 1210.09aa3System.3 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeAnalytics_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Data Lake Analytics should be enabled",
        "policy_id": "c95c74d9-38fe-4f0d-af86-0c7d626a315c",
        "service_name": "Data Lake"
    },
    "Resource logs in Event Hub should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Audit records are retained for 90 days and older audit records are archived for one year.",
                "requirement_id": "ID : 1207.09aa2System.4 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Hub/EventHub_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Event Hub should be enabled",
        "policy_id": "83a214f7-d01a-484b-91a9-ed54470c9a6a",
        "service_name": "Event Hub"
    },
    "Resource logs in IoT Hub should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "The activities of privileged users (administrators, operators, etc.) include the success/failure of the event, time the event occurred, the account involved, the processes involved, and additional information about the event.",
                "requirement_id": "ID : 1204.09aa1System.3 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Internet%20of%20Things/IoTHub_AuditDiagnosticLog_Audit.json",
        "github_version": "3.0.1",
        "name": "Resource logs in IoT Hub should be enabled",
        "policy_id": "383856f8-de7f-44a2-81fc-e5135b5c2aa4",
        "service_name": "Internet of Things"
    },
    "Resource logs in Key Vault should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "The organization verifies every ninety (90) days for each extract of covered information recorded that the data is erased or its use is still required.",
                "requirement_id": "ID : 1211.09aa3System.4 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Key Vault should be enabled",
        "policy_id": "cf820ca0-f99e-4f3e-84fb-66e913812d21",
        "service_name": "Key Vault"
    },
    "Resource logs in Logic Apps should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Audit records include the unique user ID, unique data subject ID, function performed, and date/time the event was performed.",
                "requirement_id": "ID : 1203.09aa1System.2 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Logic%20Apps/LogicApps_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Logic Apps should be enabled",
        "policy_id": "34f95f76-5386-4de7-b824-0d8478470c9d",
        "service_name": "Logic Apps"
    },
    "Resource logs in Search services should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes.",
                "requirement_id": "ID : 1208.09aa3System.1 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Search/Search_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Search services should be enabled",
        "policy_id": "b4330a05-a843-4bc8-bf9a-cacce50c67f4",
        "service_name": "Search"
    },
    "Resource logs in Service Bus should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes.",
                "requirement_id": "ID : 1208.09aa3System.1 - 09.aa"
            }
        },
        "description": "Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Bus/ServiceBus_AuditDiagnosticLog_Audit.json",
        "github_version": "4.0.1",
        "name": "Resource logs in Service Bus should be enabled",
        "policy_id": "f8d36e2f-389b-4ee4-898d-21aeb69a0f45",
        "service_name": "Service Bus"
    },
    "Resource logs in Virtual Machine Scale Sets should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Logging and Threat Detection",
                "requirement": "Enable logging for Azure resources",
                "requirement_id": "LT-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure that Diagnostic Logs are enabled for all services which support it.",
                "requirement_id": "5.3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "Auditing is always available while the system is active and tracks key events, success/failed data access, system security configuration changes, privileged or utility use, any alarms raised,  activation and de-activation of protection systems (e.g., A/V and IDS), activation and deactivation of identification and authentication mechanisms, and creation and deletion of system-level objects.",
                "requirement_id": "ID : 1206.09aa2System.23 - 09.aa"
            }
        },
        "description": "It is recommended to enable Logs so that activity trail can be recreated when investigations are required in the event of an incident or a compromise.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ServiceFabric_and_VMSS_AuditVMSSDiagnostics.json",
        "github_version": "2.0.1",
        "name": "Resource logs in Virtual Machine Scale Sets should be enabled",
        "policy_id": "7c1b1214-f927-48bf-8882-84f0af6588b1",
        "service_name": "Compute"
    },
    "Role-Based Access Control (RBAC) should be used on Kubernetes Services": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Follow just enough administration (least privilege principle)",
                "requirement_id": "PA-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Other Security Considerations",
                "requirement": "Enable role-based access control (RBAC) within Azure Kubernetes Services",
                "requirement_id": "8.5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.",
                "requirement_id": "CM.2.062"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation of Duties",
                "requirement": "Separation of duties is used to limit the risk of unauthorized or unintentional modification of information and systems.",
                "requirement_id": "ID : 1229.09c1Organizational.1 - 09.c"
            }
        },
        "description": "To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json",
        "github_version": "1.0.2",
        "name": "Role-Based Access Control (RBAC) should be used on Kubernetes Services",
        "policy_id": "ac4a19c2-fa67-49b4-8ae5-0b2e78c49457",
        "service_name": "Security Center"
    },
    "SQL Server should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization ensures information systems protect the confidentiality and integrity of transmitted information, including during preparation for transmission and during reception.",
                "requirement_id": "ID : 0862.09m2Organizational.8 - 09.m"
            }
        },
        "description": "This policy audits any SQL Server not configured to use a virtual network service endpoint.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_SQLServer_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "SQL Server should use a virtual network service endpoint",
        "policy_id": "ae5d2f14-d830-42b6-9899-df6cfe9c71a3",
        "service_name": "Network"
    },
    "SQL managed instances should use customer-managed keys to encrypt data at rest": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure SQL server's TDE protector is encrypted with Customer-managed key",
                "requirement_id": "4.5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Management of Removable Media",
                "requirement": "The organization restricts the use of writable removable media and personally-owned removable media in organizational systems.",
                "requirement_id": "ID : 0304.09o3Organizational.1 - 09.o"
            }
        },
        "description": "Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json",
        "github_version": "1.0.2",
        "name": "SQL managed instances should use customer-managed keys to encrypt data at rest",
        "policy_id": "048248b0-55cd-46da-b1ff-39efd52db260",
        "service_name": "SQL"
    },
    "SQL servers should be configured with 90 days auditing retention or higher": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that 'Auditing' Retention is 'greater than 90 days'",
                "requirement_id": "4.1.3"
            }
        },
        "description": "SQL servers should be configured with 90 days auditing retention or higher.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditingRetentionDays_Audit.json",
        "github_version": "2.0.1",
        "name": "SQL servers should be configured with 90 days auditing retention or higher",
        "policy_id": "89099bee-89e0-4b26-a5f4-165451757743",
        "service_name": "SQL"
    },
    "SQL servers should use customer-managed keys to encrypt data at rest": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure SQL server's TDE protector is encrypted with Customer-managed key",
                "requirement_id": "4.5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Management of Removable Media",
                "requirement": "The organization restricts the use of writable removable media and personally-owned removable media in organizational systems.",
                "requirement_id": "ID : 0304.09o3Organizational.1 - 09.o"
            }
        },
        "description": "Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json",
        "github_version": "2.0.1",
        "name": "SQL servers should use customer-managed keys to encrypt data at rest",
        "policy_id": "0d134df8-db83-46fb-ad72-fe0c9428c8dd",
        "service_name": "SQL"
    },
    "SSH access from the Internet should be blocked": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Networking",
                "requirement": "Ensure that SSH access is restricted from the internet",
                "requirement_id": "6.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Verify and control/limit connections to and use of external information systems.",
                "requirement_id": "AC.1.003"
            }
        },
        "description": "This policy audits any network security rule that allows SSH access from Internet",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_SSHAccess_Audit.json",
        "github_version": "2.0.0",
        "name": "SSH access from the Internet should be blocked",
        "policy_id": "2c89a2e5-7285-40fe-afe0-ae8654b92fab",
        "service_name": "Network"
    },
    "Secure transfer to storage accounts should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Storage Accounts",
                "requirement": "Ensure that 'Secure transfer required' is set to 'Enabled'",
                "requirement_id": "3.1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "SC.3.185"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "Data involved in electronic commerce and online transactions is checked to determine if it contains covered information.",
                "requirement_id": "ID : 0943.09y1Organizational.1 - 09.y"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Communications security",
                "requirement": "Information transfer policies and procedures",
                "requirement_id": "A.13.2.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "3.13.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection",
                "requirement_id": "SC-8 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json",
        "github_version": "2.0.0",
        "name": "Secure transfer to storage accounts should be enabled",
        "policy_id": "404c3081-a854-4457-ae30-26a93ef643f9",
        "service_name": "Storage"
    },
    "Security Center standard pricing tier should be selected": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Management",
                "requirement": "Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",
                "requirement_id": "RM.3.144"
            }
        },
        "description": "The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json",
        "github_version": "1.0.0",
        "name": "Security Center standard pricing tier should be selected",
        "policy_id": "a1181c5f-672a-477a-979a-7d58aa086233",
        "service_name": "Security Center"
    },
    "Sensitive data in your SQL databases should be classified": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Discovery, classify and label sensitive data",
                "requirement_id": "DP-1"
            }
        },
        "description": "Azure Security Center monitors the data discovery and classification scan results for your SQL databases and provides recommendations to classify the sensitive data in your databases for better monitoring and security",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbDataClassification_Audit.json",
        "github_version": "3.0.0-preview",
        "name": "Sensitive data in your SQL databases should be classified",
        "policy_id": "cc9835f2-9f6b-4cc8-ab4a-f8ef615eb349",
        "service_name": "Security Center"
    },
    "Service Bus should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization formally manages equipment on the network, including equipment in user areas.",
                "requirement_id": "ID : 0860.09m1Organizational.9 - 09.m"
            }
        },
        "description": "This policy audits any Service Bus not configured to use a virtual network service endpoint.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ServiceBus_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "Service Bus should use a virtual network service endpoint",
        "policy_id": "235359c5-7c52-4b82-9055-01c75cf9f60e",
        "service_name": "Network"
    },
    "Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            }
        },
        "description": "Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json",
        "github_version": "1.1.0",
        "name": "Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign",
        "policy_id": "617c02be-7f02-4efd-8836-3180d47b6c68",
        "service_name": "Service Fabric"
    },
    "Service Fabric clusters should only use Azure Active Directory for client authentication": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Standardize Azure Active Directory as the central identity and authentication system",
                "requirement_id": "IM-1"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Management of privileged access rights",
                "requirement_id": "A.9.2.3"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Account Management | Role-Based Schemes",
                "requirement_id": "AC-2 (7)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.32 System User Identification",
                "requirement_id": "AC-2"
            }
        },
        "description": "Audit usage of client authentication only via Azure Active Directory in Service Fabric",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditADAuth_Audit.json",
        "github_version": "1.1.0",
        "name": "Service Fabric clusters should only use Azure Active Directory for client authentication",
        "policy_id": "b54ed75b-3e1a-44ac-a333-05ba39b99ff0",
        "service_name": "Service Fabric"
    },
    "Service principals should be used to protect your subscriptions instead of management certificates": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Identity Management",
                "requirement": "Manage application identities securely and automatically",
                "requirement_id": "IM-2"
            }
        },
        "description": "Management certificates allow anyone who authenticates with them to manage the subscription(s) they are associated with. To manage subscriptions more securely, use of service principals with Resource Manager is recommended to limit the impact of a certificate compromise.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UseServicePrincipalToProtectSubscriptions.json",
        "github_version": "1.0.0",
        "name": "Service principals should be used to protect your subscriptions instead of management certificates",
        "policy_id": "6646a0bd-e110-40ca-bb97-84fcee63c414",
        "service_name": "Security Center"
    },
    "Storage Accounts should use a virtual network service endpoint": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "Wireless access points are placed in secure areas and shut down when not in use (e.g. nights, weekends).",
                "requirement_id": "ID : 0867.09m3Organizational.17 - 09.m"
            }
        },
        "description": "This policy audits any Storage Account not configured to use a virtual network service endpoint.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_StorageAccount_Audit.json",
        "github_version": "1.0.0",
        "name": "Storage Accounts should use a virtual network service endpoint",
        "policy_id": "60d21c4f-21a3-4d94-85f4-b924e6aeeda4",
        "service_name": "Network"
    },
    "Storage account containing the container with activity logs must be encrypted with BYOK": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key)",
                "requirement_id": "5.1.4"
            }
        },
        "description": "This policy audits if the Storage account containing the container with activity logs is encrypted with BYOK. The policy works only if the storage account lies on the same subscription as activity logs by design. More information on Azure Storage encryption at rest can be found here https://aka.ms/azurestoragebyok .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_StorageAccountBYOK_Audit.json",
        "github_version": "1.0.0",
        "name": "Storage account containing the container with activity logs must be encrypted with BYOK",
        "policy_id": "fbb99e8e-e444-4da0-9ff1-75c92f5a85b2",
        "service_name": "Monitoring"
    },
    "Storage account public access should be disallowed": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Protect sensitive data",
                "requirement_id": "DP-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Logging and Monitoring",
                "requirement": "Ensure the storage container storing the activity logs is not publicly accessible",
                "requirement_id": "5.1.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.1.13 Limiting network access",
                "requirement_id": "NS-2"
            }
        },
        "description": "Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.",
        "effects": "audit, deny, disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json",
        "github_version": "2.0.1-preview",
        "name": "Storage account public access should be disallowed",
        "policy_id": "4fa4b6c0-31ca-4c0d-b10d-24b96f62a751",
        "service_name": "Storage"
    },
    "Storage account should use a private link connection": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Private links enforce secure communication, by providing private connectivity to the storage account",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountPrivateEndpointEnabled_Audit.json",
        "github_version": "1.0.0",
        "name": "Storage account should use a private link connection",
        "policy_id": "6edd7eda-6dd8-40f7-810d-67160c639cd9",
        "service_name": "Storage"
    },
    "Storage accounts should allow access from trusted Microsoft services": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Storage Accounts",
                "requirement": "Ensure 'Trusted Microsoft Services' is enabled for Storage Account access",
                "requirement_id": "3.7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            }
        },
        "description": "Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccess_TrustedMicrosoftServices_Audit.json",
        "github_version": "1.0.0",
        "name": "Storage accounts should allow access from trusted Microsoft services",
        "policy_id": "c9d007d0-c057-4772-b18c-01e546713bcd",
        "service_name": "Storage"
    },
    "Storage accounts should be migrated to new Azure Resource Manager resources": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Asset Management",
                "requirement": "Use only approved Azure services",
                "requirement_id": "AM-3"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Access to networks and network services",
                "requirement_id": "A.9.1.2"
            }
        },
        "description": "Use new Azure Resource Manager for your storage accounts to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Classic_AuditForClassicStorages_Audit.json",
        "github_version": "1.0.0",
        "name": "Storage accounts should be migrated to new Azure Resource Manager resources",
        "policy_id": "37e0d2fe-28a5-43d6-a273-67d37d1f5606",
        "service_name": "Storage"
    },
    "Storage accounts should have infrastructure encryption": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            }
        },
        "description": "Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json",
        "github_version": "1.0.0",
        "name": "Storage accounts should have infrastructure encryption",
        "policy_id": "4733ea7b-a883-42fe-8cac-97454c2a9e4a",
        "service_name": "Storage"
    },
    "Storage accounts should restrict network access": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Storage Accounts",
                "requirement": "Ensure default network access rule for Storage Accounts is set to deny",
                "requirement_id": "3.6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization describes the groups, roles, and responsibilities for the logical management of network components and ensures coordination of and consistency in the elements of the network infrastructure.",
                "requirement_id": "ID : 0866.09m3Organizational.1516 - 09.m"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Communications security",
                "requirement": "Network controls",
                "requirement_id": "A.13.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.",
                "requirement_id": "3.13.5"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Boundary Protection",
                "requirement_id": "SC-7"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.1.13 Limiting network access",
                "requirement_id": "NS-2"
            }
        },
        "description": "Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json",
        "github_version": "1.1.1",
        "name": "Storage accounts should restrict network access",
        "policy_id": "34c877ad-507e-4c82-993e-3452a6e0ad3c",
        "service_name": "Storage"
    },
    "Storage accounts should restrict network access using virtual network rules": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Implement security for internal traffic",
                "requirement_id": "NS-1"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Storage Accounts",
                "requirement": "Ensure default network access rule for Storage Accounts is set to deny",
                "requirement_id": "3.6"
            }
        },
        "description": "Protect your storage accounts from potential threats using virtual network rules as a preferred method instead of IP-based filtering. Disabling IP-based filtering prevents public IPs from accessing your storage accounts.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountOnlyVnetRulesEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "Storage accounts should restrict network access using virtual network rules",
        "policy_id": "2a1a9cdf-e04d-429a-8416-3bfb72a1b26f",
        "service_name": "Storage"
    },
    "Storage accounts should use customer-managed key for encryption": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Storage Accounts",
                "requirement": "Ensure storage for critical data are encrypted with Customer Managed Key",
                "requirement_id": "3.9"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.",
                "requirement_id": "SC.3.177"
            }
        },
        "description": "Secure your storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json",
        "github_version": "1.0.2",
        "name": "Storage accounts should use customer-managed key for encryption",
        "policy_id": "6fac406b-40ca-413b-bf8e-0bf964659c25",
        "service_name": "Storage"
    },
    "Subnets should be associated with a Network Security Group": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Connection Control",
                "requirement": "The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.",
                "requirement_id": "ID : 0814.01n1Organizational.12 - 01.n"
            }
        },
        "description": "Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json",
        "github_version": "3.0.0",
        "name": "Subnets should be associated with a Network Security Group",
        "policy_id": "e71308d3-144b-4262-b144-efdc3cc90517",
        "service_name": "Security Center"
    },
    "Subscriptions should have a contact email address for security issues": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Incident Response",
                "requirement": "Preparation - setup incident notification",
                "requirement_id": "IR-2"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Security Center",
                "requirement": "Ensure 'Additional email addresses' is configured with a security contact email",
                "requirement_id": "2.13"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "3.14.6"
            }
        },
        "description": "To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json",
        "github_version": "1.0.1",
        "name": "Subscriptions should have a contact email address for security issues",
        "policy_id": "4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7",
        "service_name": "Security Center"
    },
    "System updates on virtual machine scale sets should be installed": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Audit Logging",
                "requirement": "A secure audit record is created for all activities on the system (create, read, update, delete) involving covered information.",
                "requirement_id": "ID : 1202.09aa1System.1 - 09.aa"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Flaw Remediation",
                "requirement_id": "SI-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Product Security",
                "requirement": "12.4.4 Patching vulnerabilities in products",
                "requirement_id": "PRS-5"
            }
        },
        "description": "Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json",
        "github_version": "3.0.0",
        "name": "System updates on virtual machine scale sets should be installed",
        "policy_id": "c3f317a7-a95c-4547-b7e7-11017ebdf2fe",
        "service_name": "Security Center"
    },
    "System updates should be installed on your machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Rapidly and automatically remediate software vulnerabilities",
                "requirement_id": "PV-7"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Virtual Machines",
                "requirement": "Ensure that the latest OS Patches for all Virtual Machines are applied",
                "requirement_id": "7.5"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Controls Against Malicious Code",
                "requirement": "Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",
                "requirement_id": "ID : 0201.09j1Organizational.124 - 09.j"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Management of technical vulnerabilities",
                "requirement_id": "A.12.6.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Flaw Remediation",
                "requirement_id": "SI-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Product Security",
                "requirement": "12.4.4 Patching vulnerabilities in products",
                "requirement_id": "PRS-5"
            }
        },
        "description": "Missing security system updates on your servers will be monitored by Azure Security Center as recommendations",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json",
        "github_version": "3.0.0",
        "name": "System updates should be installed on your machines",
        "policy_id": "86b3d65f-7626-441e-b690-81a8b71cff60",
        "service_name": "Security Center"
    },
    "The Log Analytics agent should be installed on Virtual Machine Scale Sets": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Monitoring System Use",
                "requirement": "Automated systems are used to review monitoring activities of security systems (e.g., IPS/IDS) and system records on a daily basis, and identify and document anomalies.",
                "requirement_id": "ID : 1216.09ab3System.12 - 09.ab"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",
                "requirement_id": "3.3.2"
            }
        },
        "description": "This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "The Log Analytics agent should be installed on Virtual Machine Scale Sets",
        "policy_id": "efbde977-ba53-4479-b8e9-10b957924fbf",
        "service_name": "Monitoring"
    },
    "The Log Analytics agent should be installed on virtual machines": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Monitoring System Use",
                "requirement": "Auditing and monitoring systems employed by the organization support audit reduction and report generation.",
                "requirement_id": "ID : 1215.09ab2System.7 - 09.ab"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",
                "requirement_id": "3.3.2"
            }
        },
        "description": "This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json",
        "github_version": "1.0.0",
        "name": "The Log Analytics agent should be installed on virtual machines",
        "policy_id": "a70ca396-0a34-413a-88e1-b956c1e683be",
        "service_name": "Monitoring"
    },
    "There should be more than one owner assigned to your subscription": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Privileged Access",
                "requirement": "Protect and limit highly privileged users",
                "requirement_id": "PA-1"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Separate user functionality from system management functionality.",
                "requirement_id": "SC.3.181"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "User Identification and Authentication",
                "requirement": "The organization requires that electronic signatures, unique to one individual, cannot be reused by, or reassigned to, anyone else.",
                "requirement_id": "ID : 11208.01q1Organizational.8 - 01.q"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Organization of information security",
                "requirement": "Segregation of Duties",
                "requirement_id": "A.6.1.2"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Access Control",
                "requirement": "Separate the duties of individuals to reduce the risk of malevolent activity without collusion.",
                "requirement_id": "3.1.4"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "Access Control",
                "requirement": "Least Privilege | Review of User Privileges",
                "requirement_id": "AC-6 (7)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.32 System User Identification",
                "requirement_id": "AC-2"
            }
        },
        "description": "It is recommended to designate more than one subscription owner in order to have administrator access redundancy.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json",
        "github_version": "3.0.0",
        "name": "There should be more than one owner assigned to your subscription",
        "policy_id": "09024ccc-0c5f-475e-9457-b7c0d9ed487b",
        "service_name": "Security Center"
    },
    "Transparent Data Encryption on SQL databases should be enabled": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive data at rest",
                "requirement_id": "DP-5"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that 'Data encryption' is set to 'On' on a SQL Database",
                "requirement_id": "4.1.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Management of Removable Media",
                "requirement": "The organization, based on the data classification level, registers media (including laptops) prior to use, places reasonable restrictions on how such media be used, and provides an appropriate level of physical and logical protection (including encryption) for media containing covered information until properly destroyed or sanitized.",
                "requirement_id": "ID : 0301.09o1Organizational.123 - 09.o"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "3.13.16"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Protection of Information at Rest | Cryptographic Protection",
                "requirement_id": "SC-28 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json",
        "github_version": "1.0.0",
        "name": "Transparent Data Encryption on SQL databases should be enabled",
        "policy_id": "17k78e20-9358-41c9-923c-fb736d382a12",
        "service_name": "SQL"
    },
    "Unattached disks should be encrypted": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Virtual Machines",
                "requirement": "Ensure that 'Unattached disks' are encrypted with CMK",
                "requirement_id": "7.3"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the confidentiality of CUI at rest.",
                "requirement_id": "SC.3.191"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Management of Removable Media",
                "requirement": "Digital and non-digital media requiring restricted use and the specific safeguards used to restrict their use are identified.",
                "requirement_id": "ID : 0303.09o2Organizational.2 - 09.o"
            }
        },
        "description": "This policy audits any unattached disk without encryption enabled.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/UnattachedDisk_Encryption_Audit.json",
        "github_version": "1.0.0",
        "name": "Unattached disks should be encrypted",
        "policy_id": "2c89a2e5-7285-40fe-afe0-ae8654b92fb2",
        "service_name": "Compute"
    },
    "VM Image Builder templates should use private link": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Establish private network access to Azure services",
                "requirement_id": "NS-3"
            }
        },
        "description": "Audit VM Image Builder templates that do not have a virtual network configured. When a virtual network is not configured, a public IP is created and used instead which may directly expose resources to the internet and increase the potential attack surface.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/VM%20Image%20Builder/PrivateLinkEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "VM Image Builder templates should use private link",
        "policy_id": "2154edb9-244f-4741-9970-660785bccdaa",
        "service_name": "VM Image Builder"
    },
    "Virtual machines should be connected to an approved virtual network": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Connection Control",
                "requirement": "The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.",
                "requirement_id": "ID : 0814.01n1Organizational.12 - 01.n"
            }
        },
        "description": "This policy audits any virtual machine connected to a virtual network that is not approved.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json",
        "github_version": "1.0.0",
        "name": "Virtual machines should be connected to an approved virtual network",
        "policy_id": "d416745a-506c-48b6-8ab1-83cb814bcaa3",
        "service_name": "Network"
    },
    "Virtual machines should be migrated to new Azure Resource Manager resources": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Asset Management",
                "requirement": "Use only approved Azure services",
                "requirement_id": "AM-3"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Security of Network Services",
                "requirement": "Agreed services provided by a network service provider/manager are formally managed and monitored to ensure they are provided securely.",
                "requirement_id": "ID : 0835.09n1Organizational.1 - 09.n"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Access control",
                "requirement": "Access to networks and network services",
                "requirement_id": "A.9.1.2"
            }
        },
        "description": "Use new Azure Resource Manager for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ClassicCompute_Audit.json",
        "github_version": "1.0.0",
        "name": "Virtual machines should be migrated to new Azure Resource Manager resources",
        "policy_id": "1d84d5fb-01f6-4d12-ba4f-4a26081d403d",
        "service_name": "Compute"
    },
    "Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Authorize remote execution of privileged commands and remote access to security-relevant information.",
                "requirement_id": "AC.3.021"
            }
        },
        "description": "The Guest Configuration extension requires a system assigned managed identity. Azure virtual machines in the scope of this policy will be non-compliant when they have the Guest Configuration extension installed but do not have a system assigned managed identity. Learn more at https://aka.ms/gcpol",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_GCExtOnVmWithNoSAMI.json",
        "github_version": "1.0.1",
        "name": "Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity",
        "policy_id": "d26f7642-7545-4e18-9b75-8c9bbdee3a9a",
        "service_name": "Security Center"
    },
    "Vulnerabilities in Azure Container Registry images should be remediated": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Perform software vulnerability assessments",
                "requirement_id": "PV-6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Assessment",
                "requirement": "Remediate vulnerabilities in accordance with risk assessments.",
                "requirement_id": "RM.2.143"
            }
        },
        "description": "Container image vulnerability assessment scans your registry for security vulnerabilities on each pushed container image and exposes detailed findings for each image (powered by Qualys). Resolving the vulnerabilities can greatly improve your containers' security posture and protect them from attacks.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerRegistryVulnerabilityAssessment_Audit.json",
        "github_version": "2.0.0",
        "name": "Vulnerabilities in Azure Container Registry images should be remediated",
        "policy_id": "5f0f936f-2f01-4bf5-b6be-d423792fa562",
        "service_name": "Security Center"
    },
    "Vulnerabilities in container security configurations should be remediated": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for compute resources",
                "requirement_id": "PV-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Assessment",
                "requirement": "Remediate vulnerabilities in accordance with risk assessments.",
                "requirement_id": "RM.2.143"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "Systems are appropriately hardened (e.g., configured with only necessary and secure services, ports and protocols enabled).",
                "requirement_id": "ID : 0715.10m2Organizational.8 - 10.m"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Risk Assessment",
                "requirement": "Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.",
                "requirement_id": "3.11.2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json",
        "github_version": "3.0.0",
        "name": "Vulnerabilities in container security configurations should be remediated",
        "policy_id": "e8cbc669-f12d-49eb-93e7-9273119e9933",
        "service_name": "Security Center"
    },
    "Vulnerabilities in security configuration on your machines should be remediated": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for compute resources",
                "requirement_id": "PV-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "The organization scans for vulnerabilities in the information system and hosted applications to determine the state of flaw remediation monthly (automatically) and again (manually or automatically) when new vulnerabilities potentially affecting the systems and networked environments are identified and reported.",
                "requirement_id": "ID : 0718.10m3Organizational.34 - 10.m"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Management of technical vulnerabilities",
                "requirement_id": "A.12.6.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Flaw Remediation",
                "requirement_id": "SI-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json",
        "github_version": "3.0.0",
        "name": "Vulnerabilities in security configuration on your machines should be remediated",
        "policy_id": "e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15",
        "service_name": "Security Center"
    },
    "Vulnerabilities in security configuration on your virtual machine scale sets should be remediated": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Sustain secure configurations for compute resources",
                "requirement_id": "PV-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "Vulnerability scanning tools include the capability to readily update the information system vulnerabilities scanned.",
                "requirement_id": "ID : 0717.10m3Organizational.2 - 10.m"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Flaw Remediation",
                "requirement_id": "SI-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json",
        "github_version": "3.0.0",
        "name": "Vulnerabilities in security configuration on your virtual machine scale sets should be remediated",
        "policy_id": "3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4",
        "service_name": "Security Center"
    },
    "Vulnerabilities on your SQL databases should be remediated": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Perform software vulnerability assessments",
                "requirement_id": "PV-6"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct information and information system flaws in a timely manner.",
                "requirement_id": "SI.1.210"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "The organization conducts an enterprise security posture review as needed but no less than once within every three-hundred-sixty-five (365) days, in accordance with organizational IS procedures.",
                "requirement_id": "ID : 0716.10m3Organizational.1 - 10.m"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Management of technical vulnerabilities",
                "requirement_id": "A.12.6.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Information Integrity",
                "requirement": "Identify, report, and correct system flaws in a timely manner.",
                "requirement_id": "3.14.1"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Flaw Remediation",
                "requirement_id": "SI-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json",
        "github_version": "4.0.0",
        "name": "Vulnerabilities on your SQL databases should be remediated",
        "policy_id": "feedbf84-6b99-488c-acc2-71c829aa5ffc",
        "service_name": "Security Center"
    },
    "Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports": {
        "benchmarks": {
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that VA setting Send scan reports to is configured for a SQL server",
                "requirement_id": "4.2.4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Management",
                "requirement": "Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",
                "requirement_id": "RM.3.144"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json",
        "github_version": "2.0.0",
        "name": "Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports",
        "policy_id": "057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9",
        "service_name": "SQL"
    },
    "Vulnerability assessment should be enabled on SQL Managed Instance": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Perform software vulnerability assessments",
                "requirement_id": "PV-6"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account",
                "requirement_id": "4.2.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Assessment",
                "requirement": "Remediate vulnerabilities in accordance with risk assessments.",
                "requirement_id": "RM.2.143"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "The organization updates the list of information system vulnerabilities scanned within every thirty (30) days or when new vulnerabilities are identified and reported.",
                "requirement_id": "ID : 0719.10m3Organizational.5 - 10.m"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json",
        "github_version": "1.0.1",
        "name": "Vulnerability assessment should be enabled on SQL Managed Instance",
        "policy_id": "1b7aa243-30e4-4c9e-bca8-d0d3022b634a",
        "service_name": "SQL"
    },
    "Vulnerability assessment should be enabled on your SQL servers": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Posture and Vulnerability Management",
                "requirement": "Perform software vulnerability assessments",
                "requirement_id": "PV-6"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "Database Services",
                "requirement": "Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account",
                "requirement_id": "4.2.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Risk Assessment",
                "requirement": "Remediate vulnerabilities in accordance with risk assessments.",
                "requirement_id": "RM.2.143"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",
                "requirement_id": "ID : 0709.10m1Organizational.1 - 10.m"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Information security monitoring",
                "requirement": "6.2.5 Conducting vulnerability assessments",
                "requirement_id": "ISM-3"
            }
        },
        "description": "Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json",
        "github_version": "2.0.0",
        "name": "Vulnerability assessment should be enabled on your SQL servers",
        "policy_id": "ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9",
        "service_name": "SQL"
    },
    "Web Application Firewall (WAF) should be enabled for Application Gateway": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.4.10 Malicious code counter-measures",
                "requirement_id": "NS-7"
            }
        },
        "description": "Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json",
        "github_version": "1.0.1",
        "name": "Web Application Firewall (WAF) should be enabled for Application Gateway",
        "policy_id": "564feb30-bf6a-4854-b4bb-0d2d2d1e6c66",
        "service_name": "Network"
    },
    "Web Application Firewall (WAF) should be enabled for Azure Front Door Service service": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Network Security",
                "requirement": "Protect applications and services from external network attacks",
                "requirement_id": "NS-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.4.10 Malicious code counter-measures",
                "requirement_id": "NS-7"
            }
        },
        "description": "Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json",
        "github_version": "1.0.1",
        "name": "Web Application Firewall (WAF) should be enabled for Azure Front Door Service service",
        "policy_id": "055aa869-bc98-4af8-bafc-23f1ab6ffe2c",
        "service_name": "Network"
    },
    "Web Application Firewall (WAF) should use the specified mode for Application Gateway": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.4.10 Malicious code counter-measures",
                "requirement_id": "NS-7"
            }
        },
        "description": "Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json",
        "github_version": "1.0.0",
        "name": "Web Application Firewall (WAF) should use the specified mode for Application Gateway",
        "policy_id": "12430be1-6cc8-4527-a9a8-e3d38f250096",
        "service_name": "Network"
    },
    "Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Information Integrity",
                "requirement": "Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",
                "requirement_id": "SI.2.216"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Network security",
                "requirement": "18.4.10 Malicious code counter-measures",
                "requirement_id": "NS-7"
            }
        },
        "description": "Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.",
        "effects": "Audit, Deny, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json",
        "github_version": "1.0.0",
        "name": "Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service",
        "policy_id": "425bea59-a659-4cbb-8d31-34499bd030b8",
        "service_name": "Network"
    },
    "Web Application should only be accessible over HTTPS": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CIS": {
                "benchmark": "CIS",
                "category": "App Service",
                "requirement": "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service",
                "requirement_id": "9.2"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "On-line Transactions",
                "requirement": "The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",
                "requirement_id": "ID : 0949.09y2Organizational.5 - 09.y"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Cryptography",
                "requirement": "Policy on the use of cryptographic controls",
                "requirement_id": "A.10.1.1"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "3.13.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection",
                "requirement_id": "SC-8 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Software security",
                "requirement": "14.5.8 Web applications",
                "requirement_id": "SS-8"
            }
        },
        "description": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.",
        "effects": "Audit, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json",
        "github_version": "1.0.0",
        "name": "Web Application should only be accessible over HTTPS",
        "policy_id": "a4af4a39-4135-47fb-b175-47fbdf85311d",
        "service_name": "App Service"
    },
    "Windows Defender Exploit Guard should be enabled on your machines": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Endpoint Security",
                "requirement": "Use centrally managed modern anti-malware software",
                "requirement_id": "ES-2"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.3.10 Antivirus scans",
                "requirement_id": "DM-4"
            }
        },
        "description": "Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components that are designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks while enabling enterprises to balance their security risk and productivity requirements (Windows only).",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsDefenderExploitGuard_AINE.json",
        "github_version": "1.1.1",
        "name": "Windows Defender Exploit Guard should be enabled on your machines",
        "policy_id": "bed48b13-6647-468e-aa2f-1af1d3f4dd40",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - Accounts'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Privilege Management",
                "requirement": "The organization restricts access to privileged functions and all security-relevant information.",
                "requirement_id": "ID : 1148.01c2System.78 - 01.c"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Accounts' for limiting local account use of blank passwords and guest account status. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsAccounts_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - Accounts'",
        "policy_id": "ee984370-154a-4ee8-9726-19d900e56fc0",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - Audit'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Operational Software",
                "requirement": "Only authorized administrators are allowed to implement approved upgrades to software, applications, and program libraries, based on business requirements and the security implications of the release.",
                "requirement_id": "ID : 0605.10h1System.12 - 10.h"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Audit' for forcing audit policy subcategory and shutting down if unable to log security audits. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsAudit_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - Audit'",
        "policy_id": "33936777-f2ac-45aa-82ec-07958ec9ade4",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - Microsoft Network Server'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Technical Vulnerabilities",
                "requirement": "Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",
                "requirement_id": "ID : 0709.10m1Organizational.1 - 10.m"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Microsoft Network Server' for disabling SMB v1 server. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsMicrosoftNetworkServer_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - Microsoft Network Server'",
        "policy_id": "caf2d518-f029-4f6b-833b-d7081702f253",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - Network Access'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "To identify and authenticate devices on local and/or wide area networks, including wireless networks,  the information system uses either a (i) shared known information solution or (ii) an organizational authentication solution, the exact selection and strength of which is dependent on the security categorization of the information system.",
                "requirement_id": "ID : 0861.09m2Organizational.67 - 09.m"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - Network Access'",
        "policy_id": "3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - Network Security'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",
                "requirement_id": "SC.3.183"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Identification and Authentication",
                "requirement": "Store and transmit only cryptographically-protected passwords.",
                "requirement_id": "3.5.10"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - Network Security'",
        "policy_id": "1221c620-d201-468c-81e7-2817e6107e84",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - Recovery console'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Business Continuity and Risk Assessment",
                "requirement": "Business impact analysis are used to evaluate the consequences of disasters, security failures, loss of service, and service availability.",
                "requirement_id": "ID : 1637.12b2Organizational.2 - 12.b"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Recovery console' for allowing floppy copy and access to all drives and folders. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsRecoveryconsole_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - Recovery console'",
        "policy_id": "f71be03e-e25b-4d0f-b8bc-9b3e309b66c0",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Options - User Account Control'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Control and monitor user-installed software.",
                "requirement_id": "CM.2.063"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation of Duties",
                "requirement": "The initiation of an event is separated from its authorization to reduce the possibility of collusion.",
                "requirement_id": "ID : 1277.09c2Organizational.4 - 09.c"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - User Account Control' for mode for admins, behavior of elevation prompt, and virtualizing file and registry write failures. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsUserAccountControl_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Options - User Account Control'",
        "policy_id": "492a29ed-d143-4f03-b6a4-705ce081b463",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Security Settings - Account Policies'": {
        "benchmarks": {
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.1.40 Password selection policy",
                "requirement_id": "AC-4"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Security Settings - Account Policies' for password history, age, length, complexity, and storing passwords using reversible encryption. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecuritySettingsAccountPolicies_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Security Settings - Account Policies'",
        "policy_id": "f2143251-70de-4e81-87a8-36cee5a2f29d",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'System Audit Policies - Account Management'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Control of Operational Software",
                "requirement": "Only authorized administrators are allowed to implement approved upgrades to software, applications, and program libraries, based on business requirements and the security implications of the release.",
                "requirement_id": "ID : 0605.10h1System.12 - 10.h"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Account Management' for auditing application, security, and user group management, and other management events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesAccountManagement_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'System Audit Policies - Account Management'",
        "policy_id": "94d9aca8-3757-46df-aa51-f218c5f11954",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Change Control Procedures",
                "requirement": "The organization employs automated mechanisms to (i) centrally manage, apply, and verify configuration settings; (ii) respond to unauthorized changes to network and system security-related configuration settings; and (iii) enforce access restrictions and auditing of the enforcement actions.",
                "requirement_id": "ID : 0644.10k3Organizational.4 - 10.k"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking'",
        "policy_id": "58383b73-94a9-4414-b382-4146eb02611b",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'System Audit Policies - Policy Change'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Track, review, approve or disapprove, and log changes to organizational systems.",
                "requirement_id": "CM.2.065"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Policy Change' for auditing changes to system audit policies. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesPolicyChange_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'System Audit Policies - Policy Change'",
        "policy_id": "2a7a701e-dff3-4da9-9ec5-42cb98594c0b",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'System Audit Policies - Privilege Use'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Configuration Management",
                "requirement": "Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.",
                "requirement_id": "CM.2.062"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Privilege Use' for auditing nonsensitive and other privilege use. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesPrivilegeUse_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'System Audit Policies - Privilege Use'",
        "policy_id": "87845465-c458-45f3-af66-dcd62176f397",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'User Rights Assignment'": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Access Control",
                "requirement": "Authorize remote execution of privileged commands and remote access to security-relevant information.",
                "requirement_id": "AC.3.021"
            },
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Segregation of Duties",
                "requirement": "Access for individuals responsible for administering  access controls is limited to the minimum necessary based upon each user's role and responsibilities and these individuals cannot access audit functions related to these controls.",
                "requirement_id": "ID : 1232.09c3Organizational.12 - 09.c"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'User Rights Assignment' for allowing log on locally, RDP, access from the network, and many other user activities. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_UserRightsAssignment_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'User Rights Assignment'",
        "policy_id": "e068b215-0026-4354-b347-8fb2766f73a2",
        "service_name": "Guest Configuration"
    },
    "Windows machines should meet requirements for 'Windows Firewall Properties'": {
        "benchmarks": {
            "HIPAA HITRUST 9.2": {
                "benchmark": "HIPAA HITRUST 9.2",
                "category": "Network Controls",
                "requirement": "The organization monitors for all authorized and unauthorized wireless access to the information system and prohibits installation of wireless access points (WAPs) unless explicitly authorized in writing by the CIO or his/her designated representative.",
                "requirement_id": "ID : 0858.09m1Organizational.4 - 09.m"
            }
        },
        "description": "Windows machines should have the specified Group Policy settings in the category 'Windows Firewall Properties' for firewall state, connections, rule management, and notifications. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsFirewallProperties_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows machines should meet requirements for 'Windows Firewall Properties'",
        "policy_id": "35d9882c-993d-44e6-87d2-db66ce21b636",
        "service_name": "Guest Configuration"
    },
    "Windows web servers should be configured to use secure communication protocols": {
        "benchmarks": {
            "Azure Security Benchmark": {
                "benchmark": "Azure Security Benchmark",
                "category": "Data Protection",
                "requirement": "Encrypt sensitive information in transit",
                "requirement_id": "DP-4"
            },
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "System and Communications Protection",
                "requirement": "Protect the authenticity of communications sessions.",
                "requirement_id": "SC.3.190"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "System and Communications Protection",
                "requirement": "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.",
                "requirement_id": "3.13.8"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Communications Protection",
                "requirement": "Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection",
                "requirement_id": "SC-8 (1)"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Data management",
                "requirement": "20.4.4 Database files",
                "requirement_id": "DM-6"
            }
        },
        "description": "To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.",
        "effects": "AuditIfNotExists, Disabled",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json",
        "github_version": "2.0.0",
        "name": "Windows web servers should be configured to use secure communication protocols",
        "policy_id": "5752e6d6-1206-46d8-8ab1-ecc2f71a8112",
        "service_name": "Guest Configuration"
    },
    "[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted": {
        "benchmarks": {
            "CMMC L3": {
                "benchmark": "CMMC L3",
                "category": "Audit and Accountability",
                "requirement": "Collect audit information (e.g., logs) into one or more central repositories.",
                "requirement_id": "AU.3.048"
            },
            "ISO 27001": {
                "benchmark": "ISO 27001",
                "category": "Operations security",
                "requirement": "Clock Synchronization",
                "requirement_id": "A.12.4.4"
            },
            "NIST SP 800-171 R2": {
                "benchmark": "NIST SP 800-171 R2",
                "category": "Audit and Accountability",
                "requirement": "Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",
                "requirement_id": "3.3.2"
            },
            "NIST SP 800-53 R4": {
                "benchmark": "NIST SP 800-53 R4",
                "category": "System and Information Integrity",
                "requirement": "Information System Monitoring",
                "requirement_id": "SI-4"
            },
            "NZISM Security Benchmark": {
                "benchmark": "NZISM Security Benchmark",
                "category": "Access Control and Passwords",
                "requirement": "16.6.7 Content of system management logs",
                "requirement_id": "AC-14"
            }
        },
        "description": "Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.",
        "effects": "auditIfNotExists",
        "github_link": "https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json",
        "github_version": "1.0.0-preview",
        "name": "[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted",
        "policy_id": "32133ab0-ee4b-4b44-98d6-042180979d50",
        "service_name": "Monitoring"
    }
}