Frameworks and Connectors
CIS Microsoft Azure Foundations Benchmark and connectors
Which connectors provide evidence for CIS Microsoft Azure Foundations Benchmark, for which controls, and how to connect them.
Safeguard's automated tests map to 85 recommendations of CIS Microsoft Azure Foundations Benchmark v2.1.0. 72 tests apply: 72 read a connected system, and 0 read Safeguard's own records (policies, people, training and devices), so they need no connector. A passing result is evidence toward a control, not proof that the control is met on its own.
A CIS benchmark is a catalogue mapping: results show on the tests, filters and evidence with their recommendation numbers, and the benchmark is not a framework in your library.
How to connect for this framework
- Connect the systems you run from the table below. Each connector links to its setup steps.
- Open Compliance › Tests and filter by the benchmark to see its results.
- Tests run on their schedule, or straight away with Run now on Compliance › Tests. A passing test counts toward its controls once its preview period has ended.
Automated tests are switched on per workspace by the Safeguard team.
Connectors with automated evidence (1)
| Connector | Controls it provides evidence for | Tests |
|---|---|---|
| Microsoft Azure (also Microsoft Entra ID, Azure Government) | 2.1.10, 2.1.12, 2.1.13, 2.1.17, 2.1.18, 2.1.19, 2.1.2, 2.1.20, 2.1.21, 2.1.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.16, 3.2, 3.3, 3.5, 3.7, 3.8, 3.9, 4.1.1, 4.1.3, 4.1.4, 4.1.6, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.5.1, 4.5.2, 4.5.3, 5.1.3, 5.1.4, 5.1.5, 5.1.7, 5.2.1, 5.2.10, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.3.1, 5.5, 6.3, 6.5, 6.6, 7.1, 7.2, 7.3, 7.4, 7.9, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 9.1, 9.10, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9 | 72 |
Recommendations (85)
| Recommendation | Title | Automated tests | Connectors |
|---|---|---|---|
2.1.2 | Defender for App Service is on | 1 | 3 |
2.1.9 | Defender for Containers is on | 1 | 3 |
2.1.10 | Defender for Key Vault is on | 1 | 3 |
2.1.12 | Defender for Resource Manager is on | 1 | 3 |
2.1.13 | The cloud security benchmark policies stay on | 1 | 3 |
2.1.17 | Subscription owners get alert emails | 1 | 3 |
2.1.18 | A security contact email is set | 1 | 3 |
2.1.19 | High-severity alerts are emailed | 1 | 3 |
2.1.20 | Defender for Cloud shares data with Defender for Cloud Apps | 1 | 3 |
2.1.21 | Defender for Cloud integrates Defender for Endpoint | 1 | 3 |
3.2 | Storage uses infrastructure encryption | 1 | 3 |
3.3 | Storage key rotation reminders are set | 1 | 3 |
3.5 | Queue service requests are logged | 1 | 3 |
3.7 | Storage public network access is off | 1 | 3 |
3.8 | Storage networks deny by default | 1 | 3 |
3.9 | Trusted Azure services can pass the storage firewall | 1 | 3 |
3.10 | Storage is reached through private endpoints | 1 | 3 |
3.11 | Blob and container soft delete are on | 2 | 3 |
3.12 | Storage holding critical data uses customer-managed keys | 1 | 3 |
3.13 | Blob service requests are logged | 1 | 3 |
3.14 | Table service requests are logged | 1 | 3 |
3.16 | Cross-tenant replication is off | 1 | 3 |
4.1.1 | SQL server auditing is on | 1 | 3 |
4.1.3 | SQL TDE protector is a customer-managed key | 1 | 3 |
4.1.4 | SQL servers have an Entra administrator | 1 | 3 |
4.1.6 | SQL audit records are kept over 90 days | 1 | 3 |
4.2.1 | Defender for SQL is on for SQL servers | 1 | 3 |
4.2.2 | SQL vulnerability assessment is set up | 1 | 3 |
4.2.3 | SQL vulnerability assessment scans on a schedule | 1 | 3 |
4.2.4 | SQL vulnerability assessment reports go to named recipients | 1 | 3 |
4.2.5 | SQL vulnerability assessment reports reach admins | 1 | 3 |
4.3.1 | PostgreSQL requires TLS | 1 | 3 |
4.3.2 | PostgreSQL logs checkpoints | 1 | 3 |
4.3.3 | PostgreSQL logs connections | 1 | 3 |
4.3.4 | PostgreSQL logs disconnections | 1 | 3 |
4.3.5 | PostgreSQL throttles failed connections | 1 | 3 |
4.3.6 | PostgreSQL keeps logs more than three days | 1 | 3 |
4.4.1 | MySQL requires TLS | 1 | 3 |
4.4.2 | MySQL allows only TLS 1.2 and later | 1 | 3 |
4.4.3 | MySQL audit log is on | 1 | 3 |
4.4.4 | MySQL audit log records connections | 1 | 3 |
4.5.1 | Cosmos DB is limited to selected networks | 1 | 3 |
4.5.2 | Cosmos DB is reached through private endpoints | 1 | 3 |
4.5.3 | Cosmos DB uses Entra ID authorization | 1 | 3 |
5.1.3 | Activity log storage is not public | 1 | 3 |
5.1.4 | Activity log storage uses a customer-managed key | 1 | 3 |
5.1.5 | Key Vault logging is on | 1 | 3 |
5.1.7 | App Service HTTP logs are collected | 1 | 3 |
5.2.1 | Policy assignment creation is alerted on | 1 | 3 |
5.2.2 | Policy assignment deletion is alerted on | 1 | 3 |
5.2.3 | NSG creation or change is alerted on | 1 | 3 |
5.2.4 | NSG deletion is alerted on | 1 | 3 |
5.2.5 | Security solution creation or change is alerted on | 1 | 3 |
5.2.6 | Security solution deletion is alerted on | 1 | 3 |
5.2.7 | SQL firewall rule changes are alerted on | 1 | 3 |
5.2.8 | SQL firewall rule deletion is alerted on | 1 | 3 |
5.2.9 | Public IP creation or change is alerted on | 1 | 3 |
5.2.10 | Public IP deletion is alerted on | 1 | 3 |
5.3.1 | Application Insights is set up | 1 | 3 |
5.5 | Basic SKUs are not used for monitored resources | 1 | 3 |
6.3 | Internet UDP access is restricted | 1 | 3 |
6.5 | Flow logs are kept at least 90 days | 1 | 3 |
6.6 | Network Watcher runs in every region in use | 1 | 3 |
7.1 | Azure Bastion is used for VM access | 1 | 3 |
7.2 | VMs use managed disks | 1 | 3 |
7.3 | VM disks are encrypted with customer-managed keys | 1 | 3 |
7.4 | Unattached disks use customer-managed keys | 1 | 3 |
7.9 | VMs use Trusted Launch | 1 | 3 |
8.1 | Keys in RBAC vaults expire | 1 | 3 |
8.2 | Keys in access-policy vaults expire | 1 | 3 |
8.3 | Secrets in RBAC vaults expire | 1 | 3 |
8.4 | Secrets in access-policy vaults expire | 1 | 3 |
8.5 | Key vaults are recoverable | 1 | 3 |
8.6 | Key vaults use Azure RBAC | 1 | 3 |
8.7 | Key vaults use private endpoints | 1 | 3 |
9.1 | App Service authentication is set up | 1 | 3 |
9.2 | Web apps redirect HTTP to HTTPS | 1 | 3 |
9.3 | Web apps use current TLS | 1 | 3 |
9.4 | Web apps require client certificates | 1 | 3 |
9.5 | Web apps use a managed identity | 1 | 3 |
9.6 | Web app PHP runtime is current | 1 | 3 |
9.7 | Web app Python runtime is current | 1 | 3 |
9.8 | Web app Java runtime is current | 1 | 3 |
9.9 | Web apps use the current HTTP version | 1 | 3 |
9.10 | Web app FTP deployments are off | 1 | 3 |
CIS AWS Foundations Benchmark and connectors
Which connectors provide evidence for CIS AWS Foundations Benchmark, for which controls, and how to connect them.
CIS Google Cloud Platform Foundations Benchmark and connectors
Which connectors provide evidence for CIS Google Cloud Platform Foundations Benchmark, for which controls, and how to connect them.