benchmark,category,requirement,requirement_id,service_name,name,policy_id,description,effects,github_link,github_version
CIS,Identity and Access Management,Ensure that multi-factor authentication is enabled for all privileged users,1.1,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
CIS,Identity and Access Management,Ensure that multi-factor authentication is enabled for all privileged users,1.1,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
CIS,Identity and Access Management,Ensure that multi-factor authentication is enabled for all non-privileged users,1.2,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
CIS,Identity and Access Management,Ensure guest users are reviewed on a monthly basis,1.3,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
CIS,Identity and Access Management,Ensure guest users are reviewed on a monthly basis,1.3,Security Center,External accounts with read permissions should be removed from your subscription,5f76cf89-fbf2-47fd-a3f4-b891fa780b60,External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json,3.0.0
CIS,Identity and Access Management,Ensure guest users are reviewed on a monthly basis,1.3,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
CIS,Identity and Access Management,Ensure that no custom subscription owner roles are created,1.21,General,Custom subscription owner roles should not exist,10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9,This policy ensures that no custom subscription owner roles exist.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/CustomSubscription_OwnerRole_Audit.json,2.0.0
CIS,Security Center,Ensure that Azure Defender is set to On for Servers,2.1,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CIS,Security Center,Ensure that Azure Defender is set to On for App Service,2.2,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CIS,Security Center,Ensure that Azure Defender is set to On for Azure SQL database servers,2.3,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CIS,Security Center,Ensure that Azure Defender is set to On for SQL servers on machines,2.4,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CIS,Security Center,Ensure that Azure Defender is set to On for Storage,2.5,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CIS,Security Center,Ensure that Azure Defender is set to On for Kubernetes,2.6,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CIS,Security Center,Ensure that Azure Defender is set to On for Container Registries,2.7,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CIS,Security Center,Ensure that Azure Defender is set to On for Key Vault,2.8,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CIS,Security Center,Ensure that 'Automatic provisioning of monitoring agent' is set to 'On',2.11,Security Center,Auto provisioning of the Log Analytics agent should be enabled on your subscription,475aae12-b88a-4572-8b36-9b712b2b3a17,"To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Automatic_provisioning_log_analytics_monitoring_agent.json,1.0.1
CIS,Security Center,Ensure 'Additional email addresses' is configured with a security contact email,2.13,Security Center,Subscriptions should have a contact email address for security issues,4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json,1.0.1
CIS,Security Center,Ensure that 'Notify about alerts with the following severity' is set to 'High',2.14,Security Center,Email notification for high severity alerts should be enabled,6e2593d9-add6-4083-9c9b-4b7d2188c899,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, enable email notifications for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification.json,1.0.1
CIS,Storage Accounts,Ensure that 'Secure transfer required' is set to 'Enabled',3.1,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
CIS,Storage Accounts,Ensure that 'Public access level' is set to Private for blob containers,3.5,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CIS,Storage Accounts,Ensure default network access rule for Storage Accounts is set to deny,3.6,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CIS,Storage Accounts,Ensure default network access rule for Storage Accounts is set to deny,3.6,Storage,Storage accounts should restrict network access using virtual network rules,2a1a9cdf-e04d-429a-8416-3bfb72a1b26f,Protect your storage accounts from potential threats using virtual network rules as a preferred method instead of IP-based filtering. Disabling IP-based filtering prevents public IPs from accessing your storage accounts.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountOnlyVnetRulesEnabled_Audit.json,1.0.1
CIS,Storage Accounts,Ensure 'Trusted Microsoft Services' is enabled for Storage Account access,3.7,Storage,Storage accounts should allow access from trusted Microsoft services,c9d007d0-c057-4772-b18c-01e546713bcd,"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccess_TrustedMicrosoftServices_Audit.json,1.0.0
CIS,Storage Accounts,Ensure storage for critical data are encrypted with Customer Managed Key,3.9,Storage,Storage accounts should use customer-managed key for encryption,6fac406b-40ca-413b-bf8e-0bf964659c25,"Secure your storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json,1.0.2
CIS,Database Services,Ensure that 'Auditing' is set to 'On',4.1.1,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
CIS,Database Services,Ensure that 'Data encryption' is set to 'On' on a SQL Database,4.1.2,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
CIS,Database Services,Ensure that 'Auditing' Retention is 'greater than 90 days',4.1.3,SQL,SQL servers should be configured with 90 days auditing retention or higher,89099bee-89e0-4b26-a5f4-165451757743,SQL servers should be configured with 90 days auditing retention or higher.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditingRetentionDays_Audit.json,2.0.1
CIS,Database Services,Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled',4.2.1,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CIS,Database Services,Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled',4.2.1,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CIS,Database Services,Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account,4.2.2,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
CIS,Database Services,Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account,4.2.2,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
CIS,Database Services,Ensure that VA setting Send scan reports to is configured for a SQL server,4.2.4,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
CIS,Database Services,Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server,4.3.1,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
CIS,Database Services,Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server,4.3.2,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
CIS,Database Services,Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server,4.3.3,SQL,Log checkpoints should be enabled for PostgreSQL database servers,eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d,This policy helps audit any PostgreSQL databases in your environment without log_checkpoints setting enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableLogCheckpoint_Audit.json,1.0.0
CIS,Database Services,Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server,4.3.4,SQL,Log connections should be enabled for PostgreSQL database servers,eb6f77b9-bd53-4e35-a23d-7f65d5f0e442,This policy helps audit any PostgreSQL databases in your environment without log_connections setting enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableLogConnections_Audit.json,1.0.0
CIS,Database Services,Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server,4.3.5,SQL,Disconnections should be logged for PostgreSQL database servers.,eb6f77b9-bd53-4e35-a23d-7f65d5f0e446,This policy helps audit any PostgreSQL databases in your environment without log_disconnections enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableLogDisconnections_Audit.json,1.0.0
CIS,Database Services,Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server,4.3.6,SQL,Connection throttling should be enabled for PostgreSQL database servers,5345bb39-67dc-4960-a1bf-427e16b9a0bd,This policy helps audit any PostgreSQL databases in your environment without Connection throttling enabled. This setting enables temporary connection throttling per IP for too many invalid password login failures.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_ConnectionThrottling_Enabled_Audit.json,1.0.0
CIS,Database Services,Ensure that Azure Active Directory Admin is configured,4.4,SQL,An Azure Active Directory administrator should be provisioned for SQL servers,1f314764-cb73-4fc9-b863-8eca98ac36e9,Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json,1.0.0
CIS,Database Services,Ensure SQL server's TDE protector is encrypted with Customer-managed key,4.5,SQL,SQL managed instances should use customer-managed keys to encrypt data at rest,048248b0-55cd-46da-b1ff-39efd52db260,"Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,1.0.2
CIS,Database Services,Ensure SQL server's TDE protector is encrypted with Customer-managed key,4.5,SQL,SQL servers should use customer-managed keys to encrypt data at rest,0d134df8-db83-46fb-ad72-fe0c9428c8dd,"Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,2.0.1
CIS,Logging and Monitoring,Ensure the storage container storing the activity logs is not publicly accessible,5.1.3,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CIS,Logging and Monitoring,Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key),5.1.4,Monitoring,Storage account containing the container with activity logs must be encrypted with BYOK,fbb99e8e-e444-4da0-9ff1-75c92f5a85b2,This policy audits if the Storage account containing the container with activity logs is encrypted with BYOK. The policy works only if the storage account lies on the same subscription as activity logs by design. More information on Azure Storage encryption at rest can be found here https://aka.ms/azurestoragebyok .,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_StorageAccountBYOK_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that logging for Azure KeyVault is 'Enabled',5.1.5,Key Vault,Resource logs in Key Vault should be enabled,cf820ca0-f99e-4f3e-84fb-66e913812d21,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Create Policy Assignment,5.2.1,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Delete Policy Assignment,5.2.2,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Create or Update Network Security Group,5.2.3,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Delete Network Security Group,5.2.4,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule,5.2.5,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that activity log alert exists for the Delete Network Security Group Rule,5.2.6,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Create or Update Security Solution,5.2.7,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Delete Security Solution,5.2.8,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule,5.2.9,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,App Service,Diagnostic logs in App Services should be enabled,b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0,Audit enabling of diagnostic logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditLoggingMonitoring_Audit.json,2.0.0
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Data Lake,Resource logs in Azure Data Lake Store should be enabled,057ef27e-665e-4328-8ea3-04b3122bd9fb,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStore_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Stream Analytics,Resource logs in Azure Stream Analytics should be enabled,f9be5368-9bf5-4b84-9e0a-7850da98bb46,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Stream%20Analytics/StreamAnalytics_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Batch,Resource logs in Batch accounts should be enabled,428256e6-1fac-4f48-a757-df34c2b3336d,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Batch/Batch_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Data Lake,Resource logs in Data Lake Analytics should be enabled,c95c74d9-38fe-4f0d-af86-0c7d626a315c,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeAnalytics_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Event Hub,Resource logs in Event Hub should be enabled,83a214f7-d01a-484b-91a9-ed54470c9a6a,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Hub/EventHub_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Internet of Things,Resource logs in IoT Hub should be enabled,383856f8-de7f-44a2-81fc-e5135b5c2aa4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Internet%20of%20Things/IoTHub_AuditDiagnosticLog_Audit.json,3.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Key Vault,Resource logs in Key Vault should be enabled,cf820ca0-f99e-4f3e-84fb-66e913812d21,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Logic Apps,Resource logs in Logic Apps should be enabled,34f95f76-5386-4de7-b824-0d8478470c9d,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Logic%20Apps/LogicApps_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Search,Resource logs in Search services should be enabled,b4330a05-a843-4bc8-bf9a-cacce50c67f4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Search/Search_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Service Bus,Resource logs in Service Bus should be enabled,f8d36e2f-389b-4ee4-898d-21aeb69a0f45,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Bus/ServiceBus_AuditDiagnosticLog_Audit.json,4.0.1
CIS,Logging and Monitoring,Ensure that Diagnostic Logs are enabled for all services which support it.,5.3,Compute,Resource logs in Virtual Machine Scale Sets should be enabled,7c1b1214-f927-48bf-8882-84f0af6588b1,It is recommended to enable Logs so that activity trail can be recreated when investigations are required in the event of an incident or a compromise.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ServiceFabric_and_VMSS_AuditVMSSDiagnostics.json,2.0.1
CIS,Networking,Ensure that RDP access is restricted from the internet,6.1,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
CIS,Networking,Ensure that SSH access is restricted from the internet,6.2,Network,SSH access from the Internet should be blocked,2c89a2e5-7285-40fe-afe0-ae8654b92fab,This policy audits any network security rule that allows SSH access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_SSHAccess_Audit.json,2.0.0
CIS,Networking,Ensure that Network Watcher is 'Enabled',6.5,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
CIS,Virtual Machines,Ensure Virtual Machines are utilizing Managed Disks,7.1,Compute,Audit VMs that do not use managed disks,06a78e20-9358-41c9-923c-fb736d382a4d,This policy audits VMs that do not use managed disks,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VMRequireManagedDisk_Audit.json,1.0.0
CIS,Virtual Machines,Ensure that 'OS and Data' disks are encrypted with CMK,7.2,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
CIS,Virtual Machines,Ensure that 'Unattached disks' are encrypted with CMK,7.3,Compute,Unattached disks should be encrypted,2c89a2e5-7285-40fe-afe0-ae8654b92fb2,This policy audits any unattached disk without encryption enabled.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/UnattachedDisk_Encryption_Audit.json,1.0.0
CIS,Virtual Machines,Ensure that only approved extensions are installed,7.4,Compute,Only approved VM extensions should be installed,c0e996f8-39cf-4af9-9f45-83fbde810432,This policy governs the virtual machine extensions that are not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_ApprovedExtensions_Audit.json,1.0.0
CIS,Virtual Machines,Ensure that the latest OS Patches for all Virtual Machines are applied,7.5,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
CIS,Virtual Machines,Ensure that the endpoint protection for all Virtual Machines is installed,7.6,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
CIS,Other Security Considerations,Ensure that the expiration date is set on all keys,8.1,Key Vault,Key Vault keys should have an expiration date,152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0,Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. It is a recommended security practice to set expiration dates on cryptographic keys.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_ExpirationSet.json,1.0.1-preview
CIS,Other Security Considerations,Ensure that the expiration date is set on all Secrets,8.2,Key Vault,Key Vault secrets should have an expiration date,98728c90-32c7-4049-8429-847dc0f4fe37,Secrets should have a defined expiration date and not be permanent. Secrets that are valid forever provide a potential attacker with more time to compromise them. It is a recommended security practice to set expiration dates on secrets.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Secrets_ExpirationSet.json,1.0.1-preview
CIS,Other Security Considerations,Ensure the key vault is recoverable,8.4,Key Vault,Key vaults should have purge protection enabled,0b60c0b2-2dc2-4e1c-b5c9-abbed971de53,Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_Recoverable_Audit.json,1.1.1
CIS,Other Security Considerations,Enable role-based access control (RBAC) within Azure Kubernetes Services,8.5,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
CIS,App Service,Ensure App Service Authentication is set on Azure App Service,9.1,App Service,Authentication should be enabled on your API app,c4ebc54a-46e1-481a-bee2-d4411e95d828,"Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the API app, or authenticate those that have tokens before they reach the API app","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Authentication_ApiApp_Audit.json,1.0.0
CIS,App Service,Ensure App Service Authentication is set on Azure App Service,9.1,App Service,Authentication should be enabled on your Function app,c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8,"Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the Function app, or authenticate those that have tokens before they reach the Function app","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Authentication_functionapp_Audit.json,1.0.0
CIS,App Service,Ensure App Service Authentication is set on Azure App Service,9.1,App Service,Authentication should be enabled on your web app,95bccee9-a7f8-4bec-9ee9-62c3473701fc,"Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the web app, or authenticate those that have tokens before they reach the web app","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Authentication_WebApp_Audit.json,1.0.0
CIS,App Service,Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service,9.2,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
CIS,App Service,Ensure web app is using the latest version of TLS encryption,9.3,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
CIS,App Service,Ensure web app is using the latest version of TLS encryption,9.3,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
CIS,App Service,Ensure web app is using the latest version of TLS encryption,9.3,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
CIS,App Service,Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On',9.4,App Service,Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On',0c192fe8-9cbb-4516-85b3-0ade8bd03886,Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_ClientCert.json,1.0.0
CIS,App Service,Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On',9.4,App Service,Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On',5bb220d9-2698-4ee4-8404-b9c30c9df609,Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_ClientCert.json,1.0.0
CIS,App Service,Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On',9.4,App Service,Function apps should have 'Client Certificates (Incoming client certificates)' enabled,eaebaea7-8013-4ceb-9d14-7eb32271373c,Client certificates allow for the app to request a certificate for incoming requests. Only clients with valid certificates will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_ClientCert.json,1.0.1
CIS,App Service,Ensure that Register with Azure Active Directory is enabled on App Service,9.5,App Service,Managed identity should be used in your API App,c4d441f8-f9d9-4a9e-9cef-e82117cb3eef,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_ApiApp_Audit.json,2.0.0
CIS,App Service,Ensure that Register with Azure Active Directory is enabled on App Service,9.5,App Service,Managed identity should be used in your Function App,0da106f2-4ca3-48e8-bc85-c638fe6aea8f,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_FunctionApp_Audit.json,2.0.0
CIS,App Service,Ensure that Register with Azure Active Directory is enabled on App Service,9.5,App Service,Managed identity should be used in your Web App,2b9ad585-36bc-4615-b300-fd4435808332,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_WebApp_Audit.json,2.0.0
CIS,App Service,"Ensure that 'PHP version' is the latest, if used to run the web app",9.6,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the API app",1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_PHP_Latest.json,2.0.0
CIS,App Service,"Ensure that 'PHP version' is the latest, if used to run the web app",9.6,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the WEB app",7261b898-8a84-4db8-9e04-18527132abb3,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_PHP_Latest.json,2.0.0
CIS,App Service,"Ensure that 'Python version' is the latest, if used to run the web app",9.7,App Service,"Ensure that 'Python version' is the latest, if used as a part of the API app",74c3584d-afae-46f7-a20a-6f8adba71a16,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_python_Latest.json,2.0.0
CIS,App Service,"Ensure that 'Python version' is the latest, if used to run the web app",9.7,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Function app",7238174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_python_Latest.json,2.0.0
CIS,App Service,"Ensure that 'Python version' is the latest, if used to run the web app",9.7,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Web app",7008174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_python_Latest.json,2.0.0
CIS,App Service,"Ensure that 'Java version' is the latest, if used to run the web app",9.8,App Service,"Ensure that 'Java version' is the latest, if used as a part of the API app",88999f4c-376a-45c8-bcb3-4058f713cf39,"Periodically, newer versions are released for Java either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_java_Latest.json,2.0.0
CIS,App Service,"Ensure that 'Java version' is the latest, if used to run the web app",9.8,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Function app",9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_java_Latest.json,2.0.0
CIS,App Service,"Ensure that 'Java version' is the latest, if used to run the web app",9.8,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Web app",496223c3-ad65-4ecd-878a-bae78737e9ed,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_java_Latest.json,2.0.0
CIS,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the web app",9.9,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the API app",991310cd-e9f3-47bc-b7b6-f57b557d07db,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_HTTP_Latest.json,2.0.0
CIS,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the web app",9.9,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the Function app",e2c1c086-2d84-4019-bff3-c44ccd95113c,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_HTTP_Latest.json,2.0.0
CIS,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the web app",9.9,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the Web app",8c122334-9d20-4eb8-89ea-ac9a705b74ae,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_HTTP_Latest.json,2.0.0
CIS,App Service,Ensure FTP deployments are disabled,9.10,App Service,FTPS only should be required in your API App,9a1b8c48-453a-4044-86c3-d8bfd823e4f5,Enable FTPS enforcement for enhanced security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_ApiApp_Audit.json,2.0.0
CIS,App Service,Ensure FTP deployments are disabled,9.10,App Service,FTPS only should be required in your Function App,399b2637-a50f-4f95-96f8-3a145476eb15,Enable FTPS enforcement for enhanced security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_FunctionApp_Audit.json,2.0.0
CIS,App Service,Ensure FTP deployments are disabled,9.10,App Service,FTPS should be required in your Web App,4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b,Enable FTPS enforcement for enhanced security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_WebApp_Audit.json,2.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,API Management,API Management services should use a virtual network,ef619a2c-cc4d-4d03-b2ba-8c94a834d85b,"Azure Virtual Network deployment provides enhanced security, isolation and allows you to place your API Management service in a non-internet routable network that you control access to. These networks can then be connected to your on-premises networks using various VPN technologies, which enables access to your backend services within the network and/or on-premises. The developer portal and API gateway, can be configured to be accessible either from the Internet or only within the virtual network.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20Management/ApiManagement_VNETEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,Authorized IP ranges should be defined on Kubernetes Services,0e246bcf-5f6f-4f87-bc6f-775d4712c7ea,Restrict access to the Kubernetes Service Management API by granting API access only to IP addresses in specific ranges. It is recommended to limit access to authorized IP ranges to ensure that only applications from allowed networks can access the cluster.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableIpRanges_KubernetesService_Audit.json,2.0.1
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Cosmos DB,Azure Cosmos DB accounts should have firewall rules,862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb,Firewall rules should be defined on your Azure Cosmos DB accounts to prevent traffic from unauthorized sources. Accounts that have at least one IP rule defined with the virtual network filter enabled are deemed compliant. Accounts disabling public access are also deemed compliant.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/Cosmos_NetworkRulesExist_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,IP Forwarding on your virtual machine should be disabled,bd352bd5-2853-4985-bf0d-73806b4a5744,"Enabling IP forwarding on a virtual machine's NIC allows the machine to receive traffic addressed to other destinations. IP forwarding is rarely required (e.g., when using the VM as a network virtual appliance), and therefore, this should be reviewed by the network security team.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_IPForwardingOnVirtualMachines_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,Management ports should be closed on your virtual machines,22730e10-96f6-4aac-ad84-9383d35b5917,Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OpenManagementPortsOnVirtualMachines_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Storage,Storage accounts should restrict network access using virtual network rules,2a1a9cdf-e04d-429a-8416-3bfb72a1b26f,Protect your storage accounts from potential threats using virtual network rules as a preferred method instead of IP-based filtering. Disabling IP-based filtering prevents public IPs from accessing your storage accounts.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountOnlyVnetRulesEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Implement security for internal traffic,NS-1,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,App Configuration,App Configuration should use private link,ca610c1d-041c-4332-9d88-7ed3094967c7,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your app configuration instances instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/appconfig/private-endpoint .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Configuration/PrivateLink_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Cache,Azure Cache for Redis should reside within a virtual network,7d092e0a-7acd-40d2-a975-dca21cae48c4,"Azure Virtual Network deployment provides enhanced security and isolation for your Azure Cache for Redis, as well as subnets, access control policies, and other features to further restrict access.When an Azure Cache for Redis instance is configured with a virtual network, it is not publicly addressable and can only be accessed from virtual machines and applications within the virtual network.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_CacheInVnet_Audit.json,1.0.3
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Event Grid,Azure Event Grid domains should use private link,9830b652-8523-49cc-b1b3-e17dce1127ca,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Event Grid domain instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/privateendpoints .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Grid/Domains_PrivateEndpoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Event Grid,Azure Event Grid topics should use private link,4b90e17e-8448-49db-875e-bd83fb6f804f,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Event Grid topic instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/privateendpoints .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Grid/Topics_PrivateEndpoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Machine Learning,Azure Machine Learning workspaces should use private link,40cec1dd-a100-4920-b15b-3024fe8901ab,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Azure Machine Learning workspaces instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/azureml-workspaces-privatelink .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_PrivateLinkEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,SignalR,Azure SignalR Service should use private link,53503636-bcc9-4748-9663-5348217f160f,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your SignalR resources instead of the entire service, you'll also be protected against data leakage risks .Learn more at: https://aka.ms/asrs/privatelink .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SignalR/SignalR_PrivateEndpointEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,App Platform,Azure Spring Cloud should use network injection,af35e2a4-ef96-44e7-a9ae-853dd97032c4,Azure Spring Cloud instances should use virtual network injection for the following purposes: 1. Isolate Azure Spring Cloud from Internet. 2. Enable Azure Spring Cloud to interact with systems in either on premises data centers or Azure service in other virtual networks. 3. Empower customers to control inbound and outbound network communications for Azure Spring Cloud.,"Audit, Disabled, Deny",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Platform/Spring_VNETEnabled_Audit.json,1.0.0
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Container Registry,Container registries should use private link,e8eef0a8-67cf-4eb4-9386-14b0e78733d4,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network.By mapping private endpoints to your container registries instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/acr/private-link .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_PrivateEndpointEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,SQL,Private endpoint connections on Azure SQL Database should be enabled,7698e800-9299-47a6-b3b6-5a0fee576eed,Private endpoint connections enforce secure communication by enabling private connectivity to Azure SQL Database.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PrivateEndpoint_Audit.json,1.1.0
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Key Vault,Private endpoint should be configured for Key Vault,5f0bc445-3935-4915-9981-011aa2b46147,Private link provides a way to connect Key Vault to your Azure resources without sending traffic over the public internet. Private link provides defense in depth protection against data exfiltration.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultPrivateEndpointEnabled_Audit.json,1.1.0-preview
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,SQL,Private endpoint should be enabled for MariaDB servers,0a1302fb-a631-4106-9753-f3d494733990,"Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MariaDB. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_EnablePrivateEndPoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,SQL,Private endpoint should be enabled for MySQL servers,7595c971-233d-4bcf-bd18-596129188c49,"Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MySQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnablePrivateEndPoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,SQL,Private endpoint should be enabled for PostgreSQL servers,0564d078-92f5-4f97-8398-b9f58a51f70b,"Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for PostgreSQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnablePrivateEndPoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,Storage,Storage account should use a private link connection,6edd7eda-6dd8-40f7-810d-67160c639cd9,"Private links enforce secure communication, by providing private connectivity to the storage account","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountPrivateEndpointEnabled_Audit.json,1.0.0
Azure Security Benchmark,Network Security,Connect private networks together,NS-2,VM Image Builder,VM Image Builder templates should use private link,2154edb9-244f-4741-9970-660785bccdaa,"Audit VM Image Builder templates that do not have a virtual network configured. When a virtual network is not configured, a public IP is created and used instead which may directly expose resources to the internet and increase the potential attack surface.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/VM%20Image%20Builder/PrivateLinkEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,App Configuration,App Configuration should use private link,ca610c1d-041c-4332-9d88-7ed3094967c7,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your app configuration instances instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/appconfig/private-endpoint .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Configuration/PrivateLink_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,Event Grid,Azure Event Grid domains should use private link,9830b652-8523-49cc-b1b3-e17dce1127ca,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Event Grid domain instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/privateendpoints .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Grid/Domains_PrivateEndpoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,Event Grid,Azure Event Grid topics should use private link,4b90e17e-8448-49db-875e-bd83fb6f804f,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Event Grid topic instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/privateendpoints .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Grid/Topics_PrivateEndpoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,Machine Learning,Azure Machine Learning workspaces should use private link,40cec1dd-a100-4920-b15b-3024fe8901ab,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your Azure Machine Learning workspaces instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/azureml-workspaces-privatelink .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_PrivateLinkEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,SignalR,Azure SignalR Service should use private link,53503636-bcc9-4748-9663-5348217f160f,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your SignalR resources instead of the entire service, you'll also be protected against data leakage risks .Learn more at: https://aka.ms/asrs/privatelink .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SignalR/SignalR_PrivateEndpointEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,Container Registry,Container registries should use private link,e8eef0a8-67cf-4eb4-9386-14b0e78733d4,"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network.By mapping private endpoints to your container registries instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/acr/private-link .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_PrivateEndpointEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,SQL,Private endpoint connections on Azure SQL Database should be enabled,7698e800-9299-47a6-b3b6-5a0fee576eed,Private endpoint connections enforce secure communication by enabling private connectivity to Azure SQL Database.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PrivateEndpoint_Audit.json,1.1.0
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,Key Vault,Private endpoint should be configured for Key Vault,5f0bc445-3935-4915-9981-011aa2b46147,Private link provides a way to connect Key Vault to your Azure resources without sending traffic over the public internet. Private link provides defense in depth protection against data exfiltration.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultPrivateEndpointEnabled_Audit.json,1.1.0-preview
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,SQL,Private endpoint should be enabled for MariaDB servers,0a1302fb-a631-4106-9753-f3d494733990,"Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MariaDB. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_EnablePrivateEndPoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,SQL,Private endpoint should be enabled for MySQL servers,7595c971-233d-4bcf-bd18-596129188c49,"Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MySQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnablePrivateEndPoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,SQL,Private endpoint should be enabled for PostgreSQL servers,0564d078-92f5-4f97-8398-b9f58a51f70b,"Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for PostgreSQL. Configure a private endpoint connection to enable access to traffic coming only from known networks and prevent access from all other IP addresses, including within Azure.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnablePrivateEndPoint_Audit.json,1.0.2
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,Storage,Storage account should use a private link connection,6edd7eda-6dd8-40f7-810d-67160c639cd9,"Private links enforce secure communication, by providing private connectivity to the storage account","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountPrivateEndpointEnabled_Audit.json,1.0.0
Azure Security Benchmark,Network Security,Establish private network access to Azure services,NS-3,VM Image Builder,VM Image Builder templates should use private link,2154edb9-244f-4741-9970-660785bccdaa,"Audit VM Image Builder templates that do not have a virtual network configured. When a virtual network is not configured, a public IP is created and used instead which may directly expose resources to the internet and increase the potential attack surface.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/VM%20Image%20Builder/PrivateLinkEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,Authorized IP ranges should be defined on Kubernetes Services,0e246bcf-5f6f-4f87-bc6f-775d4712c7ea,Restrict access to the Kubernetes Service Management API by granting API access only to IP addresses in specific ranges. It is recommended to limit access to authorized IP ranges to ensure that only applications from allowed networks can access the cluster.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableIpRanges_KubernetesService_Audit.json,2.0.1
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Cosmos DB,Azure Cosmos DB accounts should have firewall rules,862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb,Firewall rules should be defined on your Azure Cosmos DB accounts to prevent traffic from unauthorized sources. Accounts that have at least one IP rule defined with the virtual network filter enabled are deemed compliant. Accounts disabling public access are also deemed compliant.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/Cosmos_NetworkRulesExist_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,Azure DDoS Protection Standard should be enabled,a7aca53f-2ed4-4466-a25e-0b45ade68efd,DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableDDoSProtection_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,IP Forwarding on your virtual machine should be disabled,bd352bd5-2853-4985-bf0d-73806b4a5744,"Enabling IP forwarding on a virtual machine's NIC allows the machine to receive traffic addressed to other destinations. IP forwarding is rarely required (e.g., when using the VM as a network virtual appliance), and therefore, this should be reviewed by the network security team.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_IPForwardingOnVirtualMachines_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Network,SSH access from the Internet should be blocked,2c89a2e5-7285-40fe-afe0-ae8654b92fab,This policy audits any network security rule that allows SSH access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_SSHAccess_Audit.json,2.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Protect applications and services from external network attacks,NS-4,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
Azure Security Benchmark,Network Security,Deploy intrusion detection/intrusion prevention systems (IDS/IPS),NS-5,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
Azure Security Benchmark,Identity Management,Standardize Azure Active Directory as the central identity and authentication system,IM-1,SQL,An Azure Active Directory administrator should be provisioned for SQL servers,1f314764-cb73-4fc9-b863-8eca98ac36e9,Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json,1.0.0
Azure Security Benchmark,Identity Management,Standardize Azure Active Directory as the central identity and authentication system,IM-1,App Service,Managed identity should be used in your API App,c4d441f8-f9d9-4a9e-9cef-e82117cb3eef,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_ApiApp_Audit.json,2.0.0
Azure Security Benchmark,Identity Management,Standardize Azure Active Directory as the central identity and authentication system,IM-1,App Service,Managed identity should be used in your Function App,0da106f2-4ca3-48e8-bc85-c638fe6aea8f,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_FunctionApp_Audit.json,2.0.0
Azure Security Benchmark,Identity Management,Standardize Azure Active Directory as the central identity and authentication system,IM-1,App Service,Managed identity should be used in your Web App,2b9ad585-36bc-4615-b300-fd4435808332,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_WebApp_Audit.json,2.0.0
Azure Security Benchmark,Identity Management,Standardize Azure Active Directory as the central identity and authentication system,IM-1,Service Fabric,Service Fabric clusters should only use Azure Active Directory for client authentication,b54ed75b-3e1a-44ac-a333-05ba39b99ff0,Audit usage of client authentication only via Azure Active Directory in Service Fabric,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditADAuth_Audit.json,1.1.0
Azure Security Benchmark,Identity Management,Manage application identities securely and automatically,IM-2,App Service,Managed identity should be used in your API App,c4d441f8-f9d9-4a9e-9cef-e82117cb3eef,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_ApiApp_Audit.json,2.0.0
Azure Security Benchmark,Identity Management,Manage application identities securely and automatically,IM-2,App Service,Managed identity should be used in your Function App,0da106f2-4ca3-48e8-bc85-c638fe6aea8f,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_FunctionApp_Audit.json,2.0.0
Azure Security Benchmark,Identity Management,Manage application identities securely and automatically,IM-2,App Service,Managed identity should be used in your Web App,2b9ad585-36bc-4615-b300-fd4435808332,Use a managed identity for enhanced authentication security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_UseManagedIdentity_WebApp_Audit.json,2.0.0
Azure Security Benchmark,Identity Management,Manage application identities securely and automatically,IM-2,Security Center,Service principals should be used to protect your subscriptions instead of management certificates,6646a0bd-e110-40ca-bb97-84fcee63c414,"Management certificates allow anyone who authenticates with them to manage the subscription(s) they are associated with. To manage subscriptions more securely, use of service principals with Resource Manager is recommended to limit the impact of a certificate compromise.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UseServicePrincipalToProtectSubscriptions.json,1.0.0
Azure Security Benchmark,Identity Management,Use strong authentication controls for all Azure Active Directory based access,IM-4,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
Azure Security Benchmark,Identity Management,Use strong authentication controls for all Azure Active Directory based access,IM-4,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
Azure Security Benchmark,Identity Management,Use strong authentication controls for all Azure Active Directory based access,IM-4,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Protect and limit highly privileged users,PA-1,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Protect and limit highly privileged users,PA-1,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Protect and limit highly privileged users,PA-1,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Protect and limit highly privileged users,PA-1,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Review and reconcile user access regularly,PA-3,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Review and reconcile user access regularly,PA-3,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Review and reconcile user access regularly,PA-3,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Review and reconcile user access regularly,PA-3,Security Center,External accounts with read permissions should be removed from your subscription,5f76cf89-fbf2-47fd-a3f4-b891fa780b60,External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Review and reconcile user access regularly,PA-3,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
Azure Security Benchmark,Privileged Access,Follow just enough administration (least privilege principle),PA-7,General,Audit usage of custom RBAC rules,a451c1ef-c6ca-483d-87ed-f49761e3ffb5,"Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json,1.0.0
Azure Security Benchmark,Privileged Access,Follow just enough administration (least privilege principle),PA-7,General,Custom subscription owner roles should not exist,10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9,This policy ensures that no custom subscription owner roles exist.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/CustomSubscription_OwnerRole_Audit.json,2.0.0
Azure Security Benchmark,Privileged Access,Follow just enough administration (least privilege principle),PA-7,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,"Discovery, classify and label sensitive data",DP-1,Security Center,Sensitive data in your SQL databases should be classified,cc9835f2-9f6b-4cc8-ab4a-f8ef615eb349,Azure Security Center monitors the data discovery and classification scan results for your SQL databases and provides recommendations to classify the sensitive data in your databases for better monitoring and security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbDataClassification_Audit.json,3.0.0-preview
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,Cognitive Services,Cognitive Services accounts should enable data encryption,2bdd0062-9d75-436e-89df-487dd8e4b3c7,"This policy audits any Cognitive Services account not using data encryption. For each Cognitive Services account with storage, should enable data encryption with either customer managed or Microsoft managed key.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_Encryption_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
Azure Security Benchmark,Data Protection,Protect sensitive data,DP-2,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Monitor for unauthorized transfer of sensitive data,DP-3,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
Azure Security Benchmark,Data Protection,Monitor for unauthorized transfer of sensitive data,DP-3,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,Monitor for unauthorized transfer of sensitive data,DP-3,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,Monitor for unauthorized transfer of sensitive data,DP-3,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,FTPS only should be required in your API App,9a1b8c48-453a-4044-86c3-d8bfd823e4f5,Enable FTPS enforcement for enhanced security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_ApiApp_Audit.json,2.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,FTPS only should be required in your Function App,399b2637-a50f-4f95-96f8-3a145476eb15,Enable FTPS enforcement for enhanced security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_FunctionApp_Audit.json,2.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,FTPS should be required in your Web App,4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b,Enable FTPS enforcement for enhanced security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditFTPS_WebApp_Audit.json,2.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,Kubernetes,Kubernetes clusters should be accessible only over HTTPS,1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d,"Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. For more info, visit https://aka.ms/kubepolicydoc","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/IngressHttpsOnly.json,5.0.2
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive information in transit,DP-4,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Automation,Automation account variables should be encrypted,3657f5a0-770e-44a3-b44e-9431ba1e9735,It is important to enable encryption of Automation account variable assets when storing sensitive data,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json,1.1.0
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Cosmos DB,Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest,1f905d99-2ab7-462c-a6b0-f709acca6c8f,"Use customer-managed keys to manage the encryption at rest of your Azure Cosmos DB. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/cosmosdb-cmk .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/Cosmos_CMK_Deny.json,1.0.2
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Machine Learning,Azure Machine Learning workspaces should be encrypted with a customer-managed key,ba769a63-b8cc-4b2d-abf6-ac33c7204be8,"Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/azureml-workspaces-cmk .","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json,1.0.3
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,SQL,Bring your own key data protection should be enabled for MySQL servers,83cef61d-dbd1-4b20-a4fc-5fbc7da10833,"Use customer-managed keys to manage the encryption at rest of your MySQL servers. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableByok_Audit.json,1.0.3
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,SQL,Bring your own key data protection should be enabled for PostgreSQL servers,18adea5e-f416-4d0f-8aa8-d24321e3e274,"Use customer-managed keys to manage the encryption at rest of your PostgreSQL servers. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableByok_Audit.json,1.0.3
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Cognitive Services,Cognitive Services accounts should enable data encryption with a customer-managed key,67121cc7-ff39-4ab8-b7e3-95b84dab487d,"Customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more about customer-managed keys at https://go.microsoft.com/fwlink/?linkid=2121321 .","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_CustomerManagedKey_Audit.json,1.0.3
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Cognitive Services,Cognitive Services accounts should use customer owned storage or enable data encryption.,11566b39-f7f7-4b82-ab06-68d8700eb0a4,"This policy audits any Cognitive Services account not using customer owned storage nor data encryption. For each Cognitive Services account with storage, use either customer owned storage or enable data encryption.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_BYOX_Audit.json,1.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Container Registry,Container registries should be encrypted with a customer-managed key,5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580,"Use customer-managed keys to manage the encryption at rest of the contents of your registries. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/acr/CMK .","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_CMKEncryptionEnabled_Audit.json,1.1.2
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Service Fabric,Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign,617c02be-7f02-4efd-8836-3180d47b6c68,"Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json,1.1.0
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,SQL,SQL managed instances should use customer-managed keys to encrypt data at rest,048248b0-55cd-46da-b1ff-39efd52db260,"Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,SQL,SQL servers should use customer-managed keys to encrypt data at rest,0d134df8-db83-46fb-ad72-fe0c9428c8dd,"Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,2.0.1
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,Storage,Storage accounts should use customer-managed key for encryption,6fac406b-40ca-413b-bf8e-0bf964659c25,"Secure your storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json,1.0.2
Azure Security Benchmark,Data Protection,Encrypt sensitive data at rest,DP-5,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
Azure Security Benchmark,Asset Management,Use only approved Azure services,AM-3,Storage,Storage accounts should be migrated to new Azure Resource Manager resources,37e0d2fe-28a5-43d6-a273-67d37d1f5606,"Use new Azure Resource Manager for your storage accounts to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Classic_AuditForClassicStorages_Audit.json,1.0.0
Azure Security Benchmark,Asset Management,Use only approved Azure services,AM-3,Compute,Virtual machines should be migrated to new Azure Resource Manager resources,1d84d5fb-01f6-4d12-ba4f-4a26081d403d,"Use new Azure Resource Manager for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ClassicCompute_Audit.json,1.0.0
Azure Security Benchmark,Asset Management,Use only approved applications in compute resources,AM-6,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure resources,LT-1,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
Azure Security Benchmark,Logging and Threat Detection,Enable threat detection for Azure identity and access management,LT-2,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure network activities,LT-3,Monitoring,Network traffic data collection agent should be installed on Linux virtual machines,04c4380f-3fae-46e8-96c9-30193528f602,"Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Linux.json,1.0.1-preview
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure network activities,LT-3,Monitoring,Network traffic data collection agent should be installed on Windows virtual machines,2f2ee1de-44aa-4762-b6bd-0893fc3f306d,"Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Windows.json,1.0.1-preview
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure network activities,LT-3,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,App Service,Diagnostic logs in App Services should be enabled,b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0,Audit enabling of diagnostic logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditLoggingMonitoring_Audit.json,2.0.0
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Data Lake,Resource logs in Azure Data Lake Store should be enabled,057ef27e-665e-4328-8ea3-04b3122bd9fb,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStore_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Stream Analytics,Resource logs in Azure Stream Analytics should be enabled,f9be5368-9bf5-4b84-9e0a-7850da98bb46,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Stream%20Analytics/StreamAnalytics_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Batch,Resource logs in Batch accounts should be enabled,428256e6-1fac-4f48-a757-df34c2b3336d,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Batch/Batch_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Data Lake,Resource logs in Data Lake Analytics should be enabled,c95c74d9-38fe-4f0d-af86-0c7d626a315c,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeAnalytics_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Event Hub,Resource logs in Event Hub should be enabled,83a214f7-d01a-484b-91a9-ed54470c9a6a,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Hub/EventHub_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Internet of Things,Resource logs in IoT Hub should be enabled,383856f8-de7f-44a2-81fc-e5135b5c2aa4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Internet%20of%20Things/IoTHub_AuditDiagnosticLog_Audit.json,3.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Key Vault,Resource logs in Key Vault should be enabled,cf820ca0-f99e-4f3e-84fb-66e913812d21,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Logic Apps,Resource logs in Logic Apps should be enabled,34f95f76-5386-4de7-b824-0d8478470c9d,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Logic%20Apps/LogicApps_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Search,Resource logs in Search services should be enabled,b4330a05-a843-4bc8-bf9a-cacce50c67f4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Search/Search_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Service Bus,Resource logs in Service Bus should be enabled,f8d36e2f-389b-4ee4-898d-21aeb69a0f45,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Bus/ServiceBus_AuditDiagnosticLog_Audit.json,4.0.1
Azure Security Benchmark,Logging and Threat Detection,Enable logging for Azure resources,LT-4,Compute,Resource logs in Virtual Machine Scale Sets should be enabled,7c1b1214-f927-48bf-8882-84f0af6588b1,It is recommended to enable Logs so that activity trail can be recreated when investigations are required in the event of an incident or a compromise.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ServiceFabric_and_VMSS_AuditVMSSDiagnostics.json,2.0.1
Azure Security Benchmark,Logging and Threat Detection,Centralize security log management and analysis,LT-5,Security Center,Auto provisioning of the Log Analytics agent should be enabled on your subscription,475aae12-b88a-4572-8b36-9b712b2b3a17,"To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Automatic_provisioning_log_analytics_monitoring_agent.json,1.0.1
Azure Security Benchmark,Logging and Threat Detection,Centralize security log management and analysis,LT-5,Security Center,Log Analytics agent health issues should be resolved on your machines,d62cfe2b-3ab0-4d41-980d-76803b58ca65,"Security Center uses the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA). To make sure your virtual machines are successfully monitored, you need to make sure the agent is installed on the virtual machines and properly collects security events to the configured workspace.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ResolveLaHealthIssues.json,1.0.0
Azure Security Benchmark,Logging and Threat Detection,Centralize security log management and analysis,LT-5,Monitoring,Log Analytics agent should be installed on your Linux Azure Arc machines,842c54e8-c2f9-4d79-ae8d-38d8b8019373,This policy audits Linux Azure Arc machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Arc_Linux_LogAnalytics_Audit.json,1.0.0-preview
Azure Security Benchmark,Logging and Threat Detection,Centralize security log management and analysis,LT-5,Security Center,Log Analytics agent should be installed on your virtual machine for Azure Security Center monitoring,a4fe33eb-e377-4efb-ab31-0784311bc499,This policy audits any Windows/Linux virtual machines (VMs) if the Log Analytics agent is not installed which Security Center uses to monitor for security vulnerabilities and threats,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_InstallLaAgentOnVm.json,1.0.0
Azure Security Benchmark,Logging and Threat Detection,Centralize security log management and analysis,LT-5,Security Center,Log Analytics agent should be installed on your virtual machine scale sets for Azure Security Center monitoring,a3a6ea0c-e018-4933-9ef0-5aaa1501449b,Security Center collects data from your Azure virtual machines (VMs) to monitor for security vulnerabilities and threats.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_InstallLaAgentOnVmss.json,1.0.0
Azure Security Benchmark,Logging and Threat Detection,Centralize security log management and analysis,LT-5,Monitoring,Log Analytics agent should be installed on your Windows Azure Arc machines,d69b1763-b96d-40b8-a2d9-ca31e9fd0d3e,This policy audits Windows Azure Arc machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Arc_Windows_LogAnalytics_Audit.json,1.0.0-preview
Azure Security Benchmark,Incident Response,Preparation - setup incident notification,IR-2,Security Center,Email notification for high severity alerts should be enabled,6e2593d9-add6-4083-9c9b-4b7d2188c899,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, enable email notifications for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification.json,1.0.1
Azure Security Benchmark,Incident Response,Preparation - setup incident notification,IR-2,Security Center,Email notification to subscription owner for high severity alerts should be enabled,0b15565f-aa9e-48ba-8619-45960f2c314d,"To ensure your subscription owners are notified when there is a potential security breach in their subscription, set email notifications to subscription owners for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification_to_subscription_owner.json,2.0.0
Azure Security Benchmark,Incident Response,Preparation - setup incident notification,IR-2,Security Center,Subscriptions should have a contact email address for security issues,4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json,1.0.1
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
Azure Security Benchmark,Incident Response,Detection and analysis - create incidents based on high quality alerts,IR-3,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
Azure Security Benchmark,Incident Response,Detection and analysis - prioritize incidents,IR-5,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters,0a15ec92-a229-4763-bb14-0ea34a568f8d,"Azure Policy Add-on for Kubernetes service (AKS) extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA), to apply at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_AzurePolicyAddOn_Audit.json,1.0.2
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Do not allow privileged containers in Kubernetes cluster,95edb821-ddaf-4404-9732-666045e056b4,"This policy does not allow privileged containers creation in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerNoPrivilege.json,5.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On',0c192fe8-9cbb-4516-85b3-0ade8bd03886,Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_ClientCert.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Ensure container CPU and memory resource limits do not exceed the specified limits in Kubernetes cluster,e345eecc-fa47-480f-9e88-67dcc122b164,"This policy ensures container CPU and memory resource limits are defined and do not exceed the specified limits in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerResourceLimits.json,5.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Ensure containers listen only on allowed ports in Kubernetes cluster,440b515e-a580-421e-abeb-b159a61ddcbc,"This policy enforces containers to listen only on allowed ports in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerAllowedPorts.json,5.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Ensure only allowed container images in Kubernetes cluster,febd0533-8e55-448f-b837-bd0e06f16469,"This policy ensures only allowed container images are running in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerAllowedImages.json,5.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Ensure services listen only on allowed ports in Kubernetes cluster,233a2a17-77ca-4fb1-9b6b-69223d272a44,"This policy enforces services to listen only on allowed ports in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ServiceAllowedPorts.json,5.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On',5bb220d9-2698-4ee4-8404-b9c30c9df609,Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_ClientCert.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,Function apps should have 'Client Certificates (Incoming client certificates)' enabled,eaebaea7-8013-4ceb-9d14-7eb32271373c,Client certificates allow for the app to request a certificate for incoming requests. Only clients with valid certificates will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_ClientCert.json,1.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster containers should not share host process ID or host IPC namespace,47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8,"This policy blocks pod containers from sharing the host process ID namespace and host IPC namespace in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc/ .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/BlockHostNamespace.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster containers should only use allowed AppArmor profiles,511f5417-5d12-434d-ab2e-816901e72a5e,"This policy ensures containers only use allowed AppArmor profiles in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/EnforceAppArmorProfile.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster containers should only use allowed capabilities,c26596ff-4d70-4e6a-9a30-c2506bd2f80c,"This policy ensures containers only use allowed capabilities in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerAllowedCapabilities.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster containers should run with a read only root file system,df49d893-a74c-421d-bc95-c663042e5b80,"This policy ensures containers run with a read only root file system in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc/ .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ReadOnlyRootFileSystem.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster pod hostPath volumes should only use allowed host paths,098fc59e-46c7-4d99-9b16-64990e543d75,"This policy ensures pod hostPath volumes can only use allowed host paths in a Kubernetes Cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AllowedHostPaths.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster pods and containers should only run with approved user and group IDs,f06ddb64-5fa3-4b77-b166-acb36f7f6042,"This policy controls the user, primary group, supplemental group and file system group IDs that pods and containers can use to run in a Kubernetes Cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AllowedUsersGroups.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes cluster pods should only use approved host network and port range,82985f06-dc18-4a48-bc1c-b9f4f0098cfe,"This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,Kubernetes,Kubernetes clusters should not allow container privilege escalation,1c6e92c9-99f0-4e55-9cf2-0c234dc48f99,"This policy does not allow containers to use privilege escalation in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/ContainerNoPrivilegeEscalation.json,2.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for Azure services,PV-2,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for compute resources,PV-4,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for compute resources,PV-4,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Sustain secure configurations for compute resources,PV-4,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Perform software vulnerability assessments,PV-6,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Perform software vulnerability assessments,PV-6,Security Center,Vulnerabilities in Azure Container Registry images should be remediated,5f0f936f-2f01-4bf5-b6be-d423792fa562,Container image vulnerability assessment scans your registry for security vulnerabilities on each pushed container image and exposes detailed findings for each image (powered by Qualys). Resolving the vulnerabilities can greatly improve your containers' security posture and protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerRegistryVulnerabilityAssessment_Audit.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Perform software vulnerability assessments,PV-6,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Perform software vulnerability assessments,PV-6,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
Azure Security Benchmark,Posture and Vulnerability Management,Perform software vulnerability assessments,PV-6,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'Java version' is the latest, if used as a part of the API app",88999f4c-376a-45c8-bcb3-4058f713cf39,"Periodically, newer versions are released for Java either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_java_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Function app",9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_java_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Web app",496223c3-ad65-4ecd-878a-bae78737e9ed,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_java_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the API app",1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_PHP_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the WEB app",7261b898-8a84-4db8-9e04-18527132abb3,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_PHP_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'Python version' is the latest, if used as a part of the API app",74c3584d-afae-46f7-a20a-6f8adba71a16,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_python_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Function app",7238174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_python_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Web app",7008174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_python_Latest.json,2.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,Security Center,Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version,fb893a29-21bb-418c-a157-e99480ec364c,"Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UpgradeVersion_KubernetesService_Audit.json,1.0.2
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,Security Center,System updates on virtual machine scale sets should be installed,c3f317a7-a95c-4547-b7e7-11017ebdf2fe,Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json,3.0.0
Azure Security Benchmark,Posture and Vulnerability Management,Rapidly and automatically remediate software vulnerabilities,PV-7,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
Azure Security Benchmark,Endpoint Security,Use Endpoint Detection and Response (EDR),ES-1,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
Azure Security Benchmark,Endpoint Security,Use centrally managed modern anti-malware software,ES-2,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
Azure Security Benchmark,Endpoint Security,Use centrally managed modern anti-malware software,ES-2,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
Azure Security Benchmark,Endpoint Security,Use centrally managed modern anti-malware software,ES-2,Guest Configuration,Windows Defender Exploit Guard should be enabled on your machines,bed48b13-6647-468e-aa2f-1af1d3f4dd40,Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components that are designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks while enabling enterprises to balance their security risk and productivity requirements (Windows only).,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsDefenderExploitGuard_AINE.json,1.1.1
Azure Security Benchmark,Endpoint Security,Ensure anti-malware software and signatures are updated,ES-3,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
Azure Security Benchmark,Endpoint Security,Ensure anti-malware software and signatures are updated,ES-3,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
Azure Security Benchmark,Backup and Recovery,Ensure regular automated backups,BR-1,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Ensure regular automated backups,BR-1,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Ensure regular automated backups,BR-1,SQL,Geo-redundant backup should be enabled for Azure Database for MySQL,82339799-d096-41ae-8538-b108becf0970,"Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Ensure regular automated backups,BR-1,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Ensure regular automated backups,BR-1,SQL,Long-term geo-redundant backup should be enabled for Azure SQL Databases,d38fc420-0735-4ef3-ac11-c806f651a570,This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json,2.0.0
Azure Security Benchmark,Backup and Recovery,Encrypt backup data,BR-2,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Encrypt backup data,BR-2,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Encrypt backup data,BR-2,SQL,Geo-redundant backup should be enabled for Azure Database for MySQL,82339799-d096-41ae-8538-b108becf0970,"Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Encrypt backup data,BR-2,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
Azure Security Benchmark,Backup and Recovery,Encrypt backup data,BR-2,SQL,Long-term geo-redundant backup should be enabled for Azure SQL Databases,d38fc420-0735-4ef3-ac11-c806f651a570,This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json,2.0.0
Azure Security Benchmark,Backup and Recovery,Mitigate risk of lost keys,BR-4,Key Vault,Key vaults should have purge protection enabled,0b60c0b2-2dc2-4e1c-b5c9-abbed971de53,Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_Recoverable_Audit.json,1.1.1
Azure Security Benchmark,Backup and Recovery,Mitigate risk of lost keys,BR-4,Key Vault,Key vaults should have soft delete enabled,1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d,"Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of a key vault can lead to permanent data loss. Soft delete allows you to recover an accidentally deleted key vault for a configurable retention period.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_SoftDeleteMustBeEnabled_Audit.json,1.0.2
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,API for FHIR,CORS should not allow every domain to access your API for FHIR,0fea8f8a-4169-495d-8307-30ec335f387d,"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API for FHIR. To protect your API for FHIR, remove access for all domains and explicitly define the domains allowed to connect.","audit, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_RestrictCORSAccess_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,External accounts with read permissions should be removed from your subscription,5f76cf89-fbf2-47fd-a3f4-b891fa780b60,External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json,3.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Kubernetes,Kubernetes cluster pods should only use approved host network and port range,82985f06-dc18-4a48-bc1c-b9f4f0098cfe,"This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json,2.0.1
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,SQL,Public network access should be disabled for MySQL flexible servers,c9299215-ae47-4f50-9c54-8a392f68a052,Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,SQL,Public network access should be disabled for PostgreSQL flexible servers,5e1de0e3-42cb-4ebc-a86d-61d0c619ca48,Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Network,SSH access from the Internet should be blocked,2c89a2e5-7285-40fe-afe0-ae8654b92fab,This policy audits any network security rule that allows SSH access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_SSHAccess_Audit.json,2.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Storage,Storage accounts should allow access from trusted Microsoft services,c9d007d0-c057-4772-b18c-01e546713bcd,"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccess_TrustedMicrosoftServices_Audit.json,1.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Access',3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json,2.0.0
CMMC L3,Access Control,"Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems).",AC.1.001,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,API for FHIR,CORS should not allow every domain to access your API for FHIR,0fea8f8a-4169-495d-8307-30ec335f387d,"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API for FHIR. To protect your API for FHIR, remove access for all domains and explicitly define the domains allowed to connect.","audit, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_RestrictCORSAccess_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Kubernetes,Kubernetes cluster pods should only use approved host network and port range,82985f06-dc18-4a48-bc1c-b9f4f0098cfe,"This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json,2.0.1
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Public network access should be disabled for MySQL flexible servers,c9299215-ae47-4f50-9c54-8a392f68a052,Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Public network access should be disabled for PostgreSQL flexible servers,5e1de0e3-42cb-4ebc-a86d-61d0c619ca48,Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Network,SSH access from the Internet should be blocked,2c89a2e5-7285-40fe-afe0-ae8654b92fab,This policy audits any network security rule that allows SSH access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_SSHAccess_Audit.json,2.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Storage,Storage accounts should allow access from trusted Microsoft services,c9d007d0-c057-4772-b18c-01e546713bcd,"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccess_TrustedMicrosoftServices_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Access',3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json,2.0.0
CMMC L3,Access Control,Limit information system access to the types of transactions and functions that authorized users are permitted to execute.,AC.1.002,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
CMMC L3,Access Control,Verify and control/limit connections to and use of external information systems.,AC.1.003,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
CMMC L3,Access Control,Verify and control/limit connections to and use of external information systems.,AC.1.003,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
CMMC L3,Access Control,Verify and control/limit connections to and use of external information systems.,AC.1.003,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
CMMC L3,Access Control,Verify and control/limit connections to and use of external information systems.,AC.1.003,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
CMMC L3,Access Control,Verify and control/limit connections to and use of external information systems.,AC.1.003,Network,SSH access from the Internet should be blocked,2c89a2e5-7285-40fe-afe0-ae8654b92fab,This policy audits any network security rule that allows SSH access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_SSHAccess_Audit.json,2.0.0
CMMC L3,Access Control,"Employ the principle of least privilege, including for specific security functions and privileged accounts.",AC.2.007,Security Center,External accounts with read permissions should be removed from your subscription,5f76cf89-fbf2-47fd-a3f4-b891fa780b60,External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json,3.0.0
CMMC L3,Access Control,"Employ the principle of least privilege, including for specific security functions and privileged accounts.",AC.2.007,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
CMMC L3,Access Control,"Employ the principle of least privilege, including for specific security functions and privileged accounts.",AC.2.007,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,Access Control,"Employ the principle of least privilege, including for specific security functions and privileged accounts.",AC.2.007,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
CMMC L3,Access Control,Use non-privileged accounts or roles when accessing nonsecurity functions.,AC.2.008,Guest Configuration,Windows machines should meet requirements for 'Security Options - User Account Control',492a29ed-d143-4f03-b6a4-705ce081b463,"Windows machines should have the specified Group Policy settings in the category 'Security Options - User Account Control' for mode for admins, behavior of elevation prompt, and virtualizing file and registry write failures. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsUserAccountControl_AINE.json,2.0.0
CMMC L3,Access Control,Use non-privileged accounts or roles when accessing nonsecurity functions.,AC.2.008,Guest Configuration,Windows machines should meet requirements for 'User Rights Assignment',e068b215-0026-4354-b347-8fb2766f73a2,"Windows machines should have the specified Group Policy settings in the category 'User Rights Assignment' for allowing log on locally, RDP, access from the network, and many other user activities. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_UserRightsAssignment_AINE.json,2.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,Access Control,Monitor and control remote access sessions.,AC.2.013,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Access Control,Route remote access via managed access control points.,AC.2.015,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,API for FHIR,CORS should not allow every domain to access your API for FHIR,0fea8f8a-4169-495d-8307-30ec335f387d,"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API for FHIR. To protect your API for FHIR, remove access for all domains and explicitly define the domains allowed to connect.","audit, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_RestrictCORSAccess_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,SQL,Public network access should be disabled for MySQL flexible servers,c9299215-ae47-4f50-9c54-8a392f68a052,Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,SQL,Public network access should be disabled for PostgreSQL flexible servers,5e1de0e3-42cb-4ebc-a86d-61d0c619ca48,Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Network,RDP access from the Internet should be blocked,e372f825-a257-4fb8-9175-797a8a8627d6,This policy audits any network security rule that allows RDP access from Internet,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_RDPAccess_Audit.json,2.0.0
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,Access Control,Control the flow of CUI in accordance with approved authorizations.,AC.2.016,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Access',3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json,2.0.0
CMMC L3,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,AC.3.017,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
CMMC L3,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,AC.3.017,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
CMMC L3,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,AC.3.017,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
CMMC L3,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,AC.3.017,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
CMMC L3,Access Control,Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.,AC.3.018,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,Access Control,Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.,AC.3.018,General,Audit usage of custom RBAC rules,a451c1ef-c6ca-483d-87ed-f49761e3ffb5,"Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json,1.0.0
CMMC L3,Access Control,Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.,AC.3.018,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Privilege Use',87845465-c458-45f3-af66-dcd62176f397,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Privilege Use' for auditing nonsensitive and other privilege use. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesPrivilegeUse_AINE.json,2.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Security Center,Guest Configuration extension should be installed on your machines,ae89ebca-1c92-4898-ac2c-9f63decb045c,"To ensure secure configurations of in-guest settings of your machine, install the Guest Configuration extension. In-guest settings that the extension monitors include the configuration of the operating system, application configuration or presence, and environment settings. Once installed, in-guest policies will be available such as 'Windows Exploit guard should be enabled'. Learn more at https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_GCExtOnVm.json,1.0.1
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Security Center,Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity,d26f7642-7545-4e18-9b75-8c9bbdee3a9a,The Guest Configuration extension requires a system assigned managed identity. Azure virtual machines in the scope of this policy will be non-compliant when they have the Guest Configuration extension installed but do not have a system assigned managed identity. Learn more at https://aka.ms/gcpol,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_GCExtOnVmWithNoSAMI.json,1.0.1
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Guest Configuration,Windows machines should meet requirements for 'Security Options - User Account Control',492a29ed-d143-4f03-b6a4-705ce081b463,"Windows machines should have the specified Group Policy settings in the category 'Security Options - User Account Control' for mode for admins, behavior of elevation prompt, and virtualizing file and registry write failures. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsUserAccountControl_AINE.json,2.0.0
CMMC L3,Access Control,Authorize remote execution of privileged commands and remote access to security-relevant information.,AC.3.021,Guest Configuration,Windows machines should meet requirements for 'User Rights Assignment',e068b215-0026-4354-b347-8fb2766f73a2,"Windows machines should have the specified Group Policy settings in the category 'User Rights Assignment' for allowing log on locally, RDP, access from the network, and many other user activities. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_UserRightsAssignment_AINE.json,2.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,"Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'",1a4e592a-6a6e-44a5-9814-e36264ca96e7,"This policy ensures that a log profile collects logs for categories 'write,' 'delete,' and 'action'","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllCategories.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,Azure subscriptions should have a log profile for Activity Log,7796937f-307b-4598-941c-67d3a05ebfe7,This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
CMMC L3,Audit and Accountability,Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.,AU.2.041,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,Activity log should be retained for at least one year,b02aacc0-b073-424e-8298-42b22829ee0a,This policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLogRetention_365orGreater.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,Azure subscriptions should have a log profile for Activity Log,7796937f-307b-4598-941c-67d3a05ebfe7,This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
CMMC L3,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",AU.2.042,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
CMMC L3,Audit and Accountability,Alert in the event of an audit logging process failure.,AU.3.046,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,App Service,Diagnostic logs in App Services should be enabled,b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0,Audit enabling of diagnostic logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditLoggingMonitoring_Audit.json,2.0.0
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Internet of Things,Resource logs in IoT Hub should be enabled,383856f8-de7f-44a2-81fc-e5135b5c2aa4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Internet%20of%20Things/IoTHub_AuditDiagnosticLog_Audit.json,3.0.1
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
CMMC L3,Audit and Accountability,"Collect audit information (e.g., logs) into one or more central repositories.",AU.3.048,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
CMMC L3,Audit and Accountability,"Protect audit information and audit logging tools from unauthorized access, modification, and deletion.",AU.3.049,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,Audit and Accountability,"Protect audit information and audit logging tools from unauthorized access, modification, and deletion.",AU.3.049,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Security Center,Allowlist rules in your adaptive application control policy should be updated,123a3936-f020-408a-ba0c-47873faf1534,Monitor for changes in behavior on groups of machines configured for auditing by Azure Security Center's adaptive application controls. Security Center uses machine learning to analyze the running processes on your machines and suggest a list of known-safe applications. These are presented as recommended apps to allow in adaptive application control policies.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControlsUpdate_Audit.json,3.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
CMMC L3,Security Assessment,Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.,CA.2.158,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Security Center,Allowlist rules in your adaptive application control policy should be updated,123a3936-f020-408a-ba0c-47873faf1534,Monitor for changes in behavior on groups of machines configured for auditing by Azure Security Center's adaptive application controls. Security Center uses machine learning to analyze the running processes on your machines and suggest a list of known-safe applications. These are presented as recommended apps to allow in adaptive application control policies.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControlsUpdate_Audit.json,3.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
CMMC L3,Security Assessment,Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.,CA.3.161,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
CMMC L3,Configuration Management,"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.",CM.2.061,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
CMMC L3,Configuration Management,"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.",CM.2.061,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,Configuration Management,"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.",CM.2.061,Guest Configuration,Linux machines should meet requirements for the Azure security baseline,fc9b3da7-8347-4380-8e70-0a0361d8dedd,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines should meet the requirements for the Azure security baseline","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AzureLinuxBaseline_AINE.json,1.1.0-preview
CMMC L3,Configuration Management,Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.,CM.2.062,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
CMMC L3,Configuration Management,Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.,CM.2.062,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Privilege Use',87845465-c458-45f3-af66-dcd62176f397,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Privilege Use' for auditing nonsensitive and other privilege use. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesPrivilegeUse_AINE.json,2.0.0
CMMC L3,Configuration Management,Control and monitor user-installed software.,CM.2.063,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
CMMC L3,Configuration Management,Control and monitor user-installed software.,CM.2.063,Security Center,Allowlist rules in your adaptive application control policy should be updated,123a3936-f020-408a-ba0c-47873faf1534,Monitor for changes in behavior on groups of machines configured for auditing by Azure Security Center's adaptive application controls. Security Center uses machine learning to analyze the running processes on your machines and suggest a list of known-safe applications. These are presented as recommended apps to allow in adaptive application control policies.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControlsUpdate_Audit.json,3.0.0
CMMC L3,Configuration Management,Control and monitor user-installed software.,CM.2.063,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Configuration Management,Control and monitor user-installed software.,CM.2.063,Guest Configuration,Windows machines should meet requirements for 'Security Options - User Account Control',492a29ed-d143-4f03-b6a4-705ce081b463,"Windows machines should have the specified Group Policy settings in the category 'Security Options - User Account Control' for mode for admins, behavior of elevation prompt, and virtualizing file and registry write failures. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsUserAccountControl_AINE.json,2.0.0
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Network,Web Application Firewall (WAF) should use the specified mode for Application Gateway,12430be1-6cc8-4527-a9a8-e3d38f250096,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json,1.0.0
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Network,Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service,425bea59-a659-4cbb-8d31-34499bd030b8,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json,1.0.0
CMMC L3,Configuration Management,Establish and enforce security configuration settings for information technology products employed in organizational systems.,CM.2.064,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Configuration Management,"Track, review, approve or disapprove, and log changes to organizational systems.",CM.2.065,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,Configuration Management,"Track, review, approve or disapprove, and log changes to organizational systems.",CM.2.065,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,Configuration Management,"Track, review, approve or disapprove, and log changes to organizational systems.",CM.2.065,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Configuration Management,"Track, review, approve or disapprove, and log changes to organizational systems.",CM.2.065,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
CMMC L3,Configuration Management,"Track, review, approve or disapprove, and log changes to organizational systems.",CM.2.065,Monitoring,Azure subscriptions should have a log profile for Activity Log,7796937f-307b-4598-941c-67d3a05ebfe7,This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json,1.0.0
CMMC L3,Configuration Management,"Track, review, approve or disapprove, and log changes to organizational systems.",CM.2.065,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Policy Change',2a7a701e-dff3-4da9-9ec5-42cb98594c0b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Policy Change' for auditing changes to system audit policies. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesPolicyChange_AINE.json,2.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Allowlist rules in your adaptive application control policy should be updated,123a3936-f020-408a-ba0c-47873faf1534,Monitor for changes in behavior on groups of machines configured for auditing by Azure Security Center's adaptive application controls. Security Center uses machine learning to analyze the running processes on your machines and suggest a list of known-safe applications. These are presented as recommended apps to allow in adaptive application control policies.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControlsUpdate_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,API for FHIR,CORS should not allow every domain to access your API for FHIR,0fea8f8a-4169-495d-8307-30ec335f387d,"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API for FHIR. To protect your API for FHIR, remove access for all domains and explicitly define the domains allowed to connect.","audit, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_RestrictCORSAccess_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Kubernetes,Kubernetes cluster pods should only use approved host network and port range,82985f06-dc18-4a48-bc1c-b9f4f0098cfe,"This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json,2.0.1
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Non-internet-facing virtual machines should be protected with network security groups,bb91dfba-c30d-4263-9add-9c2384e659a6,Protect your non-internet-facing virtual machines from potential threats by restricting access with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternalVirtualMachines_Audit.json,3.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,SQL,Public network access should be disabled for MySQL flexible servers,c9299215-ae47-4f50-9c54-8a392f68a052,Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,SQL,Public network access should be disabled for PostgreSQL flexible servers,5e1de0e3-42cb-4ebc-a86d-61d0c619ca48,Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",CM.3.068,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
CMMC L3,Configuration Management,"Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.",CM.3.069,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Guest Configuration,Audit Linux machines that do not have the passwd file permissions set to 0644,e6955644-301c-44b5-a4c4-528577de6861,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that do not have the passwd file permissions set to 0644","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword121_AINE.json,1.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,"Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.",IA.1.077,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Audit Windows machines that do not have the password complexity setting enabled,bf16e0bb-31e1-4646-8202-60a235cc7e74,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have the password complexity setting enabled","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordComplexity_AINE.json,1.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Audit Windows machines that do not restrict the minimum password length to 14 characters,a2d0e922-65d0-40c4-8f87-ea6da2d307a2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not restrict the minimum password length to 14 characters","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordLength_AINE.json,1.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,IA.2.078,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Identification and Authentication,Prohibit password reuse for a specified number of generations.,IA.2.079,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Prohibit password reuse for a specified number of generations.,IA.2.079,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Prohibit password reuse for a specified number of generations.,IA.2.079,Guest Configuration,Audit Windows machines that allow re-use of the previous 24 passwords,5b054a0d-39e2-4d53-bea3-9734cad2c69b,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that allow re-use of the previous 24 passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEnforce_AINE.json,1.0.0
CMMC L3,Identification and Authentication,Prohibit password reuse for a specified number of generations.,IA.2.079,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Prohibit password reuse for a specified number of generations.,IA.2.079,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,IA.2.081,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,IA.2.081,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,IA.2.081,Guest Configuration,Audit Windows machines that do not store passwords using reversible encryption,da0f98fe-a24b-4ad5-af69-bd0400233661,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json,1.0.0
CMMC L3,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,IA.2.081,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
CMMC L3,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,IA.2.081,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,Identification and Authentication,Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.,IA.3.083,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.,IA.3.083,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.,IA.3.083,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
CMMC L3,Identification and Authentication,Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.,IA.3.084,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
CMMC L3,Incident Response,"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.",IR.2.092,Security Center,Email notification for high severity alerts should be enabled,6e2593d9-add6-4083-9c9b-4b7d2188c899,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, enable email notifications for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification.json,1.0.1
CMMC L3,Incident Response,"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.",IR.2.092,Security Center,Email notification to subscription owner for high severity alerts should be enabled,0b15565f-aa9e-48ba-8619-45960f2c314d,"To ensure your subscription owners are notified when there is a potential security breach in their subscription, set email notifications to subscription owners for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification_to_subscription_owner.json,2.0.0
CMMC L3,Incident Response,"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.",IR.2.092,Security Center,Subscriptions should have a contact email address for security issues,4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json,1.0.1
CMMC L3,Incident Response,"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.",IR.2.092,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Cosmos DB,Deploy Advanced Threat Protection for Cosmos DB Accounts,b5f04e03-92a3-4b09-9410-2cc5e5047656,This policy enables Advanced Threat Protection across Cosmos DB accounts.,"DeployIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/CosmosDbAdvancedThreatProtection_Deploy.json,1.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Storage,Deploy Advanced Threat Protection on Storage Accounts,361c2074-3595-4e5d-8cab-4f21dffc835c,This policy enables Advanced Threat Protection on Storage Accounts.,"DeployIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAdvancedThreatProtection_Deploy.json,1.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Email notification for high severity alerts should be enabled,6e2593d9-add6-4083-9c9b-4b7d2188c899,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, enable email notifications for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification.json,1.0.1
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Network,Flow log should be configured for every network security group,c251913d-7d24-4958-af87-478ed3b9ba41,"Audit for network security groups to verify if flow log resource is configured. Flow log allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions and more.",audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_FlowLog_Audit.json,1.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Network,Web Application Firewall (WAF) should use the specified mode for Application Gateway,12430be1-6cc8-4527-a9a8-e3d38f250096,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json,1.0.0
CMMC L3,Incident Response,Detect and report events.,IR.2.093,Network,Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service,425bea59-a659-4cbb-8d31-34499bd030b8,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json,1.0.0
CMMC L3,Recovery,Regularly perform and test data back-ups.,RE.2.137,Compute,Audit virtual machines without disaster recovery configured,0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56,"Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json,1.0.0
CMMC L3,Recovery,Regularly perform and test data back-ups.,RE.2.137,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
CMMC L3,Recovery,Regularly perform and test data back-ups.,RE.2.137,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
CMMC L3,Recovery,Regularly perform and test data back-ups.,RE.2.137,SQL,Geo-redundant backup should be enabled for Azure Database for MySQL,82339799-d096-41ae-8538-b108becf0970,"Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json,1.0.1
CMMC L3,Recovery,Regularly perform and test data back-ups.,RE.2.137,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
CMMC L3,Recovery,Regularly perform and test data back-ups.,RE.2.137,SQL,Long-term geo-redundant backup should be enabled for Azure SQL Databases,d38fc420-0735-4ef3-ac11-c806f651a570,This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json,2.0.0
CMMC L3,Recovery,"Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",RE.3.139,Compute,Audit virtual machines without disaster recovery configured,0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56,"Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json,1.0.0
CMMC L3,Recovery,"Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",RE.3.139,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
CMMC L3,Recovery,"Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",RE.3.139,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
CMMC L3,Recovery,"Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",RE.3.139,SQL,Geo-redundant backup should be enabled for Azure Database for MySQL,82339799-d096-41ae-8538-b108becf0970,"Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json,1.0.1
CMMC L3,Recovery,"Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",RE.3.139,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
CMMC L3,Recovery,"Regularly perform complete, comprehensive and resilient data backups as organizationally-defined.",RE.3.139,SQL,Long-term geo-redundant backup should be enabled for Azure SQL Databases,d38fc420-0735-4ef3-ac11-c806f651a570,This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json,2.0.0
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
CMMC L3,Risk Assessment,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.",RM.2.141,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
CMMC L3,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,RM.2.142,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version,fb893a29-21bb-418c-a157-e99480ec364c,"Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UpgradeVersion_KubernetesService_Audit.json,1.0.2
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Vulnerabilities in Azure Container Registry images should be remediated,5f0f936f-2f01-4bf5-b6be-d423792fa562,Container image vulnerability assessment scans your registry for security vulnerabilities on each pushed container image and exposes detailed findings for each image (powered by Qualys). Resolving the vulnerabilities can greatly improve your containers' security posture and protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerRegistryVulnerabilityAssessment_Audit.json,2.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
CMMC L3,Risk Assessment,Remediate vulnerabilities in accordance with risk assessments.,RM.2.143,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,Security Center,Security Center standard pricing tier should be selected,a1181c5f-672a-477a-979a-7d58aa086233,"The standard pricing tier enables threat detection for networks and virtual machines, providing threat intelligence, anomaly detection, and behavior analytics in Azure Security Center","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Standard_pricing_tier.json,1.0.0
CMMC L3,Risk Management,"Periodically perform risk assessments to identify and prioritize risks according to the defined risk categories, risk sources and risk measurement criteria.",RM.3.144,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Network,Flow log should be configured for every network security group,c251913d-7d24-4958-af87-478ed3b9ba41,"Audit for network security groups to verify if flow log resource is configured. Flow log allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions and more.",audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_FlowLog_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Kubernetes,Kubernetes cluster pods should only use approved host network and port range,82985f06-dc18-4a48-bc1c-b9f4f0098cfe,"This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json,2.0.1
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Security Center,Non-internet-facing virtual machines should be protected with network security groups,bb91dfba-c30d-4263-9add-9c2384e659a6,Protect your non-internet-facing virtual machines from potential threats by restricting access with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternalVirtualMachines_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,SQL,Public network access should be disabled for MySQL flexible servers,c9299215-ae47-4f50-9c54-8a392f68a052,Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,SQL,Public network access should be disabled for PostgreSQL flexible servers,5e1de0e3-42cb-4ebc-a86d-61d0c619ca48,Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Network,Web Application Firewall (WAF) should use the specified mode for Application Gateway,12430be1-6cc8-4527-a9a8-e3d38f250096,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Network,Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service,425bea59-a659-4cbb-8d31-34499bd030b8,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Access',3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json,2.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",SC.1.175,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
CMMC L3,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,SC.1.176,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,SC.1.176,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,SC.1.176,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,SC.1.176,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,SC.1.176,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Use encrypted sessions for the management of network devices.,SC.2.179,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Guest Configuration,Audit Windows machines that do not store passwords using reversible encryption,da0f98fe-a24b-4ad5-af69-bd0400233661,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Automation,Automation account variables should be encrypted,3657f5a0-770e-44a3-b44e-9431ba1e9735,It is important to enable encryption of Automation account variable assets when storing sensitive data,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json,1.1.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,API for FHIR,Azure API for FHIR should use a customer-managed key to encrypt data at rest,051cba44-2429-45b9-9649-46cec11c7119,Use a customer-managed key to control the encryption at rest of the data stored in Azure API for FHIR when this is a regulatory or compliance requirement. Customer-managed keys also deliver double encryption by adding a second layer of encryption on top of the default one done with service-managed keys.,"audit, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_EnableByok_Audit.json,1.0.1
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Data Box,Azure Data Box jobs should enable double encryption for data at rest on the device,c349d81b-9985-44ae-a8da-ff98d108ede8,Enable a second layer of software-based encryption for data at rest on the device. The device is already protected via Advanced Encryption Standard 256-bit encryption for data at rest. This option adds a second layer of data encryption.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Box/DataBox_DoubleEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Azure Data Explorer,Azure Data Explorer encryption at rest should use a customer-managed key,81e74cea-30fd-40d5-802f-d72103c2aaaa,Enabling encryption at rest using a customer-managed key on your Azure Data Explorer cluster provides additional control over the key being used by the encryption at rest. This feature is oftentimes applicable to customers with special compliance requirements and requires a Key Vault to managing the keys.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_CMK.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Stream Analytics,Azure Stream Analytics jobs should use customer-managed keys to encrypt data,87ba29ef-1ab3-4d82-b763-87fcd4f531f7,Use customer-managed keys when you want to securely store any metadata and private data assets of your Stream Analytics jobs in your storage account. This gives you total control over how your Stream Analytics data is encrypted.,"audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Stream%20Analytics/StreamAnalytics_CMK_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Synapse,Azure Synapse workspaces should use customer-managed keys to encrypt data at rest,f7d52b2d-e161-4dfa-a82b-55e564167385,Use customer-managed keys to control the encryption at rest of the data stored in Azure Synapse workspaces. Customer-managed keys deliver double encryption by adding a second layer of encryption on top of the default encryption with service-managed keys.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Synapse/SynapseWorkspaceCMK_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Kubernetes,Both operating systems and data disks in Azure Kubernetes Service clusters should be encrypted by customer-managed keys,7d7be79c-23ba-4033-84dd-45e2a5ccdd67,Encrypting OS and data disks using customer-managed keys provides more control and greater flexibility in key management. This is a common requirement in many regulatory and industry compliance standards.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_CMK_Deny.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Key Vault,Certificates using RSA cryptography should have the specified minimum key size,cee51871-e572-4576-855c-047c820360f0,Manage your organizational compliance requirements by specifying a minimum key size for RSA certificates stored in your key vault.,"audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Certificates_RSA_MinimumKeySize.json,2.0.0-preview
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Cognitive Services,Cognitive Services accounts should enable data encryption,2bdd0062-9d75-436e-89df-487dd8e4b3c7,"This policy audits any Cognitive Services account not using data encryption. For each Cognitive Services account with storage, should enable data encryption with either customer managed or Microsoft managed key.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_Encryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Cognitive Services,Cognitive Services accounts should enable data encryption with a customer-managed key,67121cc7-ff39-4ab8-b7e3-95b84dab487d,"Customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more about customer-managed keys at https://go.microsoft.com/fwlink/?linkid=2121321 .","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_CustomerManagedKey_Audit.json,1.0.3
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Container Registry,Container registries should be encrypted with a customer-managed key,5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580,"Use customer-managed keys to manage the encryption at rest of the contents of your registries. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/acr/CMK .","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_CMKEncryptionEnabled_Audit.json,1.1.2
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Azure Data Explorer,Disk encryption should be enabled on Azure Data Explorer,f4b53539-8df9-40e4-86c6-6b607703bd4e,Enabling disk encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_disk_encrypted.json,2.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Azure Data Explorer,Double encryption should be enabled on Azure Data Explorer,ec068d99-e9c7-401f-8cef-5bdde4e6ccf1,"Enabling double encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. When double encryption has been enabled, data in the storage account is encrypted twice, once at the service level and once at the infrastructure level, using two different encryption algorithms and two different keys.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_doubleEncryption.json,2.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,SQL,Infrastructure encryption should be enabled for Azure Database for MySQL servers,3a58212a-c829-4f13-9872-6371df2fd0b4,"Enable infrastructure encryption for Azure Database for MySQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_InfrastructureEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,SQL,Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers,24fba194-95d6-48c0-aea7-f65bf859c598,"Enable infrastructure encryption for Azure Database for PostgreSQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_InfrastructureEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Key Vault,Keys should be the specified cryptographic type RSA or EC,75c4f823-d65c-4f29-a733-01d0077fdbcb,"Some applications require the use of keys backed by a specific cryptographic type. Enforce a particular cryptographic key type, RSA or EC, in your environment.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_AllowedKeyTypes.json,1.0.0-preview
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Key Vault,Keys using elliptic curve cryptography should have the specified curve names,ff25f3c8-b739-4538-9d07-3d6d25cfb255,Keys backed by elliptic curve cryptography can have different curve names. Some applications are only compatible with specific elliptic curve keys. Enforce the types of elliptic curve keys that are allowed to be created in your environment.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_EC_AllowedCurveNames.json,1.0.0-preview
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Key Vault,Keys using RSA cryptography should have a specified minimum key size,82067dbb-e53b-4e06-b631-546d197452d9,Set the minimum allowed key size for use with your key vaults. Use of RSA keys with small key sizes is not a secure practice and doesn't meet many industry certification requirements.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_RSA_MinimumKeySize.json,1.0.0-preview
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Data Lake,Require encryption on Data Lake Store accounts,a7ff3161-0087-490a-9ad9-ad6217f4f43a,This policy ensures encryption is enabled on all Data Lake Store accounts,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStoreEncryption_Deny.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Service Fabric,Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign,617c02be-7f02-4efd-8836-3180d47b6c68,"Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json,1.1.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,SQL,SQL managed instances should use customer-managed keys to encrypt data at rest,048248b0-55cd-46da-b1ff-39efd52db260,"Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,1.0.2
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,SQL,SQL servers should use customer-managed keys to encrypt data at rest,0d134df8-db83-46fb-ad72-fe0c9428c8dd,"Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,2.0.1
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Storage,Storage accounts should have infrastructure encryption,4733ea7b-a883-42fe-8cac-97454c2a9e4a,"Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Storage,Storage accounts should use customer-managed key for encryption,6fac406b-40ca-413b-bf8e-0bf964659c25,"Secure your storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json,1.0.2
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.,SC.3.177,Compute,Unattached disks should be encrypted,2c89a2e5-7285-40fe-afe0-ae8654b92fb2,This policy audits any unattached disk without encryption enabled.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/UnattachedDisk_Encryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.",SC.3.180,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Separate user functionality from system management functionality.,SC.3.181,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Separate user functionality from system management functionality.,SC.3.181,SQL,An Azure Active Directory administrator should be provisioned for SQL servers,1f314764-cb73-4fc9-b863-8eca98ac36e9,Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Separate user functionality from system management functionality.,SC.3.181,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
CMMC L3,System and Communications Protection,Separate user functionality from system management functionality.,SC.3.181,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Separate user functionality from system management functionality.,SC.3.181,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Separate user functionality from system management functionality.,SC.3.181,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Cognitive Services,Cognitive Services accounts should restrict network access,037eea7a-bd0a-46c5-9a66-03aea78705d3,"Network access to Cognitive Services accounts should be restricted. Configure network rules so only applications from allowed networks can access the Cognitive Services account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_NetworkAcls_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Container Registry,Container registries should not allow unrestricted network access,d0793b48-0edc-4296-a390-4c75d1bdfd71,"Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources. Learn more about Container Registry network rules here: https://aka.ms/acr/portal/public-network and here https://aka.ms/acr/vnet .","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_NetworkRulesExist_Audit.json,1.0.1
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,API for FHIR,CORS should not allow every domain to access your API for FHIR,0fea8f8a-4169-495d-8307-30ec335f387d,"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API for FHIR. To protect your API for FHIR, remove access for all domains and explicitly define the domains allowed to connect.","audit, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/API%20for%20FHIR/HealthcareAPIs_RestrictCORSAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,Flow log should be configured for every network security group,c251913d-7d24-4958-af87-478ed3b9ba41,"Audit for network security groups to verify if flow log resource is configured. Flow log allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions and more.",audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_FlowLog_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Kubernetes,Kubernetes cluster pods should only use approved host network and port range,82985f06-dc18-4a48-bc1c-b9f4f0098cfe,"This policy controls pod access to the host network and the allowable host port range in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc .","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/HostNetworkPorts.json,2.0.1
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Security Center,Non-internet-facing virtual machines should be protected with network security groups,bb91dfba-c30d-4263-9add-9c2384e659a6,Protect your non-internet-facing virtual machines from potential threats by restricting access with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternalVirtualMachines_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,SQL,Public network access on Azure SQL Database should be disabled,1b8ca024-1d5c-4dec-8995-b1a932b41780,Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_PublicNetworkAccess_Audit.json,1.1.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Cognitive Services,Public network access should be disabled for Cognitive Services accounts,0725b4dd-7e76-479c-a735-68e7ee23d5ca,This policy audits any Cognitive Services account in your environment with public network access enabled. Public network access should be disabled so that only connections from private endpoints are allowed.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,SQL,Public network access should be disabled for MariaDB servers,fdccbe47-f3e3-4213-ad5d-ea459b2fa077,"Disable the public network access property to improve security and ensure your Azure Database for MariaDB can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MariaDB_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,SQL,Public network access should be disabled for MySQL flexible servers,c9299215-ae47-4f50-9c54-8a392f68a052,Disabling the public network access property improves security by ensuring your Azure Database for MySQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,SQL,Public network access should be disabled for MySQL servers,d9844e8a-1437-4aeb-a32c-0c992f056095,"Disable the public network access property to improve security and ensure your Azure Database for MySQL can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,SQL,Public network access should be disabled for PostgreSQL flexible servers,5e1de0e3-42cb-4ebc-a86d-61d0c619ca48,Disabling the public network access property improves security by ensuring your Azure Database for PostgreSQL flexible servers can only be accessed from a private endpoint. This configuration strictly disables access from any public address space outside of Azure IP range and denies all logins that match IP or virtual network-based firewall rules.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_FlexibleServers_DisablePublicNetworkAccess_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,SQL,Public network access should be disabled for PostgreSQL servers,b52376f7-9612-48a1-81cd-1ffe4b61032c,"Disable the public network access property to improve security and ensure your Azure Database for PostgreSQL can only be accessed from a private endpoint. This configuration disables access from any public address space outside of Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_DisablePublicNetworkAccess_Audit.json,1.0.2
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Storage,Storage accounts should allow access from trusted Microsoft services,c9d007d0-c057-4772-b18c-01e546713bcd,"Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules. These services will then use strong authentication to access the storage account.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccess_TrustedMicrosoftServices_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,Web Application Firewall (WAF) should use the specified mode for Application Gateway,12430be1-6cc8-4527-a9a8-e3d38f250096,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Network,Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service,425bea59-a659-4cbb-8d31-34499bd030b8,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json,1.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Access',3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json,2.0.0
CMMC L3,System and Communications Protection,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",SC.3.183,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,SC.3.185,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Firewall should be enabled on Key Vault,55615ac9-af46-4a59-874e-391cc3dfb490,Key vault's firewall prevents unauthorized traffic from reaching your key vault and provides an additional layer of protection for your secrets. Enable the firewall to make sure that only traffic from allowed networks can access your key vault.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVaultFirewallEnabled_Audit.json,1.0.2-preview
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Key Vault keys should have an expiration date,152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0,Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. It is a recommended security practice to set expiration dates on cryptographic keys.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_ExpirationSet.json,1.0.1-preview
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Key vaults should have purge protection enabled,0b60c0b2-2dc2-4e1c-b5c9-abbed971de53,Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_Recoverable_Audit.json,1.1.1
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Key vaults should have soft delete enabled,1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d,"Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of a key vault can lead to permanent data loss. Soft delete allows you to recover an accidentally deleted key vault for a configurable retention period.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_SoftDeleteMustBeEnabled_Audit.json,1.0.2
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Keys should be the specified cryptographic type RSA or EC,75c4f823-d65c-4f29-a733-01d0077fdbcb,"Some applications require the use of keys backed by a specific cryptographic type. Enforce a particular cryptographic key type, RSA or EC, in your environment.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_AllowedKeyTypes.json,1.0.0-preview
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Keys using elliptic curve cryptography should have the specified curve names,ff25f3c8-b739-4538-9d07-3d6d25cfb255,Keys backed by elliptic curve cryptography can have different curve names. Some applications are only compatible with specific elliptic curve keys. Enforce the types of elliptic curve keys that are allowed to be created in your environment.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_EC_AllowedCurveNames.json,1.0.0-preview
CMMC L3,System and Communications Protection,Establish and manage cryptographic keys for cryptography employed in organizational systems.,SC.3.187,Key Vault,Keys using RSA cryptography should have a specified minimum key size,82067dbb-e53b-4e06-b631-546d197452d9,Set the minimum allowed key size for use with your key vaults. Use of RSA keys with small key sizes is not a secure practice and doesn't meet many industry certification requirements.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Keys_RSA_MinimumKeySize.json,1.0.0-preview
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,Key Vault,Certificates using RSA cryptography should have the specified minimum key size,cee51871-e572-4576-855c-047c820360f0,Manage your organizational compliance requirements by specifying a minimum key size for RSA certificates stored in your key vault.,"audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Certificates_RSA_MinimumKeySize.json,2.0.0-preview
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the authenticity of communications sessions.,SC.3.190,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Automation,Automation account variables should be encrypted,3657f5a0-770e-44a3-b44e-9431ba1e9735,It is important to enable encryption of Automation account variable assets when storing sensitive data,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json,1.1.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Data Box,Azure Data Box jobs should enable double encryption for data at rest on the device,c349d81b-9985-44ae-a8da-ff98d108ede8,Enable a second layer of software-based encryption for data at rest on the device. The device is already protected via Advanced Encryption Standard 256-bit encryption for data at rest. This option adds a second layer of data encryption.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Box/DataBox_DoubleEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Cognitive Services,Cognitive Services accounts should enable data encryption,2bdd0062-9d75-436e-89df-487dd8e4b3c7,"This policy audits any Cognitive Services account not using data encryption. For each Cognitive Services account with storage, should enable data encryption with either customer managed or Microsoft managed key.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_Encryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Azure Data Explorer,Disk encryption should be enabled on Azure Data Explorer,f4b53539-8df9-40e4-86c6-6b607703bd4e,Enabling disk encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_disk_encrypted.json,2.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Azure Data Explorer,Double encryption should be enabled on Azure Data Explorer,ec068d99-e9c7-401f-8cef-5bdde4e6ccf1,"Enabling double encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. When double encryption has been enabled, data in the storage account is encrypted twice, once at the service level and once at the infrastructure level, using two different encryption algorithms and two different keys.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Data%20Explorer/ADX_doubleEncryption.json,2.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,SQL,Infrastructure encryption should be enabled for Azure Database for MySQL servers,3a58212a-c829-4f13-9872-6371df2fd0b4,"Enable infrastructure encryption for Azure Database for MySQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_InfrastructureEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,SQL,Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers,24fba194-95d6-48c0-aea7-f65bf859c598,"Enable infrastructure encryption for Azure Database for PostgreSQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_InfrastructureEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Data Lake,Require encryption on Data Lake Store accounts,a7ff3161-0087-490a-9ad9-ad6217f4f43a,This policy ensures encryption is enabled on all Data Lake Store accounts,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStoreEncryption_Deny.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Service Fabric,Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign,617c02be-7f02-4efd-8836-3180d47b6c68,"Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json,1.1.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Storage,Storage accounts should have infrastructure encryption,4733ea7b-a883-42fe-8cac-97454c2a9e4a,"Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
CMMC L3,System and Communications Protection,Protect the confidentiality of CUI at rest.,SC.3.191,Compute,Unattached disks should be encrypted,2c89a2e5-7285-40fe-afe0-ae8654b92fb2,This policy audits any unattached disk without encryption enabled.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/UnattachedDisk_Encryption_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the API app",991310cd-e9f3-47bc-b7b6-f57b557d07db,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_HTTP_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the Function app",e2c1c086-2d84-4019-bff3-c44ccd95113c,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_HTTP_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the Web app",8c122334-9d20-4eb8-89ea-ac9a705b74ae,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_HTTP_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'Java version' is the latest, if used as a part of the API app",88999f4c-376a-45c8-bcb3-4058f713cf39,"Periodically, newer versions are released for Java either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_java_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Function app",9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_java_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Web app",496223c3-ad65-4ecd-878a-bae78737e9ed,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_java_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the API app",1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_PHP_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the WEB app",7261b898-8a84-4db8-9e04-18527132abb3,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_PHP_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'Python version' is the latest, if used as a part of the API app",74c3584d-afae-46f7-a20a-6f8adba71a16,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_python_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Function app",7238174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_python_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Web app",7008174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_python_Latest.json,2.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Security Center,Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version,fb893a29-21bb-418c-a157-e99480ec364c,"Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UpgradeVersion_KubernetesService_Audit.json,1.0.2
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Compute,Microsoft Antimalware for Azure should be configured to automatically update protection signatures,c43e4a30-77cb-48ab-a4dd-93f175c63b57,This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_AntiMalwareAutoUpdate_AuditIfNotExists.json,1.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Security Center,System updates on virtual machine scale sets should be installed,c3f317a7-a95c-4547-b7e7-11017ebdf2fe,Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json,3.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
CMMC L3,System and Information Integrity,"Identify, report, and correct information and information system flaws in a timely manner.",SI.1.210,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
CMMC L3,System and Information Integrity,Provide protection from malicious code at appropriate locations within organizational information systems.,SI.1.211,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
CMMC L3,System and Information Integrity,Provide protection from malicious code at appropriate locations within organizational information systems.,SI.1.211,Compute,Microsoft Antimalware for Azure should be configured to automatically update protection signatures,c43e4a30-77cb-48ab-a4dd-93f175c63b57,This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_AntiMalwareAutoUpdate_AuditIfNotExists.json,1.0.0
CMMC L3,System and Information Integrity,Provide protection from malicious code at appropriate locations within organizational information systems.,SI.1.211,Compute,Microsoft IaaSAntimalware extension should be deployed on Windows servers,9b597639-28e4-48eb-b506-56b05d366257,This policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/WindowsServers_AntiMalware_AuditIfNotExists.json,1.0.0
CMMC L3,System and Information Integrity,Provide protection from malicious code at appropriate locations within organizational information systems.,SI.1.211,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
CMMC L3,System and Information Integrity,Update malicious code protection mechanisms when new releases are available.,SI.1.212,Compute,Microsoft Antimalware for Azure should be configured to automatically update protection signatures,c43e4a30-77cb-48ab-a4dd-93f175c63b57,This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_AntiMalwareAutoUpdate_AuditIfNotExists.json,1.0.0
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Compute,Microsoft Antimalware for Azure should be configured to automatically update protection signatures,c43e4a30-77cb-48ab-a4dd-93f175c63b57,This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_AntiMalwareAutoUpdate_AuditIfNotExists.json,1.0.0
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Compute,Microsoft IaaSAntimalware extension should be deployed on Windows servers,9b597639-28e4-48eb-b506-56b05d366257,This policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/WindowsServers_AntiMalware_AuditIfNotExists.json,1.0.0
CMMC L3,System and Information Integrity,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.",SI.1.213,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for App Service should be enabled,2913021d-f2fd-4f3d-b958-22354e2bdbcb,"Azure Defender for App Service leverages the scale of the cloud, and the visibility that Azure has as a cloud provider, to monitor for common web app attacks.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnAppServices_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for Azure SQL Database servers should be enabled,7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServers_Audit.json,1.0.2
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for container registries should be enabled,c25d9a16-bc35-4e15-a7e5-9db606bf9ed4,"Azure Defender for container registries provides vulnerability scanning of any images pulled within the last 30 days, pushed to your registry, or imported, and exposes detailed findings per image.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnContainerRegistry_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for Key Vault should be enabled,0e6763cc-5078-4e64-889d-ff4d9a839047,Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKeyVaults_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for Kubernetes should be enabled,523b5cd1-3e23-492f-a539-13118b6d1e3a,Azure Defender for Kubernetes provides real-time threat protection for containerized environments and generates alerts for suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnKubernetesService_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for servers should be enabled,4da35fc9-c9e7-4960-aec9-797fe7d9051d,Azure Defender for servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnVM_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for SQL servers on machines should be enabled,6581d072-105e-4418-827f-bd446d56421b,"Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedDataSecurityOnSqlServerVirtualMachines_Audit.json,1.0.2
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Azure Defender for Storage should be enabled,308fbb08-4ab8-4e67-9b29-592e93fb94fa,Azure Defender for Storage provides detections of unusual and potentially harmful attempts to access or exploit storage accounts.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableAdvancedThreatProtectionOnStorageAccounts_Audit.json,1.0.3
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Monitoring,Azure subscriptions should have a log profile for Activity Log,7796937f-307b-4598-941c-67d3a05ebfe7,This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Email notification to subscription owner for high severity alerts should be enabled,0b15565f-aa9e-48ba-8619-45960f2c314d,"To ensure your subscription owners are notified when there is a potential security breach in their subscription, set email notifications to subscription owners for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification_to_subscription_owner.json,2.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,Flow log should be configured for every network security group,c251913d-7d24-4958-af87-478ed3b9ba41,"Audit for network security groups to verify if flow log resource is configured. Flow log allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions and more.",audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroup_FlowLog_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Security Center,Subscriptions should have a contact email address for security issues,4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json,1.0.1
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,Web Application Firewall (WAF) should use the specified mode for Application Gateway,12430be1-6cc8-4527-a9a8-e3d38f250096,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json,1.0.0
CMMC L3,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",SI.2.216,Network,Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service,425bea59-a659-4cbb-8d31-34499bd030b8,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,Activity log should be retained for at least one year,b02aacc0-b073-424e-8298-42b22829ee0a,This policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLogRetention_365orGreater.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,An activity log alert should exist for specific Policy operations,c5447c04-a4d7-4ba8-a263-c9ee321a6858,This policy audits specific Policy operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_PolicyOperations_Audit.json,3.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,An activity log alert should exist for specific Security operations,3b980d31-7904-4bb7-8575-5665739a8052,This policy audits specific Security operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_SecurityOperations_Audit.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,"Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'",1a4e592a-6a6e-44a5-9814-e36264ca96e7,"This policy ensures that a log profile collects logs for categories 'write,' 'delete,' and 'action'","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllCategories.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Monitoring,Azure subscriptions should have a log profile for Activity Log,7796937f-307b-4598-941c-67d3a05ebfe7,This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json,1.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Security Center,Email notification to subscription owner for high severity alerts should be enabled,0b15565f-aa9e-48ba-8619-45960f2c314d,"To ensure your subscription owners are notified when there is a potential security breach in their subscription, set email notifications to subscription owners for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification_to_subscription_owner.json,2.0.0
CMMC L3,System and Information Integrity,Identify unauthorized use of organizational systems.,SI.2.217,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
HIPAA HITRUST 9.2,Privilege Management,Access to management functions or administrative consoles for systems hosting virtualized systems are restricted to personnel based upon the principle of least privilege and supported through technical controls.,ID : 11180.01c3System.6 - 01.c,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,"Privileges are formally authorized and controlled, allocated to users on a need-to-use and event-by-event basis for their functional role (e.g., user or administrator), and documented for each system product/element.",ID : 1143.01c1System.123 - 01.c,Security Center,Management ports should be closed on your virtual machines,22730e10-96f6-4aac-ad84-9383d35b5917,Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OpenManagementPortsOnVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,"The organization explicitly authorizes access to specific security relevant functions (deployed in hardware, software, and firmware) and security-relevant information.",ID : 1144.01c1System.4 - 01.c,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,"Role-based access control is implemented and capable of mapping each user to one or more roles, and each role to one or more system functions.",ID : 1145.01c2System.1 - 01.c,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,The organization promotes the development and use of programs that avoid the need to run with elevated privileges and system routines to avoid the need to grant privileges to users.,ID : 1146.01c2System.23 - 01.c,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,"Elevated privileges are assigned to a different user ID from those used for normal business use, all users access privileged services in a single role, and such privileged access is minimized.",ID : 1147.01c2System.456 - 01.c,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,The organization restricts access to privileged functions and all security-relevant information.,ID : 1148.01c2System.78 - 01.c,General,Audit usage of custom RBAC rules,a451c1ef-c6ca-483d-87ed-f49761e3ffb5,"Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json,1.0.0
HIPAA HITRUST 9.2,Privilege Management,The organization restricts access to privileged functions and all security-relevant information.,ID : 1148.01c2System.78 - 01.c,Guest Configuration,Windows machines should meet requirements for 'Security Options - Accounts',ee984370-154a-4ee8-9726-19d900e56fc0,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Accounts' for limiting local account use of blank passwords and guest account status. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsAccounts_AINE.json,2.0.0
HIPAA HITRUST 9.2,Privilege Management,The organization facilitates information sharing by enabling authorized users to determine a business partner's access when discretion is allowed as defined by the organization and by employing manual processes or automated mechanisms to assist users in making information sharing/collaboration decisions.,ID : 1149.01c2System.9 - 01.c,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
HIPAA HITRUST 9.2,Privilege Management,"The access control system for the system components storing, processing or transmitting covered information is set with a default ""deny-all"" setting.",ID : 1150.01c2System.10 - 01.c,Security Center,Management ports should be closed on your virtual machines,22730e10-96f6-4aac-ad84-9383d35b5917,Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OpenManagementPortsOnVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,The organization limits authorization to privileged accounts on information systems to a pre-defined subset of users.,ID : 1151.01c3System.1 - 01.c,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,The organization audits the execution of privileged functions on information systems and ensures information systems prevent non-privileged users from executing privileged functions.,ID : 1152.01c3System.2 - 01.c,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
HIPAA HITRUST 9.2,Privilege Management,"All file system access not explicitly required is disabled, and only authorized users are permitted access to only that which is expressly required for the performance of the users' job duties.",ID : 1153.01c3System.35 - 01.c,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
HIPAA HITRUST 9.2,Privilege Management,Contractors are provided with minimal system and physical access only after the organization assesses the contractor's ability to comply with its security requirements and the contractor agrees to comply.,ID : 1154.01c3System.4 - 01.c,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"Strong authentication methods such as multi-factor, Radius or Kerberos (for privileged access) and CHAP (for encryption of credentials for dialup methods) are implemented for all external connections to the organizations network.",ID : 1116.01j1Organizational.145 - 01.j,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"Remote access by vendors and business partners (e.g., for remote maintenance) is disabled/deactivated when not in use.",ID : 1117.01j1Organizational.23 - 01.j,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"Organizations implement encryption (e.g.  VPN solutions or private lines) and logs remote access to the organization's network by employees, contractors or third party (e.g., vendors).",ID : 1118.01j2Organizational.124 - 01.j,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,Network equipment is checked for unanticipated dial-up capabilities.,ID : 1119.01j2Organizational.3 - 01.j,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"Remote administration sessions are authorized, encrypted, and employ increased security measures.",ID : 1121.01j3Organizational.2 - 01.j,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"If encryption is not used for dial-up connections, the CIO or his/her designated representative provides specific written authorization.",ID : 1173.01j1Organizational.6 - 01.j,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,The organization protects wireless access to systems containing sensitive information by authenticating both users and devices.,ID : 1174.01j1Organizational.7 - 01.j,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,Remote access to business information across public networks only takes place after successful identification and authentication.,ID : 1175.01j1Organizational.8 - 01.j,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,The organization requires a callback capability with re-authentication to verify dial-up connections from authorized locations.,ID : 1176.01j2Organizational.5 - 01.j,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"User IDs assigned to vendors are reviewed in accordance with the organization's access review policy, at a minimum annually.",ID : 1177.01j2Organizational.6 - 01.j,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,"Node authentication, including cryptographic techniques (e.g., machine certificates), serves as an alternative means of authenticating groups of remote users where they are connected to a secure, shared computer facility.",ID : 1178.01j2Organizational.7 - 01.j,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Authentication for External Connections,The information system monitors and controls remote access methods.,ID : 1179.01j3Organizational.1 - 01.j,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
HIPAA HITRUST 9.2,Remote Diagnostic and Configuration Port Protection,Access to network equipment is physically protected.,ID : 1192.01l1Organizational.1 - 01.l,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
HIPAA HITRUST 9.2,Remote Diagnostic and Configuration Port Protection,Controls for the access to diagnostic and configuration ports include the use of a key lock and the implementation of supporting procedures to control physical access to the port.,ID : 1193.01l2Organizational.13 - 01.l,Security Center,Management ports should be closed on your virtual machines,22730e10-96f6-4aac-ad84-9383d35b5917,Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OpenManagementPortsOnVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Remote Diagnostic and Configuration Port Protection,"Ports, services, and similar applications installed on a computer or network systems, which are not specifically required for business functionality, are disabled or removed.",ID : 1194.01l2Organizational.2 - 01.l,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Remote Diagnostic and Configuration Port Protection,"The organization reviews the information system within every three hundred and sixty- five (365) days to identify and disables unnecessary and non-secure functions, ports, protocols, and/or services.",ID : 1195.01l3Organizational.1 - 01.l,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Remote Diagnostic and Configuration Port Protection,"The organization identifies unauthorized (blacklisted) software on the information system, prevents program execution in accordance with a list of unauthorized (blacklisted) software programs, employs an allow-all, deny-by exception policy to prohibit execution of known unauthorized (blacklisted) software, and reviews and updates the list of unauthorized (blacklisted) software programs annually.",ID : 1196.01l3Organizational.24 - 01.l,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Remote Diagnostic and Configuration Port Protection,The organization disables Bluetooth and peer-to-peer networking protocols within the information system determined to be unnecessary or non-secure.,ID : 1197.01l3Organizational.3 - 01.l,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,App Service should use a virtual network service endpoint,2d21331d-a4c2-4def-a9ad-ee4e1e023beb,This policy audits any App Service not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_AppService_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Cosmos DB should use a virtual network service endpoint,e0a2b1a3-f7f9-4569-807f-2a9edebdf4d9,This policy audits any Cosmos DB not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_CosmosDB_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Event Hub should use a virtual network service endpoint,d63edb4a-c612-454d-b47d-191a724fcbf0,This policy audits any Event Hub not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_EventHub_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Gateway subnets should not be configured with a network security group,35f9c03a-cc27-418e-9c0c-539ff999d010,This policy denies if a gateway subnet is configured with a network security group. Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroupOnGatewaySubnet_Deny.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Key Vault should use a virtual network service endpoint,ea4d6841-2173-4317-9747-ff522a45120f,This policy audits any Key Vault not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_KeyVault_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Service Bus should use a virtual network service endpoint,235359c5-7c52-4b82-9055-01c75cf9f60e,This policy audits any Service Bus not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ServiceBus_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,SQL Server should use a virtual network service endpoint,ae5d2f14-d830-42b6-9899-df6cfe9c71a3,This policy audits any SQL Server not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_SQLServer_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Storage Accounts should use a virtual network service endpoint,60d21c4f-21a3-4d94-85f4-b924e6aeeda4,This policy audits any Storage Account not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_StorageAccount_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organization's security gateways (e.g. firewalls) enforce security policies and are configured to filter traffic between domains, block unauthorized access, and are used to maintain segregation between internal wired, internal wireless, and external network segments (e.g., the Internet) including DMZs and enforce access control policies for each of the domains.",ID : 0805.01m1Organizational.12 - 01.m,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,App Service should use a virtual network service endpoint,2d21331d-a4c2-4def-a9ad-ee4e1e023beb,This policy audits any App Service not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_AppService_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Cosmos DB should use a virtual network service endpoint,e0a2b1a3-f7f9-4569-807f-2a9edebdf4d9,This policy audits any Cosmos DB not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_CosmosDB_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Event Hub should use a virtual network service endpoint,d63edb4a-c612-454d-b47d-191a724fcbf0,This policy audits any Event Hub not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_EventHub_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Gateway subnets should not be configured with a network security group,35f9c03a-cc27-418e-9c0c-539ff999d010,This policy denies if a gateway subnet is configured with a network security group. Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroupOnGatewaySubnet_Deny.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Key Vault should use a virtual network service endpoint,ea4d6841-2173-4317-9747-ff522a45120f,This policy audits any Key Vault not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_KeyVault_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Service Bus should use a virtual network service endpoint,235359c5-7c52-4b82-9055-01c75cf9f60e,This policy audits any Service Bus not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ServiceBus_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,SQL Server should use a virtual network service endpoint,ae5d2f14-d830-42b6-9899-df6cfe9c71a3,This policy audits any SQL Server not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_SQLServer_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Storage Accounts should use a virtual network service endpoint,60d21c4f-21a3-4d94-85f4-b924e6aeeda4,This policy audits any Storage Account not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_StorageAccount_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"The organizations network is logically and physically segmented with a defined security perimeter and a graduated set of controls, including subnetworks for publicly accessible system components that are logically separated from the internal network, based on organizational requirements; and traffic is controlled based on functionality required and classification of the data/systems based on a risk assessment and their respective security requirements.",ID : 0806.01m2Organizational.12356 - 01.m,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,App Service should use a virtual network service endpoint,2d21331d-a4c2-4def-a9ad-ee4e1e023beb,This policy audits any App Service not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_AppService_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Cosmos DB should use a virtual network service endpoint,e0a2b1a3-f7f9-4569-807f-2a9edebdf4d9,This policy audits any Cosmos DB not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_CosmosDB_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Deploy network watcher when virtual networks are created,a9b99dd8-06c5-4317-8629-9d86a3c6e7d9,"This policy creates a network watcher resource in regions with virtual networks. You need to ensure existence of a resource group named networkWatcherRG, which will be used to deploy network watcher instances.",DeployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Deploy.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Event Hub should use a virtual network service endpoint,d63edb4a-c612-454d-b47d-191a724fcbf0,This policy audits any Event Hub not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_EventHub_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Gateway subnets should not be configured with a network security group,35f9c03a-cc27-418e-9c0c-539ff999d010,This policy denies if a gateway subnet is configured with a network security group. Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkSecurityGroupOnGatewaySubnet_Deny.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Key Vault should use a virtual network service endpoint,ea4d6841-2173-4317-9747-ff522a45120f,This policy audits any Key Vault not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_KeyVault_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Service Bus should use a virtual network service endpoint,235359c5-7c52-4b82-9055-01c75cf9f60e,This policy audits any Service Bus not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ServiceBus_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,SQL Server should use a virtual network service endpoint,ae5d2f14-d830-42b6-9899-df6cfe9c71a3,This policy audits any SQL Server not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_SQLServer_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Storage Accounts should use a virtual network service endpoint,60d21c4f-21a3-4d94-85f4-b924e6aeeda4,This policy audits any Storage Account not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_StorageAccount_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Segregation in Networks,"Networks are segregated from production-level networks when migrating physical servers, applications or data to virtualized servers.",ID : 0894.01m2Organizational.7 - 01.m,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Network traffic is controlled in accordance with the organizations access control policy through firewall and other network-related restrictions for each network access point or external telecommunication service's managed interface.,ID : 0809.01n2Organizational.1234 - 01.n,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Transmitted information is secured and, at a minimum, encrypted over open, public networks.",ID : 0810.01n2Organizational.5 - 01.n,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,"Exceptions to the traffic flow policy are documented with a supporting mission/business need, duration of the exception, and reviewed at least annually; traffic flow policy exceptions are removed when no longer supported by an explicit mission/business need.",ID : 0811.01n2Organizational.6 - 01.n,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,Remote devices establishing a non-remote connection are not allowed to communicate with external (remote) resources.,ID : 0812.01n2Organizational.8 - 01.n,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,Security Center,Subnets should be associated with a Network Security Group,e71308d3-144b-4262-b144-efdc3cc90517,Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,Network,Virtual machines should be connected to an approved virtual network,d416745a-506c-48b6-8ab1-83cb814bcaa3,This policy audits any virtual machine connected to a virtual network that is not approved.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Connection Control,The ability of users to connect to the internal network is restricted using a deny-by-default and allow-by-exception policy at managed interfaces according to the access control policy and the requirements of clinical and business applications.,ID : 0814.01n1Organizational.12 - 01.n,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,The organization ensures that redundant user IDs are not issued to other users and that all users are uniquely identified and authenticated for both local and remote access to information systems.,ID : 11109.01q1Organizational.57 - 01.q,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"Non-organizational users (all information system users other than organizational users, such as patients, customers, contractors, or foreign nationals), or processes acting on behalf of non-organizational users, determined to need access to information residing on the organization's information systems, are uniquely identified and authenticated.",ID : 11110.01q1Organizational.6 - 01.q,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"When PKI-based authentication is used, the information system validates certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; enforces access to the corresponding private key; maps the identity to the corresponding account of the individual or group; and implements a local cache of revocation data to support path discovery and validation in case of an inability to access revocation information via the network.",ID : 11111.01q2System.4 - 01.q,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"The information system employs replay-resistant authentication mechanisms such as nonce, one-time passwords, or time stamps to secure network access for privileged accounts; and, for hardware token-based authentication, employs mechanisms that satisfy minimum token requirements discussed in NIST SP 800-63-2, Electronic Authentication Guideline.",ID : 11112.01q2Organizational.67 - 01.q,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"The organization requires that electronic signatures, unique to one individual, cannot be reused by, or reassigned to, anyone else.",ID : 11208.01q1Organizational.8 - 01.q,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records.,ID : 11210.01q2Organizational.10 - 01.q,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,Signed electronic records shall contain information associated with the signing in human-readable format.,ID : 11211.01q2Organizational.11 - 01.q,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"Users who performed privileged functions (e.g., system administration) use separate accounts when performing those privileged functions.",ID : 1123.01q1System.2 - 01.q,Guest Configuration,Audit Windows machines that have extra accounts in the Administrators group,3d2a3320-2a72-4c67-ac5f-caa40fbee2b2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains members that are not listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembers_AINE.json,1.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"Multi-factor authentication methods are used in accordance with organizational policy, (e.g., for remote network access).",ID : 1125.01q2System.1 - 01.q,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
HIPAA HITRUST 9.2,User Identification and Authentication,"Where tokens are provided for multi-factor authentication, in-person verification is required prior to granting access.",ID : 1127.01q2System.3 - 01.q,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,"Access to the organizations information and systems by external parties is not permitted until due diligence has been conducted, the appropriate controls have been implemented, and a contract/agreement reflecting the security requirements is signed acknowledging they understand and accept their obligations.",ID : 1401.05i1Organizational.1239 - 05.i,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,Remote access connections between the organization and external parties are encrypted.,ID : 1402.05i1Organizational.45 - 05.i,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,Access granted to external parties is limited to the minimum necessary and granted only for the duration required.,ID : 1403.05i1Organizational.67 - 05.i,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,"Due diligence of the external party includes interviews, document review, checklists, certification reviews (e.g. HITRUST) or other remote means.",ID : 1404.05i2Organizational.1 - 05.i,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,The identification of risks related to external party access takes into account a minimal set of specifically defined issues.,ID : 1418.05i1Organizational.8 - 05.i,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,"The organization obtains satisfactory assurances that reasonable information security exists across their information supply chain by performing an annual review, which includes all partners/third party-providers upon which their information supply chain depends.",ID : 1450.05i2Organizational.2 - 05.i,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Identification of Risks Related to External Parties,"Cloud service providers design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain.",ID : 1451.05iCSPOrganizational.2 - 05.i,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,Audit Logging,"A secure audit record is created for all activities on the system (create, read, update, delete) involving covered information.",ID : 1202.09aa1System.1 - 09.aa,Data Lake,Resource logs in Azure Data Lake Store should be enabled,057ef27e-665e-4328-8ea3-04b3122bd9fb,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStore_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,"A secure audit record is created for all activities on the system (create, read, update, delete) involving covered information.",ID : 1202.09aa1System.1 - 09.aa,Security Center,System updates on virtual machine scale sets should be installed,c3f317a7-a95c-4547-b7e7-11017ebdf2fe,Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json,3.0.0
HIPAA HITRUST 9.2,Audit Logging,"Audit records include the unique user ID, unique data subject ID, function performed, and date/time the event was performed.",ID : 1203.09aa1System.2 - 09.aa,Logic Apps,Resource logs in Logic Apps should be enabled,34f95f76-5386-4de7-b824-0d8478470c9d,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Logic%20Apps/LogicApps_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,"The activities of privileged users (administrators, operators, etc.) include the success/failure of the event, time the event occurred, the account involved, the processes involved, and additional information about the event.",ID : 1204.09aa1System.3 - 09.aa,Internet of Things,Resource logs in IoT Hub should be enabled,383856f8-de7f-44a2-81fc-e5135b5c2aa4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Internet%20of%20Things/IoTHub_AuditDiagnosticLog_Audit.json,3.0.1
HIPAA HITRUST 9.2,Audit Logging,"Logs of messages sent and received are maintained including the date, time, origin and destination of the message, but not its contents.",ID : 1205.09aa2System.1 - 09.aa,Batch,Resource logs in Batch accounts should be enabled,428256e6-1fac-4f48-a757-df34c2b3336d,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Batch/Batch_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,"Auditing is always available while the system is active and tracks key events, success/failed data access, system security configuration changes, privileged or utility use, any alarms raised,  activation and de-activation of protection systems (e.g., A/V and IDS), activation and deactivation of identification and authentication mechanisms, and creation and deletion of system-level objects.",ID : 1206.09aa2System.23 - 09.aa,Compute,Resource logs in Virtual Machine Scale Sets should be enabled,7c1b1214-f927-48bf-8882-84f0af6588b1,It is recommended to enable Logs so that activity trail can be recreated when investigations are required in the event of an incident or a compromise.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ServiceFabric_and_VMSS_AuditVMSSDiagnostics.json,2.0.1
HIPAA HITRUST 9.2,Audit Logging,Audit records are retained for 90 days and older audit records are archived for one year.,ID : 1207.09aa2System.4 - 09.aa,Stream Analytics,Resource logs in Azure Stream Analytics should be enabled,f9be5368-9bf5-4b84-9e0a-7850da98bb46,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Stream%20Analytics/StreamAnalytics_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,Audit records are retained for 90 days and older audit records are archived for one year.,ID : 1207.09aa2System.4 - 09.aa,Event Hub,Resource logs in Event Hub should be enabled,83a214f7-d01a-484b-91a9-ed54470c9a6a,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Event%20Hub/EventHub_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,"Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes.",ID : 1208.09aa3System.1 - 09.aa,Search,Resource logs in Search services should be enabled,b4330a05-a843-4bc8-bf9a-cacce50c67f4,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Search/Search_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,"Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes.",ID : 1208.09aa3System.1 - 09.aa,Service Bus,Resource logs in Service Bus should be enabled,f8d36e2f-389b-4ee4-898d-21aeb69a0f45,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Bus/ServiceBus_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,The information system generates audit records containing the following detailed information: (i) filename accessed; (ii) program or command used to initiate the event; and (iii) source and destination addresses.,ID : 1209.09aa3System.2 - 09.aa,App Service,Diagnostic logs in App Services should be enabled,b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0,Audit enabling of diagnostic logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_AuditLoggingMonitoring_Audit.json,2.0.0
HIPAA HITRUST 9.2,Audit Logging,"All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender.",ID : 1210.09aa3System.3 - 09.aa,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
HIPAA HITRUST 9.2,Audit Logging,"All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender.",ID : 1210.09aa3System.3 - 09.aa,Data Lake,Resource logs in Data Lake Analytics should be enabled,c95c74d9-38fe-4f0d-af86-0c7d626a315c,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeAnalytics_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Audit Logging,The organization verifies every ninety (90) days for each extract of covered information recorded that the data is erased or its use is still required.,ID : 1211.09aa3System.4 - 09.aa,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
HIPAA HITRUST 9.2,Audit Logging,The organization verifies every ninety (90) days for each extract of covered information recorded that the data is erased or its use is still required.,ID : 1211.09aa3System.4 - 09.aa,Key Vault,Resource logs in Azure Key Vault Managed HSM should be enabled,a2a5b911-5617-447e-a49e-59dbe0e0434b,"To recreate activity trails for investigation purposes when a security incident occurs or when your network is compromised, you may want to audit by enabling resource logs on Managed HSMs. Please follow the instructions here: https://docs.microsoft.com/azure/key-vault/managed-hsm/logging .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/ManagedHsm_AuditDiagnosticLog_Audit.json,1.0.0
HIPAA HITRUST 9.2,Audit Logging,The organization verifies every ninety (90) days for each extract of covered information recorded that the data is erased or its use is still required.,ID : 1211.09aa3System.4 - 09.aa,Key Vault,Resource logs in Key Vault should be enabled,cf820ca0-f99e-4f3e-84fb-66e913812d21,Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes when a security incident occurs or when your network is compromised,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_AuditDiagnosticLog_Audit.json,4.0.1
HIPAA HITRUST 9.2,Monitoring System Use,"Unauthorized remote connections to the information systems are monitored and reviewed at least quarterly, and appropriate action is taken if an unauthorized connection is discovered.",ID : 1120.09ab3System.9 - 09.ab,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,"The organization monitors the information system to identify irregularities or anomalies that are indicators of a system malfunction or compromise and help confirm the system is functioning in an optimal, resilient and secure state.",ID : 12100.09ab2System.15 - 09.ab,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,"The organization specifies how often audit logs are reviewed, how the reviews are documented, and the specific roles and responsibilities of the personnel conducting the reviews, including the professional certifications or other qualifications required.",ID : 12101.09ab1Organizational.3 - 09.ab,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,"The organization shall periodically test its monitoring and detection processes, remediate deficiencies, and improve its processes.",ID : 12102.09ab1Organizational.4 - 09.ab,Guest Configuration,Audit Windows machines on which the Log Analytics agent is not connected as expected,6265018c-d7e2-432f-a75d-094d5f6f4465,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the agent is not installed, or if it is installed but the COM object AgentConfigManager.MgmtSvcCfg returns that it is registered to a workspace other than the ID specified in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsLogAnalyticsAgentConnection_AINE.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,All applicable legal requirements related to monitoring authorized access and unauthorized access attempts are met.,ID : 1212.09ab1System.1 - 09.ab,Monitoring,"Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'",1a4e592a-6a6e-44a5-9814-e36264ca96e7,"This policy ensures that a log profile collects logs for categories 'write,' 'delete,' and 'action'","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllCategories.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,"Automated systems deployed throughout the organization's environment are used to monitor key events and anomalous activity, and analyze system logs, the results of which are reviewed regularly.",ID : 1213.09ab2System.128 - 09.ab,Security Center,Auto provisioning of the Log Analytics agent should be enabled on your subscription,475aae12-b88a-4572-8b36-9b712b2b3a17,"To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Automatic_provisioning_log_analytics_monitoring_agent.json,1.0.1
HIPAA HITRUST 9.2,Monitoring System Use,"Monitoring includes privileged operations, authorized access or unauthorized access attempts, including attempts to access deactivated accounts, and system alerts or failures.",ID : 1214.09ab2System.3456 - 09.ab,Monitoring,Azure Monitor should collect activity logs from all regions,41388f1c-2db0-4c25-95b2-35d7f5ccbfa9,This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllRegions.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,Auditing and monitoring systems employed by the organization support audit reduction and report generation.,ID : 1215.09ab2System.7 - 09.ab,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,"Automated systems are used to review monitoring activities of security systems (e.g., IPS/IDS) and system records on a daily basis, and identify and document anomalies.",ID : 1216.09ab3System.12 - 09.ab,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,Alerts are generated for technical personnel to analyze and investigate suspicious activity or suspected violations.,ID : 1217.09ab3System.3 - 09.ab,Guest Configuration,Audit Windows machines on which the Log Analytics agent is not connected as expected,6265018c-d7e2-432f-a75d-094d5f6f4465,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the agent is not installed, or if it is installed but the COM object AgentConfigManager.MgmtSvcCfg returns that it is registered to a workspace other than the ID specified in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsLogAnalyticsAgentConnection_AINE.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,The information system is able to automatically process audit records for events of interest based on selectable criteria.,ID : 1219.09ab3System.10 - 09.ab,Monitoring,"Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'",1a4e592a-6a6e-44a5-9814-e36264ca96e7,"This policy ensures that a log profile collects logs for categories 'write,' 'delete,' and 'action'","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_CaptureAllCategories.json,1.0.0
HIPAA HITRUST 9.2,Monitoring System Use,Monitoring includes inbound and outbound communications and file integrity monitoring.,ID : 1220.09ab3System.56 - 09.ab,Security Center,Auto provisioning of the Log Analytics agent should be enabled on your subscription,475aae12-b88a-4572-8b36-9b712b2b3a17,"To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Automatic_provisioning_log_analytics_monitoring_agent.json,1.0.1
HIPAA HITRUST 9.2,Administrator and Operator Logs,The organization ensures proper logging is enabled in order to audit administrator activities; and reviews system administrator and operator logs on a regular basis.,ID : 1270.09ad1System.12 - 09.ad,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
HIPAA HITRUST 9.2,Administrator and Operator Logs,An intrusion detection system managed outside of the control of system and network administrators is used to monitor system and network administration activities for compliance.,ID : 1271.09ad1System.1 - 09.ad,Monitoring,An activity log alert should exist for specific Administrative operations,b954148f-4c11-4c38-8221-be76711e194a,This policy audits specific Administrative operations with no activity log alerts configured.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLog_AdministrativeOperations_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation of Duties,Separation of duties is used to limit the risk of unauthorized or unintentional modification of information and systems.,ID : 1229.09c1Organizational.1 - 09.c,Security Center,Role-Based Access Control (RBAC) should be used on Kubernetes Services,ac4a19c2-fa67-49b4-8ae5-0b2e78c49457,"To provide granular filtering on the actions that users can perform, use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters and configure relevant authorization policies.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableRBAC_KubernetesService_Audit.json,1.0.2
HIPAA HITRUST 9.2,Segregation of Duties,"No single person is able to access, modify, or use information systems without authorization or detection.",ID : 1230.09c2Organizational.1 - 09.c,General,Audit usage of custom RBAC rules,a451c1ef-c6ca-483d-87ed-f49761e3ffb5,"Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json,1.0.0
HIPAA HITRUST 9.2,Segregation of Duties,Access for individuals responsible for administering  access controls is limited to the minimum necessary based upon each user's role and responsibilities and these individuals cannot access audit functions related to these controls.,ID : 1232.09c3Organizational.12 - 09.c,Guest Configuration,Windows machines should meet requirements for 'User Rights Assignment',e068b215-0026-4354-b347-8fb2766f73a2,"Windows machines should have the specified Group Policy settings in the category 'User Rights Assignment' for allowing log on locally, RDP, access from the network, and many other user activities. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_UserRightsAssignment_AINE.json,2.0.0
HIPAA HITRUST 9.2,Segregation of Duties,Security audit activities are independent.,ID : 1276.09c2Organizational.2 - 09.c,General,Custom subscription owner roles should not exist,10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9,This policy ensures that no custom subscription owner roles exist.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/CustomSubscription_OwnerRole_Audit.json,2.0.0
HIPAA HITRUST 9.2,Segregation of Duties,The initiation of an event is separated from its authorization to reduce the possibility of collusion.,ID : 1277.09c2Organizational.4 - 09.c,Guest Configuration,Windows machines should meet requirements for 'Security Options - User Account Control',492a29ed-d143-4f03-b6a4-705ce081b463,"Windows machines should have the specified Group Policy settings in the category 'Security Options - User Account Control' for mode for admins, behavior of elevation prompt, and virtualizing file and registry write failures. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsUserAccountControl_AINE.json,2.0.0
HIPAA HITRUST 9.2,Segregation of Duties,The organization identifies duties that require separation and defines information system access authorizations to support separation of duties; and incompatible duties are segregated across multiple users to minimize the opportunity for misuse or fraud.,ID : 1278.09c2Organizational.56 - 09.c,General,Custom subscription owner roles should not exist,10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9,This policy ensures that no custom subscription owner roles exist.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/CustomSubscription_OwnerRole_Audit.json,2.0.0
HIPAA HITRUST 9.2,Controls Against Malicious Code,"Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",ID : 0201.09j1Organizational.124 - 09.j,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
HIPAA HITRUST 9.2,Controls Against Malicious Code,"Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",ID : 0201.09j1Organizational.124 - 09.j,Compute,Deploy default Microsoft IaaSAntimalware extension for Windows Server,2835b622-407b-4114-9198-6f7064cbe0dc,This policy deploys a Microsoft IaaSAntimalware extension with a default configuration when a VM is not configured with the antimalware extension.,deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VMAntimalwareExtension_Deploy.json,1.0.0
HIPAA HITRUST 9.2,Controls Against Malicious Code,"Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",ID : 0201.09j1Organizational.124 - 09.j,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
HIPAA HITRUST 9.2,Controls Against Malicious Code,"Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",ID : 0201.09j1Organizational.124 - 09.j,Compute,Microsoft Antimalware for Azure should be configured to automatically update protection signatures,c43e4a30-77cb-48ab-a4dd-93f175c63b57,This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VirtualMachines_AntiMalwareAutoUpdate_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Controls Against Malicious Code,"Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",ID : 0201.09j1Organizational.124 - 09.j,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
HIPAA HITRUST 9.2,Controls Against Malicious Code,"Anti-virus and anti-spyware are installed, operating and updated on all end-user devices to conduct periodic scans of the systems to identify and remove unauthorized software. Server environments for which the server software developer specifically recommends not installing host-based anti-virus and anti-spyware software may address the requirement via a network-based malware detection (NBMD) solution.",ID : 0201.09j1Organizational.124 - 09.j,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
HIPAA HITRUST 9.2,Back-up,Backup copies of information and software are made and tests of the media and restoration procedures are regularly performed at appropriate intervals.,ID : 1616.09l1Organizational.16 - 09.l,SQL,Long-term geo-redundant backup should be enabled for Azure SQL Databases,d38fc420-0735-4ef3-ac11-c806f651a570,This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json,2.0.0
HIPAA HITRUST 9.2,Back-up,"A formal definition of the level of backup required for each system is defined and documented including how each system will be restored, the scope of data to be imaged, frequency of imaging, and duration of retention based on relevant contractual, legal, regulatory and business requirements.",ID : 1617.09l1Organizational.23 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for MySQL,82339799-d096-41ae-8538-b108becf0970,"Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"The backups are stored in a physically secure remote location, at a sufficient distance to make them reasonably immune from damage to data at the primary site, and reasonable physical and environmental controls are in place to ensure their protection at the remote location.",ID : 1618.09l1Organizational.45 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"Inventory records for the backup copies, including content and current location, are maintained.",ID : 1619.09l1Organizational.7 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"When the backup service is delivered by the third party, the service level agreement includes the detailed protections to control confidentiality, integrity and availability of the backup information.",ID : 1620.09l1Organizational.8 - 09.l,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,Automated tools are used to track all backups.,ID : 1621.09l2Organizational.1 - 09.l,SQL,Long-term geo-redundant backup should be enabled for Azure SQL Databases,d38fc420-0735-4ef3-ac11-c806f651a570,This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_SQLDatabase_AuditIfNotExists.json,2.0.0
HIPAA HITRUST 9.2,Back-up,"The integrity and security of the backup copies are maintained to ensure future availability, and any potential accessibility problems with the backup copies are identified and mitigated in the event of an area-wide disaster.",ID : 1622.09l2Organizational.23 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for MySQL,82339799-d096-41ae-8538-b108becf0970,"Azure Database for MySQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMySQL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,Covered information is backed-up in an encrypted format to ensure confidentiality.,ID : 1623.09l2Organizational.4 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,The organization performs incremental or differential backups daily and full backups weekly to separate media.,ID : 1624.09l3Organizational.12 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"Three (3) generations of backups (full plus all related incremental or differential backups) are stored off-site, and both on-site and off-site backups are logged with name, date, time and action.",ID : 1625.09l3Organizational.34 - 09.l,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"The organization ensures a current, retrievable copy of covered information is available before movement of servers.",ID : 1626.09l3Organizational.5 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for PostgreSQL,48af4db5-9b8b-401c-8e74-076be876a430,"Azure Database for PostgreSQL allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForPostgreSQL_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"The organization tests backup information following each backup to verify media reliability and information integrity, and at least annually thereafter.",ID : 1627.09l3Organizational.6 - 09.l,SQL,Geo-redundant backup should be enabled for Azure Database for MariaDB,0ec47710-77ff-4a3d-9181-6aa50af424d0,"Azure Database for MariaDB allows you to choose the redundancy option for your database server. It can be set to a geo-redundant backup storage in which the data is not only stored within the region in which your server is hosted, but is also replicated to a paired region to provide recovery option in case of a region failure. Configuring geo-redundant storage for backup is only allowed during server create.","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/GeoRedundant_DBForMariaDB_Audit.json,1.0.1
HIPAA HITRUST 9.2,Back-up,"Workforce members roles and responsibilities in the data backup process are identified and communicated to the workforce; in particular, Bring Your Own Device (BYOD) users are required to perform backups of organizational and/or client data on their devices.",ID : 1699.09l1Organizational.10 - 09.l,Backup,Azure Backup should be enabled for Virtual Machines,013e242c-8828-4970-87b3-ab247555486d,Ensure protection of your Azure Virtual Machines by enabling Azure Backup. Azure Backup is a secure and cost effective data protection solution for Azure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Backup/VirtualMachines_EnableAzureBackup_Audit.json,1.0.1
HIPAA HITRUST 9.2,Network Controls,The organization monitors for all authorized and unauthorized wireless access to the information system and prohibits installation of wireless access points (WAPs) unless explicitly authorized in writing by the CIO or his/her designated representative.,ID : 0858.09m1Organizational.4 - 09.m,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Controls,The organization monitors for all authorized and unauthorized wireless access to the information system and prohibits installation of wireless access points (WAPs) unless explicitly authorized in writing by the CIO or his/her designated representative.,ID : 0858.09m1Organizational.4 - 09.m,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Controls,The organization monitors for all authorized and unauthorized wireless access to the information system and prohibits installation of wireless access points (WAPs) unless explicitly authorized in writing by the CIO or his/her designated representative.,ID : 0858.09m1Organizational.4 - 09.m,Guest Configuration,Windows machines should meet requirements for 'Windows Firewall Properties',35d9882c-993d-44e6-87d2-db66ce21b636,"Windows machines should have the specified Group Policy settings in the category 'Windows Firewall Properties' for firewall state, connections, rule management, and notifications. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsFirewallProperties_AINE.json,2.0.0
HIPAA HITRUST 9.2,Network Controls,"The organization ensures the security of information in networks, availability of network services and information services using the network, and the protection of connected services from unauthorized access.",ID : 0859.09m1Organizational.78 - 09.m,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
HIPAA HITRUST 9.2,Network Controls,"The organization formally manages equipment on the network, including equipment in user areas.",ID : 0860.09m1Organizational.9 - 09.m,Monitoring,Deploy Diagnostic Settings for Network Security Groups,c9c29499-c1d1-4195-99bd-2ec9e3a9dc89,This policy automatically deploys diagnostic settings to network security groups. A storage account with name '{storagePrefixParameter}{NSGLocation}' will be automatically created.,deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForNSG_Deploy.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,"The organization formally manages equipment on the network, including equipment in user areas.",ID : 0860.09m1Organizational.9 - 09.m,Network,Service Bus should use a virtual network service endpoint,235359c5-7c52-4b82-9055-01c75cf9f60e,This policy audits any Service Bus not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ServiceBus_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,"To identify and authenticate devices on local and/or wide area networks, including wireless networks,  the information system uses either a (i) shared known information solution or (ii) an organizational authentication solution, the exact selection and strength of which is dependent on the security categorization of the information system.",ID : 0861.09m2Organizational.67 - 09.m,Network,App Service should use a virtual network service endpoint,2d21331d-a4c2-4def-a9ad-ee4e1e023beb,This policy audits any App Service not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_AppService_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,"To identify and authenticate devices on local and/or wide area networks, including wireless networks,  the information system uses either a (i) shared known information solution or (ii) an organizational authentication solution, the exact selection and strength of which is dependent on the security categorization of the information system.",ID : 0861.09m2Organizational.67 - 09.m,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Access',3ff60f98-7fa4-410a-9f7f-0b00f5afdbdd,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Access' for including access for anonymous users, local accounts, and remote access to the registry. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkAccess_AINE.json,2.0.0
HIPAA HITRUST 9.2,Network Controls,"The organization ensures information systems protect the confidentiality and integrity of transmitted information, including during preparation for transmission and during reception.",ID : 0862.09m2Organizational.8 - 09.m,Network,SQL Server should use a virtual network service endpoint,ae5d2f14-d830-42b6-9899-df6cfe9c71a3,This policy audits any SQL Server not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_SQLServer_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,The organization builds a firewall configuration that restricts connections between un-trusted networks and any system components in the covered information environment; and any changes to the firewall configuration are updated in the network diagram.,ID : 0863.09m2Organizational.910 - 09.m,Network,Event Hub should use a virtual network service endpoint,d63edb4a-c612-454d-b47d-191a724fcbf0,This policy audits any Event Hub not configured to use a virtual network service endpoint.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_EventHub_AuditIfNotExists.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,"Usage restrictions and implementation guidance are formally defined for VoIP, including the authorization and monitoring of the service.",ID : 0864.09m2Organizational.12 - 09.m,Network,Cosmos DB should use a virtual network service endpoint,e0a2b1a3-f7f9-4569-807f-2a9edebdf4d9,This policy audits any Cosmos DB not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_CosmosDB_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,"The organization (i) authorizes connections from the information system to other information systems outside of the organization through the use of interconnection security agreements or other formal agreement; (ii) documents each connection, the interface characteristics, security requirements, and the nature of the information communicated; (iii) employs a deny all, permit by exception policy for allowing connections from the information system to other information systems outside of the organization; and (iv) applies a default-deny rule that drops all traffic via host-based firewalls or port filtering tools on its endpoints (workstations, servers, etc.), except those services and ports that are explicitly allowed.",ID : 0865.09m2Organizational.13 - 09.m,Network,Key Vault should use a virtual network service endpoint,ea4d6841-2173-4317-9747-ff522a45120f,This policy audits any Key Vault not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_KeyVault_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,"The organization describes the groups, roles, and responsibilities for the logical management of network components and ensures coordination of and consistency in the elements of the network infrastructure.",ID : 0866.09m3Organizational.1516 - 09.m,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
HIPAA HITRUST 9.2,Network Controls,"Wireless access points are placed in secure areas and shut down when not in use (e.g. nights, weekends).",ID : 0867.09m3Organizational.17 - 09.m,Network,Storage Accounts should use a virtual network service endpoint,60d21c4f-21a3-4d94-85f4-b924e6aeeda4,This policy audits any Storage Account not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_StorageAccount_Audit.json,1.0.0
HIPAA HITRUST 9.2,Network Controls,The organization builds a firewall configuration to restrict inbound and outbound traffic to that which is necessary for the covered data environment.,ID : 0868.09m3Organizational.18 - 09.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Network Controls,The router configuration files are secured and synchronized.,ID : 0869.09m3Organizational.19 - 09.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Network Controls,"Access to all proxies is denied, except for those hosts, ports, and services that are explicitly required.",ID : 0870.09m3Organizational.20 - 09.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Network Controls,Authoritative DNS servers are segregated into internal and external roles.,ID : 0871.09m3Organizational.22 - 09.m,Network,Container Registry should use a virtual network service endpoint,c4857be7-912a-4c75-87e6-e30292bcdf78,This policy audits any Container Registry not configured to use a virtual network service endpoint.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetworkServiceEndpoint_ContainerRegistry_Audit.json,1.0.0-preview
HIPAA HITRUST 9.2,Security of Network Services,Agreed services provided by a network service provider/manager are formally managed and monitored to ensure they are provided securely.,ID : 0835.09n1Organizational.1 - 09.n,Monitoring,Network traffic data collection agent should be installed on Windows virtual machines,2f2ee1de-44aa-4762-b6bd-0893fc3f306d,"Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Windows.json,1.0.1-preview
HIPAA HITRUST 9.2,Security of Network Services,Agreed services provided by a network service provider/manager are formally managed and monitored to ensure they are provided securely.,ID : 0835.09n1Organizational.1 - 09.n,Compute,Virtual machines should be migrated to new Azure Resource Manager resources,1d84d5fb-01f6-4d12-ba4f-4a26081d403d,"Use new Azure Resource Manager for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ClassicCompute_Audit.json,1.0.0
HIPAA HITRUST 9.2,Security of Network Services,The organization formally authorizes and documents the characteristics of each connection from an information system to other information systems outside the organization.,ID : 0836.09.n2Organizational.1 - 09.n,Monitoring,Network traffic data collection agent should be installed on Linux virtual machines,04c4380f-3fae-46e8-96c9-30193528f602,"Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Linux.json,1.0.1-preview
HIPAA HITRUST 9.2,Security of Network Services,Formal agreements with external information system providers include specific obligations for security and privacy.,ID : 0837.09.n2Organizational.2 - 09.n,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
HIPAA HITRUST 9.2,Security of Network Services,The organization reviews and updates the interconnection security agreements on an ongoing basis verifying enforcement of security requirements.,ID : 0885.09n2Organizational.3 - 09.n,Monitoring,Network traffic data collection agent should be installed on Linux virtual machines,04c4380f-3fae-46e8-96c9-30193528f602,"Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Linux.json,1.0.1-preview
HIPAA HITRUST 9.2,Security of Network Services,"The organization employs and documents in a formal agreement or other document, either i) allow-all, deny-by-exception, or, ii) deny-all, permit-by-exception (preferred), policy for allowing specific information systems to connect to external information systems.",ID : 0886.09n2Organizational.4 - 09.n,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
HIPAA HITRUST 9.2,Security of Network Services,"The organization requires external/outsourced service providers to identify the specific functions, ports, and protocols used in the provision of the external/outsourced services.",ID : 0887.09n2Organizational.5 - 09.n,Monitoring,Network traffic data collection agent should be installed on Windows virtual machines,2f2ee1de-44aa-4762-b6bd-0893fc3f306d,"Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ASC_Dependency_Agent_Audit_Windows.json,1.0.1-preview
HIPAA HITRUST 9.2,Security of Network Services,The contract with the external/outsourced service provider includes the specification that the service provider is responsible for the protection of covered information shared.,ID : 0888.09n2Organizational.6 - 09.n,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
HIPAA HITRUST 9.2,Management of Removable Media,"The organization, based on the data classification level, registers media (including laptops) prior to use, places reasonable restrictions on how such media be used, and provides an appropriate level of physical and logical protection (including encryption) for media containing covered information until properly destroyed or sanitized.",ID : 0301.09o1Organizational.123 - 09.o,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
HIPAA HITRUST 9.2,Management of Removable Media,The organization protects and controls media containing sensitive information during transport outside of controlled areas.,ID : 0302.09o2Organizational.1 - 09.o,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
HIPAA HITRUST 9.2,Management of Removable Media,Digital and non-digital media requiring restricted use and the specific safeguards used to restrict their use are identified.,ID : 0303.09o2Organizational.2 - 09.o,Compute,Unattached disks should be encrypted,2c89a2e5-7285-40fe-afe0-ae8654b92fb2,This policy audits any unattached disk without encryption enabled.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/UnattachedDisk_Encryption_Audit.json,1.0.0
HIPAA HITRUST 9.2,Management of Removable Media,The organization restricts the use of writable removable media and personally-owned removable media in organizational systems.,ID : 0304.09o3Organizational.1 - 09.o,Data Lake,Require encryption on Data Lake Store accounts,a7ff3161-0087-490a-9ad9-ad6217f4f43a,This policy ensures encryption is enabled on all Data Lake Store accounts,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Data%20Lake/DataLakeStoreEncryption_Deny.json,1.0.0
HIPAA HITRUST 9.2,Management of Removable Media,The organization restricts the use of writable removable media and personally-owned removable media in organizational systems.,ID : 0304.09o3Organizational.1 - 09.o,SQL,SQL managed instances should use customer-managed keys to encrypt data at rest,048248b0-55cd-46da-b1ff-39efd52db260,"Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,1.0.2
HIPAA HITRUST 9.2,Management of Removable Media,The organization restricts the use of writable removable media and personally-owned removable media in organizational systems.,ID : 0304.09o3Organizational.1 - 09.o,SQL,SQL servers should use customer-managed keys to encrypt data at rest,0d134df8-db83-46fb-ad72-fe0c9428c8dd,"Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json,2.0.1
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,"Cloud service providers use an industry-recognized virtualization platform and standard virtualization formats (e.g., Open Virtualization Format, OVF) to help ensure interoperability, and has documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review.",ID : 0662.09sCSPOrganizational.2 - 09.s,App Service,Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On',5bb220d9-2698-4ee4-8404-b9c30c9df609,Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_ClientCert.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,The organization formally addresses multiple safeguards before allowing the use of information systems for information exchange.,ID : 0901.09s1Organizational.1 - 09.s,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,Remote (external) access to the organization's information assets and access to external information assets (for which the organization has no control) is based on clearly defined terms and conditions.,ID : 0902.09s2Organizational.13 - 09.s,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,"The organization establishes terms and conditions, consistent with any trust relationship established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to (i) access the information system from external information systems; and (ii) process, store or transmit organization-controlled information using external information systems.",ID : 0911.09s1Organizational.2 - 09.s,App Service,CORS should not allow every resource to access your API App,358c20a6-3f9e-4f0e-97ff-c6ce485e2aac,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,Cryptography is used to protect the confidentiality and integrity of remote access sessions to the internal network and to external systems.,ID : 0912.09s1Organizational.4 - 09.s,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,Strong cryptography protocols are used to safeguard covered information during transmission over less trusted / open public networks.,ID : 0913.09s1Organizational.5 - 09.s,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,"The organization ensures that communication protection requirements, including the security of exchanges of information, is the subject of policy development and compliance audits.",ID : 0914.09s1Organizational.6 - 09.s,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,The organization limits the use of organization-controlled portable storage media by authorized individuals on external information systems.,ID : 0915.09s2Organizational.2 - 09.s,App Service,Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On',5bb220d9-2698-4ee4-8404-b9c30c9df609,Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_ClientCert.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,The information system prohibits remote activation of collaborative computing devices and provides an explicit indication of use to users physically present at the devices.,ID : 0916.09s2Organizational.4 - 09.s,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,"Cloud service providers use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.",ID : 0960.09sCSPOrganizational.1 - 09.s,App Service,CORS should not allow every resource to access your Function Apps,0820b7b9-23aa-4725-a1ce-ae4558f718e5,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_FuntionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,Information Exchange Policies and Procedures,"Personnel are appropriately trained on leading principles and practices for all types of information exchange (oral, paper and electronic).",ID : 1325.09s1Organizational.3 - 09.s,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,Data involved in electronic commerce and online transactions is checked to determine if it contains covered information.,ID : 0943.09y1Organizational.1 - 09.y,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
HIPAA HITRUST 9.2,On-line Transactions,"Protocols used to communicate between all involved parties are secured using cryptographic techniques (e.g., SSL).",ID : 0945.09y1Organizational.3 - 09.y,Guest Configuration,Audit Windows machines that do not contain the specified certificates in Trusted Root,934345e1-4dfb-4c70-90d7-41990dc9608b,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the machine Trusted Root certificate store (Cert:\LocalMachine\Root) does not contain one or more of the certificates listed by the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsCertificateInTrustedRoot_AINE.json,1.0.1
HIPAA HITRUST 9.2,On-line Transactions,"The organization requires the use of encryption between, and the use of electronic signatures by, each of the parties involved in the transaction.",ID : 0946.09y2Organizational.14 - 09.y,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,"The organization ensures the storage of the transaction details are located outside of any publicly accessible environments (e.g., on a storage platform existing on the organization's intranet) and not retained and exposed on a storage medium directly accessible from the Internet.",ID : 0947.09y2Organizational.2 - 09.y,SQL,Enforce SSL connection should be enabled for PostgreSQL database servers,d158790f-bfb0-486c-8631-2dc6b4e8e6af,Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/PostgreSQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,On-line Transactions,"Where a trusted authority is used (e.g., for the purposes of issuing and maintaining digital signatures and/or digital certificates), security is integrated and embedded throughout the entire end-to-end certificate/signature management process.",ID : 0948.09y2Organizational.3 - 09.y,SQL,Enforce SSL connection should be enabled for MySQL database servers,e802a67a-daf5-4436-9ea6-f6d821dd0c5d,Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/MySQL_EnableSSL_Audit.json,1.0.1
HIPAA HITRUST 9.2,On-line Transactions,"The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",ID : 0949.09y2Organizational.5 - 09.y,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,"The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",ID : 0949.09y2Organizational.5 - 09.y,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,"The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",ID : 0949.09y2Organizational.5 - 09.y,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,"The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",ID : 0949.09y2Organizational.5 - 09.y,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,"The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",ID : 0949.09y2Organizational.5 - 09.y,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
HIPAA HITRUST 9.2,On-line Transactions,"The protocols used for communications are enhanced to address any new vulnerability, and the updated versions of the protocols are adopted as soon as possible.",ID : 0949.09y2Organizational.5 - 09.y,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
HIPAA HITRUST 9.2,Control of Operational Software,"Only authorized administrators are allowed to implement approved upgrades to software, applications, and program libraries, based on business requirements and the security implications of the release.",ID : 0605.10h1System.12 - 10.h,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Operational Software,"Only authorized administrators are allowed to implement approved upgrades to software, applications, and program libraries, based on business requirements and the security implications of the release.",ID : 0605.10h1System.12 - 10.h,Guest Configuration,Windows machines should meet requirements for 'Security Options - Audit',33936777-f2ac-45aa-82ec-07958ec9ade4,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Audit' for forcing audit policy subcategory and shutting down if unable to log security audits. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsAudit_AINE.json,2.0.0
HIPAA HITRUST 9.2,Control of Operational Software,"Only authorized administrators are allowed to implement approved upgrades to software, applications, and program libraries, based on business requirements and the security implications of the release.",ID : 0605.10h1System.12 - 10.h,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Account Management',94d9aca8-3757-46df-aa51-f218c5f11954,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Account Management' for auditing application, security, and user group management, and other management events. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesAccountManagement_AINE.json,2.0.0
HIPAA HITRUST 9.2,Control of Operational Software,"Applications and operating systems are successfully tested for usability, security and impact prior to production.",ID : 0606.10h2System.1 - 10.h,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Operational Software,The organization uses its configuration control program to maintain control of all implemented software and its system documentation and archive prior versions of implemented software and associated system documentation.,ID : 0607.10h2System.23 - 10.h,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Operational Software,The organization uses its configuration control program to maintain control of all implemented software and its system documentation and archive prior versions of implemented software and associated system documentation.,ID : 0607.10h2System.23 - 10.h,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Change Control Procedures,Managers responsible for application systems are also responsible for the strict control (security) of the project or support environment and ensure that all proposed system changes are reviewed to check that they do not compromise the security of either the system or the operating environment.,ID : 0635.10k1Organizational.12 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"The organization formally addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance for configuration management (e.g., through policies, standards, processes).",ID : 0636.10k2Organizational.1 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"The organization has developed, documented, and implemented a configuration management plan for the information system.",ID : 0637.10k2Organizational.2 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"Changes are formally controlled, documented and enforced in order to minimize the corruption of information systems.",ID : 0638.10k2Organizational.34569 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"Installation checklists and vulnerability scans are used to validate the configuration of servers, workstations, devices and appliances and ensure the configuration meets minimum standards.",ID : 0639.10k2Organizational.78 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"Where development is outsourced, change control procedures to address security are included in the contract(s) and specifically require the developer to track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel or roles.",ID : 0640.10k2Organizational.1012 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,The organization does not use automated updates on critical systems.,ID : 0641.10k2Organizational.11 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"The organization develops, documents, and maintains, under configuration control, a current baseline configuration of the information system, and reviews and updates the baseline as required.",ID : 0642.10k3Organizational.12 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"The organization (i) establishes and documents mandatory configuration settings for information technology products employed within the information system using the latest security configuration baselines; (ii) identifies, documents, and approves exceptions from the mandatory established configuration settings for individual components based on explicit operational requirements; and (iii) monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.",ID : 0643.10k3Organizational.3 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Change Control Procedures,"The organization employs automated mechanisms to (i) centrally manage, apply, and verify configuration settings; (ii) respond to unauthorized changes to network and system security-related configuration settings; and (iii) enforce access restrictions and auditing of the enforcement actions.",ID : 0644.10k3Organizational.4 - 10.k,Guest Configuration,Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking',58383b73-94a9-4414-b382-4146eb02611b,"Windows machines should have the specified Group Policy settings in the category 'System Audit Policies - Detailed Tracking' for auditing DPAPI, process creation/termination, RPC events, and PNP activity. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SystemAuditPoliciesDetailedTracking_AINE.json,2.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Technical vulnerabilities are identified, evaluated for risk and corrected in a timely manner.",ID : 0709.10m1Organizational.1 - 10.m,Guest Configuration,Windows machines should meet requirements for 'Security Options - Microsoft Network Server',caf2d518-f029-4f6b-833b-d7081702f253,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Microsoft Network Server' for disabling SMB v1 server. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsMicrosoftNetworkServer_AINE.json,2.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,A hardened configuration standard exists for all system and network components.,ID : 0710.10m2Organizational.1 - 10.m,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"A technical vulnerability management program is in place to monitor, assess, rank, and remediate vulnerabilities identified in systems.",ID : 0711.10m2Organizational.23 - 10.m,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,Patches are tested and evaluated before they are installed.,ID : 0713.10m2Organizational.5 - 10.m,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,The technical vulnerability management program is evaluated on a quarterly basis.,ID : 0714.10m2Organizational.7 - 10.m,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"Systems are appropriately hardened (e.g., configured with only necessary and secure services, ports and protocols enabled).",ID : 0715.10m2Organizational.8 - 10.m,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,"The organization conducts an enterprise security posture review as needed but no less than once within every three-hundred-sixty-five (365) days, in accordance with organizational IS procedures.",ID : 0716.10m3Organizational.1 - 10.m,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,Vulnerability scanning tools include the capability to readily update the information system vulnerabilities scanned.,ID : 0717.10m3Organizational.2 - 10.m,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,The organization scans for vulnerabilities in the information system and hosted applications to determine the state of flaw remediation monthly (automatically) and again (manually or automatically) when new vulnerabilities potentially affecting the systems and networked environments are identified and reported.,ID : 0718.10m3Organizational.34 - 10.m,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
HIPAA HITRUST 9.2,Control of Technical Vulnerabilities,The organization updates the list of information system vulnerabilities scanned within every thirty (30) days or when new vulnerabilities are identified and reported.,ID : 0719.10m3Organizational.5 - 10.m,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
HIPAA HITRUST 9.2,Business Continuity and Risk Assessment,The organization identifies the critical business processes requiring business continuity.,ID : 1634.12b1Organizational.1 - 12.b,Compute,Audit virtual machines without disaster recovery configured,0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56,"Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json,1.0.0
HIPAA HITRUST 9.2,Business Continuity and Risk Assessment,"Information security aspects of business continuity are (i) based on identifying events (or sequence of events) that can cause interruptions to the organization's critical business processes (e.g., equipment failure, human errors, theft, fire, natural disasters acts of terrorism); (ii) followed by a risk assessment to determine the probability and impact of such interruptions, in terms of time, damage scale and recovery period; (iii) based on the results of the risk assessment, a business continuity strategy is developed to identify the overall approach to business continuity; and (iv) once this strategy has been created, endorsement is provided by management, and a plan created and endorsed to implement this strategy.",ID : 1635.12b1Organizational.2 - 12.b,Key Vault,Azure Key Vault Managed HSM should have purge protection enabled,c39ba22d-4428-4149-b981-70acb31fc383,Malicious deletion of an Azure Key Vault Managed HSM can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge Azure Key Vault Managed HSM. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted Azure Key Vault Managed HSM. No one inside your organization or Microsoft will be able to purge your Azure Key Vault Managed HSM during the soft delete retention period.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/ManagedHsm_Recoverable_Audit.json,1.0.0
HIPAA HITRUST 9.2,Business Continuity and Risk Assessment,"Information security aspects of business continuity are (i) based on identifying events (or sequence of events) that can cause interruptions to the organization's critical business processes (e.g., equipment failure, human errors, theft, fire, natural disasters acts of terrorism); (ii) followed by a risk assessment to determine the probability and impact of such interruptions, in terms of time, damage scale and recovery period; (iii) based on the results of the risk assessment, a business continuity strategy is developed to identify the overall approach to business continuity; and (iv) once this strategy has been created, endorsement is provided by management, and a plan created and endorsed to implement this strategy.",ID : 1635.12b1Organizational.2 - 12.b,Key Vault,Key vaults should have purge protection enabled,0b60c0b2-2dc2-4e1c-b5c9-abbed971de53,Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_Recoverable_Audit.json,1.1.1
HIPAA HITRUST 9.2,Business Continuity and Risk Assessment,"Business impact analysis are used to evaluate the consequences of disasters, security failures, loss of service, and service availability.",ID : 1637.12b2Organizational.2 - 12.b,Guest Configuration,Windows machines should meet requirements for 'Security Options - Recovery console',f71be03e-e25b-4d0f-b8bc-9b3e309b66c0,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Recovery console' for allowing floppy copy and access to all drives and folders. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsRecoveryconsole_AINE.json,2.0.0
HIPAA HITRUST 9.2,Business Continuity and Risk Assessment,"Business continuity risk assessments (i) are carried out annually with full involvement from owners of business resources and processes; (ii) consider all business processes and is not limited to the information assets, but includes the results specific to information security; and (iii) identifies, quantifies, and prioritizes risks against key business objectives and criteria relevant to the organization, including critical resources, impacts of disruptions, allowable outage times, and recovery priorities.",ID : 1638.12b2Organizational.345 - 12.b,Compute,Audit virtual machines without disaster recovery configured,0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56,"Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json,1.0.0
ISO 27001,Organization of information security,Segregation of Duties,A.6.1.2,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
ISO 27001,Organization of information security,Segregation of Duties,A.6.1.2,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
ISO 27001,Asset management,Classification of information,A.8.2.1,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Compute,Audit VMs that do not use managed disks,06a78e20-9358-41c9-923c-fb736d382a4d,This policy audits VMs that do not use managed disks,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VMRequireManagedDisk_Audit.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Storage,Storage accounts should be migrated to new Azure Resource Manager resources,37e0d2fe-28a5-43d6-a273-67d37d1f5606,"Use new Azure Resource Manager for your storage accounts to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Classic_AuditForClassicStorages_Audit.json,1.0.0
ISO 27001,Access control,Access to networks and network services,A.9.1.2,Compute,Virtual machines should be migrated to new Azure Resource Manager resources,1d84d5fb-01f6-4d12-ba4f-4a26081d403d,"Use new Azure Resource Manager for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/ClassicCompute_Audit.json,1.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,SQL,An Azure Active Directory administrator should be provisioned for SQL servers,1f314764-cb73-4fc9-b863-8eca98ac36e9,Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json,1.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,General,Audit usage of custom RBAC rules,a451c1ef-c6ca-483d-87ed-f49761e3ffb5,"Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json,1.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Management of privileged access rights,A.9.2.3,Service Fabric,Service Fabric clusters should only use Azure Active Directory for client authentication,b54ed75b-3e1a-44ac-a333-05ba39b99ff0,Audit usage of client authentication only via Azure Active Directory in Service Fabric,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditADAuth_Audit.json,1.1.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Guest Configuration,Audit Linux machines that do not have the passwd file permissions set to 0644,e6955644-301c-44b5-a4c4-528577de6861,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that do not have the passwd file permissions set to 0644","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword121_AINE.json,1.0.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Management of secret authentication information of users,A.9.2.4,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
ISO 27001,Access control,Review of user access rights,A.9.2.5,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
ISO 27001,Access control,Review of user access rights,A.9.2.5,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Review of user access rights,A.9.2.5,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Review of user access rights,A.9.2.5,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
ISO 27001,Access control,Removal or adjustment of access rights,A.9.2.6,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
ISO 27001,Access control,Removal or adjustment of access rights,A.9.2.6,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Secure log-on procedures,A.9.4.2,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
ISO 27001,Access control,Secure log-on procedures,A.9.4.2,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
ISO 27001,Access control,Secure log-on procedures,A.9.4.2,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Audit Windows machines that allow re-use of the previous 24 passwords,5b054a0d-39e2-4d53-bea3-9734cad2c69b,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that allow re-use of the previous 24 passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEnforce_AINE.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Audit Windows machines that do not have a maximum password age of 70 days,4ceb8dc2-559c-478b-a15b-733fbf1e3738,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have a maximum password age of 70 days","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsMaximumPassword_AINE.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Audit Windows machines that do not have a minimum password age of 1 day,237b38db-ca4d-4259-9e47-7882441ca2c0,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have a minimum password age of 1 day","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsMinimumPassword_AINE.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Audit Windows machines that do not have the password complexity setting enabled,bf16e0bb-31e1-4646-8202-60a235cc7e74,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have the password complexity setting enabled","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordComplexity_AINE.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Audit Windows machines that do not restrict the minimum password length to 14 characters,a2d0e922-65d0-40c4-8f87-ea6da2d307a2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not restrict the minimum password length to 14 characters","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordLength_AINE.json,1.0.0
ISO 27001,Access control,Password management system,A.9.4.3,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Guest Configuration,Audit Windows machines that do not store passwords using reversible encryption,da0f98fe-a24b-4ad5-af69-bd0400233661,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Automation,Automation account variables should be encrypted,3657f5a0-770e-44a3-b44e-9431ba1e9735,It is important to enable encryption of Automation account variable assets when storing sensitive data,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json,1.1.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,Service Fabric,Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign,617c02be-7f02-4efd-8836-3180d47b6c68,"Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json,1.1.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
ISO 27001,Cryptography,Policy on the use of cryptographic controls,A.10.1.1,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
ISO 27001,Operations security,Event Logging,A.12.4.1,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
ISO 27001,Operations security,Event Logging,A.12.4.1,Monitoring,Audit Dependency agent deployment - VM Image (OS) unlisted,11ac78e3-31bc-4f0c-8434-37ab963cea07,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_Audit.json,1.0.1
ISO 27001,Operations security,Event Logging,A.12.4.1,Monitoring,Audit Dependency agent deployment in virtual machine scale sets - VM Image (OS) unlisted,e2dd799a-a932-4e9d-ac17-d473bc3c6c10,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_VMSS_Audit.json,1.0.1
ISO 27001,Operations security,Event Logging,A.12.4.1,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
ISO 27001,Operations security,Event Logging,A.12.4.1,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
ISO 27001,Operations security,Event Logging,A.12.4.1,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
ISO 27001,Operations security,Event Logging,A.12.4.1,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,Monitoring,Audit Dependency agent deployment - VM Image (OS) unlisted,11ac78e3-31bc-4f0c-8434-37ab963cea07,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_Audit.json,1.0.1
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,Monitoring,Audit Dependency agent deployment in virtual machine scale sets - VM Image (OS) unlisted,e2dd799a-a932-4e9d-ac17-d473bc3c6c10,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_VMSS_Audit.json,1.0.1
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
ISO 27001,Operations security,Administrator and operator logs,A.12.4.3,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,Monitoring,Audit Dependency agent deployment - VM Image (OS) unlisted,11ac78e3-31bc-4f0c-8434-37ab963cea07,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_Audit.json,1.0.1
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,Monitoring,Audit Dependency agent deployment in virtual machine scale sets - VM Image (OS) unlisted,e2dd799a-a932-4e9d-ac17-d473bc3c6c10,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgent_OSImage_VMSS_Audit.json,1.0.1
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
ISO 27001,Operations security,Clock Synchronization,A.12.4.4,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
ISO 27001,Operations security,Installation of software on operational systems,A.12.5.1,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
ISO 27001,Operations security,Management of technical vulnerabilities,A.12.6.1,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
ISO 27001,Operations security,Management of technical vulnerabilities,A.12.6.1,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
ISO 27001,Operations security,Management of technical vulnerabilities,A.12.6.1,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
ISO 27001,Operations security,Management of technical vulnerabilities,A.12.6.1,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
ISO 27001,Operations security,Management of technical vulnerabilities,A.12.6.1,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
ISO 27001,Operations security,Restrictions on software installation,A.12.6.2,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
ISO 27001,Communications security,Network controls,A.13.1.1,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
ISO 27001,Communications security,Network controls,A.13.1.1,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
ISO 27001,Communications security,Information transfer policies and procedures,A.13.2.1,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
ISO 27001,Communications security,Information transfer policies and procedures,A.13.2.1,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,SQL,Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports,057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9,Ensure that an email address is provided for the 'Send scan reports to' field in the Vulnerability Assessment settings. This email address receives scan result summary after a periodic scan runs on SQL servers.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_VulnerabilityAssessmentEmails_Audit.json,2.0.0
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,SQL,Vulnerability assessment should be enabled on SQL Managed Instance,1b7aa243-30e4-4c9e-bca8-d0d3022b634a,"Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnManagedInstance_Audit.json,1.0.1
NZISM Security Benchmark,Information security monitoring,6.2.5 Conducting vulnerability assessments,ISM-3,SQL,Vulnerability assessment should be enabled on your SQL servers,ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9,"Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/VulnerabilityAssessmentOnServer_Audit.json,2.0.0
NZISM Security Benchmark,Product Security,12.4.4 Patching vulnerabilities in products,PRS-5,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
NZISM Security Benchmark,Product Security,12.4.4 Patching vulnerabilities in products,PRS-5,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Product Security,12.4.4 Patching vulnerabilities in products,PRS-5,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Product Security,12.4.4 Patching vulnerabilities in products,PRS-5,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
NZISM Security Benchmark,Product Security,12.4.4 Patching vulnerabilities in products,PRS-5,Security Center,System updates on virtual machine scale sets should be installed,c3f317a7-a95c-4547-b7e7-11017ebdf2fe,Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json,3.0.0
NZISM Security Benchmark,Product Security,12.4.4 Patching vulnerabilities in products,PRS-5,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
NZISM Security Benchmark,Software security,14.1.9 Maintaining hardened SOEs,SS-2,Monitoring,Deploy Dependency agent for Windows virtual machine scale sets,3be22e3b-d919-47aa-805e-8985dbeb0ad9,"Deploy Dependency agent for Windows virtual machine scale sets if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. Note: if your scale set upgradePolicy is set to Manual, you need to apply the extension to the all virtual machines in the set by calling upgrade on them. In CLI this would be az vmss update-instances.",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VMSS_Deploy.json,1.3.0
NZISM Security Benchmark,Software security,14.1.9 Maintaining hardened SOEs,SS-2,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
NZISM Security Benchmark,Software security,14.1.9 Maintaining hardened SOEs,SS-2,Compute,Microsoft IaaSAntimalware extension should be deployed on Windows servers,9b597639-28e4-48eb-b506-56b05d366257,This policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/WindowsServers_AntiMalware_AuditIfNotExists.json,1.0.0
NZISM Security Benchmark,Software security,14.1.9 Maintaining hardened SOEs,SS-2,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
NZISM Security Benchmark,Software security,14.2.4 Application Whitelisting,SS-4,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NZISM Security Benchmark,Software security,14.5.8 Web applications,SS-8,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
NZISM Security Benchmark,Software security,14.5.8 Web applications,SS-8,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
NZISM Security Benchmark,Software security,14.5.8 Web applications,SS-8,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
NZISM Security Benchmark,Software security,14.5.8 Web applications,SS-8,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
NZISM Security Benchmark,Software security,14.5.8 Web applications,SS-8,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Audit Windows machines that have extra accounts in the Administrators group,3d2a3320-2a72-4c67-ac5f-caa40fbee2b2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains members that are not listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembers_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Monitoring,Deploy Dependency agent for Windows virtual machines,1c210e94-a481-4beb-95fa-1571b434fb04,Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VM_Deploy.json,1.3.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Service Fabric,Service Fabric clusters should only use Azure Active Directory for client authentication,b54ed75b-3e1a-44ac-a333-05ba39b99ff0,Audit usage of client authentication only via Azure Active Directory in Service Fabric,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditADAuth_Audit.json,1.1.0
NZISM Security Benchmark,Access Control and Passwords,16.1.32 System User Identification,AC-2,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.35 Methods for system user identification and authentication,AC-3,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.35 Methods for system user identification and authentication,AC-3,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.35 Methods for system user identification and authentication,AC-3,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.40 Password selection policy,AC-4,Monitoring,Deploy Dependency agent for Windows virtual machines,1c210e94-a481-4beb-95fa-1571b434fb04,Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VM_Deploy.json,1.3.0
NZISM Security Benchmark,Access Control and Passwords,16.1.40 Password selection policy,AC-4,Guest Configuration,Windows machines should meet requirements for 'Security Settings - Account Policies',f2143251-70de-4e81-87a8-36cee5a2f29d,"Windows machines should have the specified Group Policy settings in the category 'Security Settings - Account Policies' for password history, age, length, complexity, and storing passwords using reversible encryption. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecuritySettingsAccountPolicies_AINE.json,2.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.46 Suspension of access,AC-5,Monitoring,Deploy Dependency agent for Windows virtual machines,1c210e94-a481-4beb-95fa-1571b434fb04,Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VM_Deploy.json,1.3.0
NZISM Security Benchmark,Access Control and Passwords,16.1.46 Suspension of access,AC-5,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.1.46 Suspension of access,AC-5,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.2.5 Protecting compartmented information on systems,AC-7,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.2.5 Protecting compartmented information on systems,AC-7,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.2.5 Protecting compartmented information on systems,AC-7,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.2.5 Protecting compartmented information on systems,AC-7,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.3.5 Use of Privileged Accounts,AC-9,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.3.5 Use of Privileged Accounts,AC-9,Guest Configuration,Audit Windows machines that have extra accounts in the Administrators group,3d2a3320-2a72-4c67-ac5f-caa40fbee2b2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains members that are not listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembers_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.3.5 Use of Privileged Accounts,AC-9,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.3.5 Use of Privileged Accounts,AC-9,Monitoring,Deploy Dependency agent for Windows virtual machines,1c210e94-a481-4beb-95fa-1571b434fb04,Deploy Dependency agent for Windows virtual machines if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VM_Deploy.json,1.3.0
NZISM Security Benchmark,Access Control and Passwords,16.3.5 Use of Privileged Accounts,AC-9,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.6.6 Maintaining System Management Logs,AC-13,Monitoring,Azure subscriptions should have a log profile for Activity Log,7796937f-307b-4598-941c-67d3a05ebfe7,This policy ensures if a log profile is enabled for exporting activity logs. It audits if there is no log profile created to export the logs either to a storage account or to an event hub.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/Logprofile_activityLogs_Audit.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.6.7 Content of system management logs,AC-14,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NZISM Security Benchmark,Access Control and Passwords,16.6.7 Content of system management logs,AC-14,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.6.7 Content of system management logs,AC-14,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NZISM Security Benchmark,Access Control and Passwords,16.6.7 Content of system management logs,AC-14,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NZISM Security Benchmark,Access Control and Passwords,16.6.13 Event log archives,AC-15,Monitoring,Activity log should be retained for at least one year,b02aacc0-b073-424e-8298-42b22829ee0a,This policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/ActivityLogRetention_365orGreater.json,1.0.0
NZISM Security Benchmark,Access Control and Passwords,16.7.34 System Architecture and Security Controls,AC-17,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.7.34 System Architecture and Security Controls,AC-17,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Access Control and Passwords,16.7.34 System Architecture and Security Controls,AC-17,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
NZISM Security Benchmark,Cryptography,17.1.46 Reducing storage and physical transfer requirements,CR-2,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
NZISM Security Benchmark,Cryptography,17.4.16 Using TLS,CR-6,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NZISM Security Benchmark,Cryptography,17.4.16 Using TLS,CR-6,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
NZISM Security Benchmark,Cryptography,17.4.16 Using TLS,CR-6,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
NZISM Security Benchmark,Cryptography,17.4.16 Using TLS,CR-6,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
NZISM Security Benchmark,Cryptography,17.4.16 Using TLS,CR-6,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
NZISM Security Benchmark,Network security,18.1.13 Limiting network access,NS-2,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
NZISM Security Benchmark,Network security,18.1.13 Limiting network access,NS-2,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
NZISM Security Benchmark,Network security,18.1.13 Limiting network access,NS-2,Storage,Storage account public access should be disallowed,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751,"Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it.","audit, deny, disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/ASC_Storage_DisallowPublicBlobAccess_Audit.json,2.0.1-preview
NZISM Security Benchmark,Network security,18.1.13 Limiting network access,NS-2,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NZISM Security Benchmark,Network security,18.3.19 Content of a Denial of Service (DoS) response plan,NS-5,Security Center,Azure DDoS Protection Standard should be enabled,a7aca53f-2ed4-4466-a25e-0b45ade68efd,DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableDDoSProtection_Audit.json,3.0.0
NZISM Security Benchmark,Network security,18.4.10 Malicious code counter-measures,NS-7,Network,All Internet traffic should be routed via your deployed Azure Firewall,fc5e4038-4584-4632-8c85-c0448d374b2c,Azure Security Center has identified that some of your subnets aren't protected with a next generation firewall. Protect your subnets from potential threats by restricting access to them with Azure Firewall or a supported next generation firewall,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ASC_All_Internet_traffic_should_be_routed_via_Azure_Firewall.json,3.0.0-preview
NZISM Security Benchmark,Network security,18.4.10 Malicious code counter-measures,NS-7,Network,Web Application Firewall (WAF) should be enabled for Application Gateway,564feb30-bf6a-4854-b4bb-0d2d2d1e6c66,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayEnabled_Audit.json,1.0.1
NZISM Security Benchmark,Network security,18.4.10 Malicious code counter-measures,NS-7,Network,Web Application Firewall (WAF) should be enabled for Azure Front Door Service service,055aa869-bc98-4af8-bafc-23f1ab6ffe2c,"Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Enabled_Audit.json,1.0.1
NZISM Security Benchmark,Network security,18.4.10 Malicious code counter-measures,NS-7,Network,Web Application Firewall (WAF) should use the specified mode for Application Gateway,12430be1-6cc8-4527-a9a8-e3d38f250096,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Application Gateway.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AppGatewayMode_Audit.json,1.0.0
NZISM Security Benchmark,Network security,18.4.10 Malicious code counter-measures,NS-7,Network,Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service,425bea59-a659-4cbb-8d31-34499bd030b8,Mandates the use of 'Detection' or 'Prevention' mode to be active on all Web Application Firewall policies for Azure Front Door Service.,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/WAF_AFD_Mode_Audit.json,1.0.0
NZISM Security Benchmark,Data management,20.3.10 Antivirus scans,DM-4,Monitoring,Deploy Dependency agent for Windows virtual machine scale sets,3be22e3b-d919-47aa-805e-8985dbeb0ad9,"Deploy Dependency agent for Windows virtual machine scale sets if the VM Image (OS) is in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated. Note: if your scale set upgradePolicy is set to Manual, you need to apply the extension to the all virtual machines in the set by calling upgrade on them. In CLI this would be az vmss update-instances.",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DependencyAgentExtension_Windows_VMSS_Deploy.json,1.3.0
NZISM Security Benchmark,Data management,20.3.10 Antivirus scans,DM-4,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
NZISM Security Benchmark,Data management,20.3.10 Antivirus scans,DM-4,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
NZISM Security Benchmark,Data management,20.3.10 Antivirus scans,DM-4,Guest Configuration,Windows Defender Exploit Guard should be enabled on your machines,bed48b13-6647-468e-aa2f-1af1d3f4dd40,Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components that are designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks while enabling enterprises to balance their security risk and productivity requirements (Windows only).,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsDefenderExploitGuard_AINE.json,1.1.1
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,SQL,An Azure Active Directory administrator should be provisioned for SQL servers,1f314764-cb73-4fc9-b863-8eca98ac36e9,Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json,1.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
NZISM Security Benchmark,Data management,20.4.4 Database files,DM-6,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
NZISM Security Benchmark,Enterprise systems security,22.1.22 Offshore Services,ESS-2,General,Allowed locations,e56962a6-4747-49cd-b67b-bf8b01975c4c,"This policy enables you to restrict the locations your organization can specify when deploying resources. Use to enforce your geo-compliance requirements. Excludes resource groups, Microsoft.AzureActiveDirectory/b2cDirectories, and resources that use the 'global' region.",deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/AllowedLocations_Deny.json,1.0.0
NZISM Security Benchmark,Enterprise systems security,22.1.22 Offshore Services,ESS-2,General,Allowed locations for resource groups,e765b5de-1225-4ba3-bd56-1ac6695af988,This policy enables you to restrict the locations your organization can create resource groups in. Use to enforce your geo-compliance requirements.,deny,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/ResourceGroupAllowedLocations_Deny.json,1.0.0
NZISM Security Benchmark,Enterprise systems security,"22.1.26 Backup, Recovery Archiving and Data Remanence",ESS-3,Compute,Audit virtual machines without disaster recovery configured,0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56,"Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Account Management,AC-2,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Account Management,AC-2,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Account Management,AC-2,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Account Management,AC-2,Security Center,External accounts with read permissions should be removed from your subscription,5f76cf89-fbf2-47fd-a3f4-b891fa780b60,External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Account Management,AC-2,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Account Management | Role-Based Schemes,AC-2 (7),SQL,An Azure Active Directory administrator should be provisioned for SQL servers,1f314764-cb73-4fc9-b863-8eca98ac36e9,Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SQL_DB_AuditServerADAdmins_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Account Management | Role-Based Schemes,AC-2 (7),General,Audit usage of custom RBAC rules,a451c1ef-c6ca-483d-87ed-f49761e3ffb5,"Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/General/Subscription_AuditCustomRBACRoles_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Account Management | Role-Based Schemes,AC-2 (7),Service Fabric,Service Fabric clusters should only use Azure Active Directory for client authentication,b54ed75b-3e1a-44ac-a333-05ba39b99ff0,Audit usage of client authentication only via Azure Active Directory in Service Fabric,"Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditADAuth_Audit.json,1.1.0
NIST SP 800-53 R4,Access Control,Account Management | Account Monitoring / Atypical Usage,AC-2 (12),Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Information Flow Enforcement,AC-4,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Separation of Duties,AC-5,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Separation of Duties,AC-5,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
NIST SP 800-53 R4,Access Control,Separation of Duties,AC-5,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
NIST SP 800-53 R4,Access Control,Separation of Duties,AC-5,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Least Privilege | Review of User Privileges,AC-6 (7),Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Least Privilege | Review of User Privileges,AC-6 (7),Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
NIST SP 800-53 R4,Access Control,Least Privilege | Review of User Privileges,AC-6 (7),Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
NIST SP 800-53 R4,Access Control,Least Privilege | Review of User Privileges,AC-6 (7),Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
NIST SP 800-53 R4,Access Control,Security Attributes,AC-16,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-53 R4,Access Control,Security Attributes,AC-16,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
NIST SP 800-53 R4,Access Control,Remote Access | Automated Monitoring / Control,AC-17 (1),Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NIST SP 800-53 R4,Audit and Accountability,Content of Audit Records | Centralized Management of Planned Audit Record Content,AU-3 (2),Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NIST SP 800-53 R4,Audit and Accountability,Content of Audit Records | Centralized Management of Planned Audit Record Content,AU-3 (2),Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Content of Audit Records | Centralized Management of Planned Audit Record Content,AU-3 (2),Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Response to Audit Processing Failures,AU-5,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Response to Audit Processing Failures,AU-5,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-53 R4,Audit and Accountability,Response to Audit Processing Failures,AU-5,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NIST SP 800-53 R4,Audit and Accountability,Response to Audit Processing Failures,AU-5,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
NIST SP 800-53 R4,Audit and Accountability,"Audit Review, Analysis, and Reporting | Central Review and Analysis",AU-6 (4),Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NIST SP 800-53 R4,Audit and Accountability,"Audit Review, Analysis, and Reporting | Central Review and Analysis",AU-6 (4),Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,"Audit Review, Analysis, and Reporting | Central Review and Analysis",AU-6 (4),Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NIST SP 800-53 R4,Audit and Accountability,Audit Generation,AU-12,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
NIST SP 800-53 R4,Configuration Management,Least Functionality | Prevent Program Execution,CM-7 (2),Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NIST SP 800-53 R4,Configuration Management,Least Functionality | Authorized Software / Whitelisting,CM-7 (5),Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NIST SP 800-53 R4,Configuration Management,User-Installed Software,CM-11,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NIST SP 800-53 R4,Contingency Planning,Alternate Processing Site,CP-7,Compute,Audit virtual machines without disaster recovery configured,0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56,"Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc .",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/RecoveryServices_DisasterRecovery_Audit.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts,IA-2 (1),Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Identification and Authentication,Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts,IA-2 (1),Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Identification and Authentication,Identification and Authentication (Organizational Users) | Network Access to Non-Privileged Accounts,IA-2 (2),Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Audit Linux machines that do not have the passwd file permissions set to 0644,e6955644-301c-44b5-a4c4-528577de6861,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that do not have the passwd file permissions set to 0644","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword121_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Audit Windows machines that do not store passwords using reversible encryption,da0f98fe-a24b-4ad5-af69-bd0400233661,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management,IA-5,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Audit Windows machines that allow re-use of the previous 24 passwords,5b054a0d-39e2-4d53-bea3-9734cad2c69b,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that allow re-use of the previous 24 passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEnforce_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Audit Windows machines that do not have a maximum password age of 70 days,4ceb8dc2-559c-478b-a15b-733fbf1e3738,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have a maximum password age of 70 days","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsMaximumPassword_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Audit Windows machines that do not have a minimum password age of 1 day,237b38db-ca4d-4259-9e47-7882441ca2c0,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have a minimum password age of 1 day","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsMinimumPassword_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Audit Windows machines that do not have the password complexity setting enabled,bf16e0bb-31e1-4646-8202-60a235cc7e74,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have the password complexity setting enabled","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordComplexity_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Audit Windows machines that do not restrict the minimum password length to 14 characters,a2d0e922-65d0-40c4-8f87-ea6da2d307a2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not restrict the minimum password length to 14 characters","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordLength_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Audit Windows machines that do not store passwords using reversible encryption,da0f98fe-a24b-4ad5-af69-bd0400233661,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs,331e8ea8-378a-410f-a2e5-ae22f38bb0da,"This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must deployed to machines before using any Linux Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionLinux_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Identification and Authentication,Authenticator Management | Password-Based Authentication,IA-5 (1),Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-53 R4,Risk Assessment,Vulnerability Scanning,RA-5,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
NIST SP 800-53 R4,Risk Assessment,Vulnerability Scanning,RA-5,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-53 R4,Risk Assessment,Vulnerability Scanning,RA-5,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-53 R4,Risk Assessment,Vulnerability Scanning,RA-5,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
NIST SP 800-53 R4,Risk Assessment,Vulnerability Scanning,RA-5,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
NIST SP 800-53 R4,Risk Assessment,Vulnerability Scanning,RA-5,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
NIST SP 800-53 R4,System and Communications Protection,Denial of Service Protection,SC-5,Security Center,Azure DDoS Protection Standard should be enabled,a7aca53f-2ed4-4466-a25e-0b45ade68efd,DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableDDoSProtection_Audit.json,3.0.0
NIST SP 800-53 R4,System and Communications Protection,Boundary Protection,SC-7,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
NIST SP 800-53 R4,System and Communications Protection,Boundary Protection,SC-7,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
NIST SP 800-53 R4,System and Communications Protection,Boundary Protection,SC-7,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NIST SP 800-53 R4,System and Communications Protection,Boundary Protection | Access Points,SC-7 (3),Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
NIST SP 800-53 R4,System and Communications Protection,Boundary Protection | External Telecommunications Services,SC-7 (4) Ownership : Microsoft,Security Center,Management ports of virtual machines should be protected with just-in-time network access control,b0f33259-77d7-4c9e-aac6-3aabcfae693c,Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_JITNetworkAccess_Audit.json,3.0.0
NIST SP 800-53 R4,System and Communications Protection,Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection,SC-8 (1),App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-53 R4,System and Communications Protection,Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection,SC-8 (1),App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-53 R4,System and Communications Protection,Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection,SC-8 (1),Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
NIST SP 800-53 R4,System and Communications Protection,Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection,SC-8 (1),Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
NIST SP 800-53 R4,System and Communications Protection,Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection,SC-8 (1),App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-53 R4,System and Communications Protection,Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection,SC-8 (1),Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
NIST SP 800-53 R4,System and Communications Protection,Protection of Information at Rest | Cryptographic Protection,SC-28 (1),SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-53 R4,System and Communications Protection,Protection of Information at Rest | Cryptographic Protection,SC-28 (1),SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-53 R4,System and Communications Protection,Protection of Information at Rest | Cryptographic Protection,SC-28 (1),Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
NIST SP 800-53 R4,System and Communications Protection,Protection of Information at Rest | Cryptographic Protection,SC-28 (1),SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
NIST SP 800-53 R4,System and Information Integrity,Flaw Remediation,SI-2,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Flaw Remediation,SI-2,Security Center,System updates on virtual machine scale sets should be installed,c3f317a7-a95c-4547-b7e7-11017ebdf2fe,Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Flaw Remediation,SI-2,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Flaw Remediation,SI-2,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Flaw Remediation,SI-2,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Flaw Remediation,SI-2,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
NIST SP 800-53 R4,System and Information Integrity,Malicious Code Protection,SI-3,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Malicious Code Protection,SI-3,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Malicious Code Protection | Central Management,SI-3 (1),Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Malicious Code Protection | Central Management,SI-3 (1),Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
NIST SP 800-53 R4,System and Information Integrity,Information System Monitoring,SI-4,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NIST SP 800-53 R4,System and Information Integrity,Information System Monitoring,SI-4,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-53 R4,System and Information Integrity,Information System Monitoring,SI-4,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-53 R4,System and Information Integrity,Information System Monitoring,SI-4,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NIST SP 800-53 R4,System and Information Integrity,Information System Monitoring,SI-4,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Security Center,Deprecated accounts should be removed from your subscription,6b1cbf55-e8b6-442f-ba4c-7246b6381474,Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccounts_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Security Center,Deprecated accounts with owner permissions should be removed from your subscription,ebb62a0c-3560-49e1-89ed-27e074e9f8ad,Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveDeprecatedAccountsWithOwnerPermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Security Center,External accounts with owner permissions should be removed from your subscription,f8456c1c-aa66-4dfb-861a-25d127b775c9,External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWithOwnerPermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Security Center,External accounts with read permissions should be removed from your subscription,5f76cf89-fbf2-47fd-a3f4-b891fa780b60,External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsReadPermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Security Center,External accounts with write permissions should be removed from your subscription,5c607a2e-c700-4744-8254-d77e7c9eb5e4,External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_RemoveExternalAccountsWritePermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NIST SP 800-171 R2,Access Control,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",3.1.1,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
NIST SP 800-171 R2,Access Control,Control the flow of CUI in accordance with approved authorizations.,3.1.3,App Service,CORS should not allow every resource to access your Web Applications,5744710e-cc2f-4ee8-8809-3b11e89f4bc9,Cross-Origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RestrictCORSAccess_WebApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,3.1.4,Security Center,A maximum of 3 owners should be designated for your subscription,4f11b553-d42e-4e3a-89be-32ca364cad4c,It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateLessThanXOwners_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,3.1.4,Guest Configuration,Audit Windows machines missing any of specified members in the Administrators group,30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group does not contain one or more members that are listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToInclude_AINE.json,1.0.0
NIST SP 800-171 R2,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,3.1.4,Guest Configuration,Audit Windows machines that have the specified members in the Administrators group,69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if the local Administrators group contains one or more of the members listed in the policy parameter.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AdministratorsGroupMembersToExclude_AINE.json,1.0.0
NIST SP 800-171 R2,Access Control,Separate the duties of individuals to reduce the risk of malevolent activity without collusion.,3.1.4,Security Center,There should be more than one owner assigned to your subscription,09024ccc-0c5f-475e-9457-b7c0d9ed487b,It is recommended to designate more than one subscription owner in order to have administrator access redundancy.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_DesignateMoreThanOneOwner_Audit.json,3.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,Guest Configuration,Audit Linux machines that allow remote connections from accounts without passwords,ea53dbee-c6c9-4f0e-9f9e-de0039b78023,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword110_AINE.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,App Service,Remote debugging should be turned off for API Apps,e9c8d085-d9cc-4b17-9cdc-059f1f01f19e,Remote debugging requires inbound ports to be opened on API apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_ApiApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,App Service,Remote debugging should be turned off for Function Apps,0e60b895-3786-45da-8377-9c6b4b6ac5f9,Remote debugging requires inbound ports to be opened on function apps. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_FunctionApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,App Service,Remote debugging should be turned off for Web Applications,cb510bfd-1cba-4d9f-a230-cb0976f4bb71,Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json,1.0.0
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NIST SP 800-171 R2,Access Control,Monitor and control remote access sessions.,3.1.12,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.",3.3.1,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,Monitoring,[Preview]: Audit Log Analytics Agent Deployment - VM Image (OS) unlisted,32133ab0-ee4b-4b44-98d6-042180979d50,Reports VMs as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_Audit.json,1.0.0-preview
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,Monitoring,Audit Log Analytics agent deployment in virtual machine scale sets - VM Image (OS) unlisted,5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138,Reports virtual machine scale sets as non-compliant if the VM Image (OS) is not in the list defined and the agent is not installed. The list of OS images will be updated over time as support is updated.,auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_OSImage_VMSS_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,Monitoring,Audit Log Analytics workspace for VM - Report Mismatch,f47b5582-33ec-4c5c-87c0-b010a6b2e917,Reports VMs as non-compliant if they aren't logging to the Log Analytics workspace specified in the policy/initiative assignment.,audit,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/LogAnalytics_WorkspaceMismatch_VM_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,Monitoring,The Log Analytics agent should be installed on Virtual Machine Scale Sets,efbde977-ba53-4479-b8e9-10b957924fbf,This policy audits any Windows/Linux Virtual Machine Scale Sets if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VMSS_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,"Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.",3.3.2,Monitoring,The Log Analytics agent should be installed on virtual machines,a70ca396-0a34-413a-88e1-b956c1e683be,This policy audits any Windows/Linux virtual machines if the Log Analytics agent is not installed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/VirtualMachines_LogAnalyticsAgent_AuditIfNotExists.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,Alert in the event of an audit logging process failure.,3.3.4,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-171 R2,Audit and Accountability,Alert in the event of an audit logging process failure.,3.3.4,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-171 R2,Audit and Accountability,Alert in the event of an audit logging process failure.,3.3.4,Monitoring,Audit diagnostic setting,7f89b1eb-583c-429a-8828-af049802c1d9,Audit diagnostic setting for selected resource types,AuditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Monitoring/DiagnosticSettingsForTypes_Audit.json,1.0.0
NIST SP 800-171 R2,Audit and Accountability,Alert in the event of an audit logging process failure.,3.3.4,SQL,Auditing on SQL server should be enabled,a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9,Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json,2.0.0
NIST SP 800-171 R2,Configuration Management,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",3.4.7,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NIST SP 800-171 R2,Configuration Management,"Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.",3.4.8,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NIST SP 800-171 R2,Configuration Management,Control and monitor user-installed software.,3.4.9,Security Center,Adaptive application controls for defining safe applications should be enabled on your machines,47a6b606-51aa-4496-8bb7-64b11cf66adc,"Enable application controls to define the list of known-safe applications running on your machines, and alert you when other applications run. This helps harden your machines against malware. To simplify the process of configuring and maintaining your rules, Security Center uses machine learning to analyze the applications running on each machine and suggest the list of known-safe applications.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveApplicationControls_Audit.json,3.0.0
NIST SP 800-171 R2,Identification and Authentication,"Identify system users, processes acting on behalf of users, and devices.",3.5.1,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Identification and Authentication,"Identify system users, processes acting on behalf of users, and devices.",3.5.1,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Identification and Authentication,"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.",3.5.2,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.",3.5.2,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.",3.5.2,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.",3.5.2,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.",3.5.2,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
NIST SP 800-171 R2,Identification and Authentication,Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.,3.5.3,Security Center,MFA should be enabled accounts with write permissions on your subscription,9297c21d-2ed6-4474-b48f-163f75654ce3,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForWritePermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Identification and Authentication,Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.,3.5.3,Security Center,MFA should be enabled on accounts with owner permissions on your subscription,aa633080-8b72-40c4-a2d7-d00c03e80bed,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForOwnerPermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Identification and Authentication,Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.,3.5.3,Security Center,MFA should be enabled on accounts with read permissions on your subscription,e3576e28-8b17-4677-84c3-db2990658d64,Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_EnableMFAForReadPermissions_Audit.json,3.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Audit Linux machines that have accounts without passwords,f6ec09a3-78bf-4f8f-99dc-6c77182d0f99,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that have accounts without passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword232_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Audit Windows machines that do not have the password complexity setting enabled,bf16e0bb-31e1-4646-8202-60a235cc7e74,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not have the password complexity setting enabled","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordComplexity_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Audit Windows machines that do not restrict the minimum password length to 14 characters,a2d0e922-65d0-40c4-8f87-ea6da2d307a2,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not restrict the minimum password length to 14 characters","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordLength_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Enforce a minimum password complexity and change of characters when new passwords are created.,3.5.7,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
NIST SP 800-171 R2,Identification and Authentication,Prohibit password reuse for a specified number of generations.,3.5.8,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Prohibit password reuse for a specified number of generations.,3.5.8,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Prohibit password reuse for a specified number of generations.,3.5.8,Guest Configuration,Audit Windows machines that allow re-use of the previous 24 passwords,5b054a0d-39e2-4d53-bea3-9734cad2c69b,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that allow re-use of the previous 24 passwords","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEnforce_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Prohibit password reuse for a specified number of generations.,3.5.8,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Prohibit password reuse for a specified number of generations.,3.5.8,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
NIST SP 800-171 R2,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,3.5.10,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities,3cf2ab00-13f1-4d0c-8971-2ac904541a7e,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenNone_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,3.5.10,Guest Configuration,Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity,497dff13-db2a-4c0f-8603-28fa3b331ab6,"This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol .",modify,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_AddSystemIdentityWhenUser_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,3.5.10,Guest Configuration,Audit Linux machines that do not have the passwd file permissions set to 0644,e6955644-301c-44b5-a4c4-528577de6861,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Linux machines that do not have the passwd file permissions set to 0644","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_LinuxPassword121_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,3.5.10,Guest Configuration,Audit Windows machines that do not store passwords using reversible encryption,da0f98fe-a24b-4ad5-af69-bd0400233661,"Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol . Machines are non-compliant if Windows machines that do not store passwords using reversible encryption","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_WindowsPasswordEncryption_AINE.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,3.5.10,Guest Configuration,Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs,385f5831-96d4-41db-9a3c-cd3af78aaae6,"This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments and must deployed to machines before using any Windows Guest Configuration policy definition. For more information on Guest Configuration, visit https://aka.ms/gcpol .",deployIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_DeployExtensionWindows_Prerequisite.json,1.0.0
NIST SP 800-171 R2,Identification and Authentication,Store and transmit only cryptographically-protected passwords.,3.5.10,Guest Configuration,Windows machines should meet requirements for 'Security Options - Network Security',1221c620-d201-468c-81e7-2817e6107e84,"Windows machines should have the specified Group Policy settings in the category 'Security Options - Network Security' for including Local System behavior, PKU2U, LAN Manager, LDAP client, and NTLM SSP. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol .","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecurityOptionsNetworkSecurity_AINE.json,2.0.0
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,Security Center,Vulnerabilities in container security configurations should be remediated,e8cbc669-f12d-49eb-93e7-9273119e9933,Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json,3.0.0
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
NIST SP 800-171 R2,Risk Assessment,Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.,3.11.2,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.",3.13.1,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,3.13.5,Security Center,Adaptive network hardening recommendations should be applied on internet facing virtual machines,08e6af2d-db70-460a-bfe9-d5bd474ba9d6,Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_AdaptiveNetworkHardenings_Audit.json,3.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,3.13.5,Security Center,All network ports should be restricted on network security groups associated to your virtual machine,9daedab3-fb2d-461e-b861-71790eead4f6,Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnprotectedEndpoints_Audit.json,3.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,3.13.5,Security Center,Internet-facing virtual machines should be protected with network security groups,f6de0be7-9a8a-4b8a-b349-43cf02d22f7c,Protect your virtual machines from potential threats by restricting access to them with network security groups (NSG). Learn more about controlling traffic with NSGs at https://aka.ms/nsg-doc,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnInternetFacingVirtualMachines_Audit.json,3.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.,3.13.5,Storage,Storage accounts should restrict network access,34c877ad-507e-4c82-993e-3452a6e0ad3c,"Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json,1.1.1
NIST SP 800-171 R2,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,3.13.8,App Service,API App should only be accessible over HTTPS,b7ddfbdc-1260-477d-91fd-98bd9be789a6,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceApiApp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,3.13.8,App Service,Function App should only be accessible over HTTPS,6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceFunctionApp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,3.13.8,Cache,Only secure connections to your Azure Cache for Redis should be enabled,22bee202-a82f-4305-9a2a-6d7f44d4dedb,"Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cache/RedisCache_AuditSSLPort_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,3.13.8,Storage,Secure transfer to storage accounts should be enabled,404c3081-a854-4457-ae30-26a93ef643f9,"Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking","Audit, Deny, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json,2.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,3.13.8,App Service,Web Application should only be accessible over HTTPS,a4af4a39-4135-47fb-b175-47fbdf85311d,Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.,"Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json,1.0.0
NIST SP 800-171 R2,System and Communications Protection,Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.,3.13.8,Guest Configuration,Windows web servers should be configured to use secure communication protocols,5752e6d6-1206-46d8-8ab1-ecc2f71a8112,"To protect the privacy of information communicated over the Internet, your web servers should use the latest version of the industry-standard cryptographic protocol, Transport Layer Security (TLS). TLS secures communications over a network by using security certificates to encrypt a connection between machines. TLS 1.3 is faster and more secure than the earlier versions: TLS 1.0-1.2 and SSL 2-3, which are all considered legacy protocols.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Guest%20Configuration/GuestConfiguration_SecureWebProtocol_AINE.json,2.0.0
NIST SP 800-171 R2,System and Communications Protection,Protect the confidentiality of CUI at rest.,3.13.16,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-171 R2,System and Communications Protection,Protect the confidentiality of CUI at rest.,3.13.16,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-171 R2,System and Communications Protection,Protect the confidentiality of CUI at rest.,3.13.16,Security Center,Disk encryption should be applied on virtual machines,0961003e-5a0a-4549-abde-af6a37f2724d,Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json,2.0.0
NIST SP 800-171 R2,System and Communications Protection,Protect the confidentiality of CUI at rest.,3.13.16,SQL,Transparent Data Encryption on SQL databases should be enabled,17k78e20-9358-41c9-923c-fb736d382a12,Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json,1.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,A vulnerability assessment solution should be enabled on your virtual machines,501541f7-f7e7-4cd6-868c-4190fdad3ac9,"Audits virtual machines to detect whether they are running a supported vulnerability assessment solution. A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Azure Security Center's standard pricing tier includes vulnerability scanning for your virtual machines at no extra cost. Additionally, Security Center can automatically deploy this tool for you.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ServerVulnerabilityAssessment_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the API app",991310cd-e9f3-47bc-b7b6-f57b557d07db,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_HTTP_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the Function app",e2c1c086-2d84-4019-bff3-c44ccd95113c,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_HTTP_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'HTTP Version' is the latest, if used to run the Web app",8c122334-9d20-4eb8-89ea-ac9a705b74ae,"Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_HTTP_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'Java version' is the latest, if used as a part of the API app",88999f4c-376a-45c8-bcb3-4058f713cf39,"Periodically, newer versions are released for Java either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_java_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Function app",9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_java_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'Java version' is the latest, if used as a part of the Web app",496223c3-ad65-4ecd-878a-bae78737e9ed,"Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_java_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the API app",1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_PHP_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'PHP version' is the latest, if used as a part of the WEB app",7261b898-8a84-4db8-9e04-18527132abb3,"Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_Webapp_Audit_PHP_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'Python version' is the latest, if used as a part of the API app",74c3584d-afae-46f7-a20a-6f8adba71a16,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for API apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_ApiApp_Audit_python_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Function app",7238174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_FunctionApp_Audit_python_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,"Ensure that 'Python version' is the latest, if used as a part of the Web app",7008174a-fd10-4ef0-817e-fc820a951d73,"Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_WebApp_Audit_python_Latest.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version,fb893a29-21bb-418c-a157-e99480ec364c,"Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+","Audit, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UpgradeVersion_KubernetesService_Audit.json,1.0.2
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,Latest TLS version should be used in your API App,8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_ApiApp_Audit.json,1.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,Latest TLS version should be used in your Function App,f9d614c5-c173-4d56-95a7-b4437057d193,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_FunctionApp_Audit.json,1.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,App Service,Latest TLS version should be used in your Web App,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b,Upgrade to the latest TLS version,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_RequireLatestTls_WebApp_Audit.json,1.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,System updates on virtual machine scale sets should be installed,c3f317a7-a95c-4547-b7e7-11017ebdf2fe,Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingSystemUpdates_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,System updates should be installed on your machines,86b3d65f-7626-441e-b690-81a8b71cff60,Missing security system updates on your servers will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingSystemUpdates_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,Vulnerabilities in security configuration on your machines should be remediated,e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15,Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_OSVulnerabilities_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,Vulnerabilities in security configuration on your virtual machine scale sets should be remediated,3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4,Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssOSVulnerabilities_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,"Identify, report, and correct system flaws in a timely manner.",3.14.1,Security Center,Vulnerabilities on your SQL databases should be remediated,feedbf84-6b99-488c-acc2-71c829aa5ffc,Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_SQLDbVulnerabilities_Audit.json,4.0.0
NIST SP 800-171 R2,System and Information Integrity,Provide protection from malicious code at designated locations within organizational systems.,3.14.2,Security Center,Endpoint protection solution should be installed on virtual machine scale sets,26a828e1-e88f-464e-bbb3-c134a282b9de,"Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_VmssMissingEndpointProtection_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,Provide protection from malicious code at designated locations within organizational systems.,3.14.2,Compute,Microsoft IaaSAntimalware extension should be deployed on Windows servers,9b597639-28e4-48eb-b506-56b05d366257,This policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/WindowsServers_AntiMalware_AuditIfNotExists.json,1.0.0
NIST SP 800-171 R2,System and Information Integrity,Provide protection from malicious code at designated locations within organizational systems.,3.14.2,Security Center,Monitor missing Endpoint Protection in Azure Security Center,af6cd1bd-1635-48cb-bde7-5b15693900b9,Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_MissingEndpointProtection_Audit.json,3.0.0
NIST SP 800-171 R2,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",3.14.6,SQL,Advanced data security should be enabled on SQL Managed Instance,abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9,Audit each SQL Managed Instance without advanced data security.,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json,1.0.1
NIST SP 800-171 R2,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",3.14.6,SQL,Advanced data security should be enabled on your SQL servers,abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9,Audit SQL servers without Advanced Data Security,"AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",3.14.6,Security Center,Email notification to subscription owner for high severity alerts should be enabled,0b15565f-aa9e-48ba-8619-45960f2c314d,"To ensure your subscription owners are notified when there is a potential security breach in their subscription, set email notifications to subscription owners for high severity alerts in Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Email_notification_to_subscription_owner.json,2.0.0
NIST SP 800-171 R2,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",3.14.6,Network,Network Watcher should be enabled,b6e2945c-0b7b-40f5-9233-7a5323b5cdc6,"Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",auditIfNotExists,https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/NetworkWatcher_Enabled_Audit.json,1.1.0
NIST SP 800-171 R2,System and Information Integrity,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.",3.14.6,Security Center,Subscriptions should have a contact email address for security issues,4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7,"To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center.","AuditIfNotExists, Disabled",https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json,1.0.1
