D9.AWS.IAM.30

Ensure that policies attached to Amazon Bedrock service roles are configured to prevent cross-service impersonation

High

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS ASD Essential Eight

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.IAM.29

Ensure that policies attached to Amazon Bedrock service roles adhere to the Principle of Least Privilege

High

New

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS ASD Essential Eight

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.CRY.08

Ensure Azure Data Factory is using a customer-managed key for encryption at rest

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.CAM.139

Machine Learning Workspace Private Link endpoints should exist and be approved

Medium

New

• Azure NIST SP 800-53 R5

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure ACSC ISM

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure AI Best Practice Ruleset

D9.AZU.CAM.141

Machine Learning Workspace should have a private endpoint

Medium

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure ISO 27017:2015

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure AI Best Practice Ruleset

D9.AZU.CAM.137

Machine Learning workspace High Business Impact should be enabled

Medium

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure NIST CSF v1.1

• Azure HIPAA

• Azure AI Best Practice Ruleset

D9.AZU.CAM.138

Ensure Databricks Workspace Private Link endpoints should exist and be approved

High

New

• Azure NIST SP 800-53 R5

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure ACSC ISM

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure AI Best Practice Ruleset

D9.AZU.CAM.140

Ensure Databricks Workspace should be in a virtual network

Medium

New

• Azure NIST SP 800-53 R5

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure ACSC ISM

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure AI Best Practice Ruleset

D9.AZU.CAM.142

Ensure the Databricks Workspace denies public IPs for Databricks clusters

High

New

• Azure NIST SP 800-53 R5

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure ACSC ISM

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure AI Best Practice Ruleset

D9.AZU.IAM.05

Machine Learning Workspace should use user-assigned managed identity

Low

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure ASD Essential Eight

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

• Azure AI Best Practice Ruleset

D9.AZU.IAM.06

Ensure Azure Data Factory should use Managed Identity for authentication

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.NET.32

Ensure a private endpoint that connects to Azure AI Search Services is configured with a private DNS zone

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure AI Best Practice Ruleset

D9.AZU.NET.34

Ensure that Azure AI Search services with public network access enabled have firewall rules configured

Medium

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.ALI.NET.08

Ensure NAT Gateway Security Protection is Enabled

Medium

New

• CloudGuard Alibaba All Rules Ruleset

D9.AWS.CRY.26

Ensure that agent session data is encrypted with Amazon KMS Customer Managed Keys (CMKs)

Medium

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.IAM.22

Ensure that SageMaker notebook instances are referencing active execution roles

Medium

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS ASD Essential Eight

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.IAM.26

Ensure that Amazon Bedrock agents are referencing active service roles

Medium

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS ASD Essential Eight

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.IAM.28

Ensure that permissions boundaries are set for IAM identities used by Amazon Bedrock

Medium

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS ENS 2022 Spain

• AWS ASD Essential Eight

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.AAA.161

Ensure that model invocation logging is enabled in the Amazon Bedrock account level settings

Medium

New

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.IAM.21

Ensure that root access is disabled for Amazon SageMaker notebook instances

High

New

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS ASD Essential Eight

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.NET.07

Ensure that network isolation is enabled for your SageMaker training jobs to prevent unauthorized access.

Medium

New

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• CloudGuard AWS All Rules Ruleset

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS NIST SP 800-172

• AWS Secure Controls Framework (SCF) v2024.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.NET.19

Ensure that SageMaker notebook instances deployed into a VPC can access required resources

Medium

New

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• CloudGuard AWS All Rules Ruleset

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS NIST SP 800-172

• AWS Secure Controls Framework (SCF) v2024.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.AAA.121

Enable network logging for Azure Databricks

Low

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ASD Essential Eight

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure SWIFT Customer Security Programme CSCF

• Azure Secure Controls Framework (SCF) v2024.1

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.CRY.05

Ensure customer-managed key is used for Azure Databricks

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.CRY.07

Use secure key management process for Azure Databricks

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.CAM.118

Establish network segment boundaries in Azure Databricks

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure ISO 27017:2015

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

D9.GCP.AAA.56

Ensure continuous monitoring of Blockchain Node Engine node state

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP FFIEC Cybersecurity Assessment Tool (CAT)

• GCP Secure Controls Framework (SCF) v2024.1

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.GCP.CRY.12

Ensure KMS key utilization for enhanced encryption in Dataform

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP NIST SP 800-172

• GCP Secure Controls Framework (SCF) v2024.1

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.GCP.CRY.14

Ensures that media is encrypted using MACsec protocol

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP NIST SP 800-172

• GCP Secure Controls Framework (SCF) v2024.1

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.GCP.NET.05

Ensure 'macsec.failOpen' option is not set

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP NIST SP 800-172

• GCP Secure Controls Framework (SCF) v2024.1

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP SOC 2 (AICPA TSC 2017 Controls)

D9.GCP.NET.11

Ensure Private Service Connect is enabled for the Blockchain Node Engine node

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP NIST SP 800-172

• GCP Secure Controls Framework (SCF) v2024.1

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

D9.GCP.OPE.09

Ensure Interconnect is active and can carry traffic

Low

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP FedRAMP R5 (moderate)

• GCP Secure Controls Framework (SCF) v2024.1

• GCP NIST SP 800-171 R2

D9.GCP.OPE.11

Ensure 'nocContactEmail' is not empty

Low

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP NIST SP 800-172

• GCP PIPEDA

• GCP Secure Controls Framework (SCF) v2024.1

• GCP ASD Essential Eight

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.ALI.IAM.19

Enforce Custom RAM Role for ROS Stack

Low

Modification

• Name

• Logic

• Severity

• Ensure access keys are rotated every 90 days or less

• RamUser where (firstAccessKey.status='Active' or secondAccessKey.status='Active') should not have (firstAccessKey.createDate before(-90, 'days') or secondAccessKey.createDate before(-90, 'days'))

• High

• Enforce Custom RAM Role for ROS Stack

• ROSStack should have ramRoleName

• Low

• Alibaba CIS Foundations Benchmark v1.0.0

• CloudGuard Alibaba All Rules Ruleset

• Alibaba ISO 27001:2022

• Alibaba NIST SP 800-53 R5

• Alibaba PCI DSS v4

• Alibaba SOC 2 (AICPA TSC 2017 Controls)

• Alibaba DORA

• Alibaba NIST CSF v2.0

• Alibaba ACSC ISM

• Alibaba NIST SP 800-172

• Alibaba Secure Controls Framework (SCF) v2024.1

• Alibaba SOX (Section 404)

• Alibaba FedRAMP R5 (moderate)

• Alibaba CMMC 2.0 v1.02

• Alibaba NY DFS 23 CRR 500

• Alibaba NIST SP 800-82 R3 (high)

• Alibaba UK Cyber Essentials

• Alibaba Security for Industrial Automation and Control Systems, Part 4-2

• Alibaba NIST SP 800-171A R3

• Alibaba NIST SP 800-161

• Alibaba Shared Assessments SIG Questionnaire

• Alibaba TISAX ISA

• Alibaba NIST SP 800-171 R3

D9.AWS.CRY.25

Ensure that inter-container traffic encryption is enabled for your SageMaker training jobs

Medium

New

• CloudGuard AWS All Rules Ruleset

D9.ALI.AAA.12

Enable logging for Simple Message Queue (SMQ) queues

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.AAA.13

Enable logging for Simple Message Queue (SMQ) topics

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.AAA.14

Ensure logging is enabled for domain activity with Cloud DNS

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.14

Ensure that PolarDB cluster requires all incoming connections to use SSL

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.15

Ensure that all PolarDB cluster have SSL auto-rotation enabled

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.16

Ensure that all PolarDB cluster endpoints use private network types

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.23

Ensure that PolarDB cluster SSL certificate has at least one month before expiration

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.IAM.22

Validate Custom Execution Role for ROS Stack Group

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.IAM.23

Validate Custom Administration Role for ROS Stack Group

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.OPE.04

Ensure all ROS Stack Status is Successful

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.AWS.CRY.168

Ensure Amazon Storage Gateway file share uses AWS KMS Keys that are customer managed for encryption

High

Modification

• Logic

• StorageGateway should have fileShares.nfsFileShares contain [ kmsEncrypted = true]

• StorageGateway should have (fileShares.nfsFileShares contain [ kmsEncrypted = true] or fileShares.smbFileShares contain [ kmsEncrypted = true])

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SOC 2 (AICPA TSC 2017 Controls)

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.OCI.CAM.27

Ensure default tags are used on resources

Low

Modification

• Logic

• TagDefault should have lifecycleState='ACTIVE' and value='${iam.principal.name}'

• TagDefault where compartmentId regexMatch /tenancy/i should have lifecycleState = 'ACTIVE' and value = '${iam.principal.name}' and tagDefinitionName = 'CreatedBy'

• OCI CIS Foundations Benchmark v1.2.0

• CloudGuard OCI All Rules Ruleset

• OCI CIS Foundations Benchmark v2.0.0

• OCI ISO 27001:2022

• OCI NIST SP 800-53 R5

• OCI HIPAA

• OCI PCI DSS v4

• OCI SOC 2 (AICPA TSC 2017 Controls)

• OCI FedRAMP R5 (low)

• OCI MPA Content Security Program

• OCI DORA

• OCI ENISA Technical Guideline on Security Measures

• OCI IEC/ISO 27701:2019

• OCI NIST CSF v2.0

• OCI ACSC ISM

• OCI FFIEC Cybersecurity Assessment Tool (CAT)

• OCI ISO 27002:2022

• OCI NIST SP 800-172

• OCI Secure Controls Framework (SCF) v2024.1

• OCI SOX (Section 404)

• OCI FedRAMP R5 (moderate)

• OCI ISO 27017:2015

• OCI NIST SP 800-171 R2

• OCI New Zealand ISM v3.6

• OCI CMMC 2.0 v1.02

• OCI NY DFS 23 CRR 500

• OCI NIST SP 800-82 R3 (high)

• OCI Security for Industrial Automation and Control Systems, Part 4-2

• OCI NIST SP 800-171A R3

• OCI NIST AI RMF

• OCI NIST Privacy Framework

• OCI SCF-Z Zero Trust Architecture (ZTA)

• OCI NIST SP 800-37

• OCI COBIT 2019

• OCI NIST SP 800-161

• OCI NIST SP 800-207

• OCI Shared Assessments SIG Questionnaire

• OCI TISAX ISA

• OCI NIST SP 800-171 R3

D9.AZU.PMT.14

Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'

Low

Modification

• Logic

• PolicyAssignment where id like '%SecurityCenterBuiltIn' should have properties.parametersCollection with [ key='systemUpdatesMonitoringEffect' and value contain-any ['AuditIfNotExists']]

• PolicyAssignment where id like '%SecurityCenterBuiltIn' should have properties.parametersCollection with [(key='systemUpdatesMonitoringEffect' and value contain-any ['AuditIfNotExists']) or (key='systemUpdatesV2MonitoringEffect' and value contain-any ['AuditIfNotExists'])]

• CloudGuard Azure All Rules Ruleset

• Azure CIS Foundations Benchmark v2.1.0

• Azure Shared Assessments SIG Questionnaire

• Azure CIS Foundations v. 3.0.0

D9.ALI.CAM.17

Ensure that CDN domain SSL certificate status is valid

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.18

Ensure that CDN domain has a valid CNAME record status

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.19

Ensure that CDN domain SSL certificate has sufficient validity period

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.20

Ensure that CDN domain has HTTPS enabled

Medium

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.21

Ensure that CDN domain has SSL certificate enabled

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CAM.22

Ensure that Cloud CDN Domain is free from configuration or check failures

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CRY.11

Ensure that SSL is Enabled for ApsaraDB Redis Instance

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CRY.13

Ensure that Encryption Key is Configured for ApsaraDB Redis Instance

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CRY.14

Ensure KMS ID is specified for encrypted disks on AnalyticDB for MySQL

Low

New

• CloudGuard Alibaba All Rules Ruleset

D9.ALI.CRY.15

Ensure SSL is enabled when using AnalyticDB for MySQL with Data Warehouse Edition

High

New

• CloudGuard Alibaba All Rules Ruleset

D9.AWS.CAM.257

S3 Bucket should not have CDK generated default name

High

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS NIST SP 800-172

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

D9.AWS.CRY.31

Ensure ElastiCache clusters have encryption for data at rest enabled

High

Modification

• Name

• Logic

• Ensure AWS ElastiCache Redis clusters have encryption for data at rest enabled

• ElastiCache where engine='redis' should have atRestEncryptionEnabled=true

• Ensure ElastiCache clusters have encryption for data at rest enabled

• ElastiCache should have atRestEncryptionEnabled=true

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS CIS Critical Security Controls v8

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS Foundational Security Best Practices (FSBP)

• AWS APRA 234

• AWS CMMC 2.0 v1.02

• AWS CRI Profile v1.2

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS RMiT Malaysia

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS CloudGuard CheckUp

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS Shared Assessments SIG Questionnaire

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS Dashboard System Ruleset

• AWS MAS TRM

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.32

Ensure ElastiCache clusters have in-transit encryption enabled

High

Modification

• Name

• Logic

• Ensure AWS ElastiCache Redis clusters have in-transit encryption enabled

• ElastiCache where engine='redis' should have transitEncryptionEnabled=true

• Ensure ElastiCache clusters have in-transit encryption enabled

• ElastiCache should have transitEncryptionEnabled=true

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS CIS Critical Security Controls v8

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS Foundational Security Best Practices (FSBP)

• AWS APRA 234

• AWS CRI Profile v1.2

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS RMiT Malaysia

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS Generally Accepted Privacy Principles (GAPP)

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-161

• AWS NIST SP 800-207

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.52

Ensure that AWS SQS is encrypted using customer-managed instead of AWS-owned KMS Key

Low

Modification

• Name

• Ensure that AWS SQS is encrypted using 'KMS Key' instead of AWS-owned 'AWS KMS Key'

• Ensure that AWS SQS is encrypted using customer-managed instead of AWS-owned KMS Key

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS Foundational Security Best Practices (FSBP)

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS CloudGuard Best Practices

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.94

Ensure OpenSearch domains are encrypted using customer managed KMS keys

High

Modification

• Name

• Severity

• Ensure that your OpenSearch domains are encrypted using KMS KMS Keys

• Low

• Ensure OpenSearch domains are encrypted using customer managed KMS keys

• High

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.AWS.CRY.113

Ensure AWS Code Artifact Domain is using encryption with customer managed KMS Key

High

Modification

• Name

• Ensure AWS Code Artifact Domain is using encryption with KMS Key

• Ensure AWS Code Artifact Domain is using encryption with customer managed KMS Key

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.AWS.CRY.117

Ensure HealthLake Datastore has data-at-rest encryption using customer managed KMS Keys

High

Modification

• Name

• Ensure HealthLake Datastore has data-at-rest encryption using KMS Keys

• Ensure HealthLake Datastore has data-at-rest encryption using customer managed KMS Keys

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS Shared Assessments SIG Questionnaire

• AWS NIST SP 800-171 R3

D9.AWS.CRY.138

Ensure AppFabric App Bundle is encrypted using customer managed KMS Key

High

Modification

• Name

• Severity

• Ensure that AppFabric App Bundle is encrypted using KMS Key

• Low

• Ensure AppFabric App Bundle is encrypted using customer managed KMS Key

• High

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.AWS.CRY.142

Ensure that Comprehend Flywheel's model is encrypted with KMS Key

High

Modification

• Severity

• Low

• High

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.AWS.CRY.143

Ensure that Comprehend Flywheel's volume is encrypted with KMS Key

High

Modification

• Severity

• Low

• High

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.AZU.CAM.88

Ensure that 'Public access level' is Disabled for Blob Containers

Critical

Modification

• Severity

• High

• Critical

• Azure CIS Foundations Benchmark v1.4.0

• Azure CIS Foundations Benchmark v1.5.0

• Azure NIST SP 800-53 R5

• Azure CIS Foundations Benchmark v2.0.0

• CloudGuard Azure All Rules Ruleset

• CloudGuard Azure Default Ruleset

• Azure CMMC 2.0 v1.02

• Azure CRI Profile v1.2

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure RMiT Malaysia

• Azure ACSC ISM

• Azure CIS Critical Security Controls v8

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure NIST SP 800-172

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure ISO 27002:2022

• Azure New Zealand ISM v3.6

• Azure MPA Content Security Program

• Azure DORA

• Azure IEC/ISO 27701:2019

• Azure NIST CSF v2.0

• Azure NIST SP 800-82 R3 (high)

• Azure China Cybersecurity Law

• Azure Spanish Royal Decree 311/2022

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure ISO/SAE 21434:2021

• Azure ISO/IEC 42001:2023

• Azure NIST Privacy Framework

• Azure SCF-Z Zero Trust Architecture (ZTA)

• Azure COBIT 2019

• Azure NIST SP 800-160 Vol. 1

• Azure NIST SP 800-161

• Azure NIST SP 800-207

• Azure Shared Assessments SIG Questionnaire

• Azure TISAX ISA

• Azure NIST SP 800-171 R3

• Azure CloudGuard Best Practices

• Azure Microsoft Cloud Security Benchmark (MCSB) v1

D9.AWS.BDR.05

Ensure ElastiCache clusters have the Multi-AZ feature enabled

High

Modification

• Name

• Logic

• Severity

• Ensure Amazon ElastiCache Redis clusters have the Multi-AZ feature enabled

• ElastiCache where engine='redis' should have replicationGroup.multiAZ.value='enabled'

• Low

• Ensure ElastiCache clusters have the Multi-AZ feature enabled

• ElastiCache should have replicationGroup.multiAZ.value='enabled'

• High

• AWS NIST SP 800-53 R5

• CloudGuard AWS All Rules Ruleset

• AWS Foundational Security Best Practices (FSBP)

• AWS APRA 234

• AWS MLPS 2.0 (Level 3)

• AWS FedRAMP R5 (moderate)

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS FedRAMP R5 (low)

• AWS DORA

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS SOC 2 (AICPA TSC 2017 Controls)

• AWS Shared Assessments SIG Questionnaire

D9.AZU.CAM.89

Ensure that 'Public access level' is Disabled for Storage Accounts with Blob Containers

Critical

Modification

• Severity

• High

• Critical

• Azure CIS Foundations Benchmark v1.5.0

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure ISO 27017:2015

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

D9.AZU.AAA.119

Ensure continuous monitoring of Resource Mover Move Resource state

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.NET.36

Ensure continuous monitoring of Network Function Manager state

Low

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.NET.08

Ensure continuous monitoring of Traffic Manager Profile state

Low

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.NET.33

Ensure public network access is disabled for Databricks Workspace

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.GCP.AAA.62

Ensure continuous monitoring of Vertex AI Search Retail Catalog state

Low

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP FFIEC Cybersecurity Assessment Tool (CAT)

• GCP Secure Controls Framework (SCF) v2024.1

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.GCP.AAA.60

Ensure continuous monitoring of Data Protection DLP Job state

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP FFIEC Cybersecurity Assessment Tool (CAT)

• GCP Secure Controls Framework (SCF) v2024.1

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.GCP.CRY.17

Ensure continuous monitoring of Vertex AI Agent Builder DS encryption state

High

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP NIST SP 800-172

• GCP Secure Controls Framework (SCF) v2024.1

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.AZU.IAM.73

Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'

Critical

Modification

• Severity

• High

• Critical

• Azure CIS Foundations Benchmark v2.0.0

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure ISO 27002:2022

• Azure New Zealand ISM v3.6

• Azure CIS Foundations Benchmark v2.1.0

• Azure EU GDPR

• Azure FedRAMP R5 (low)

• Azure MPA Content Security Program

• Azure DORA

• Azure ENISA Technical Guideline on Security Measures

• Azure Generally Accepted Privacy Principles (GAPP)

• Azure GLBA

• Azure IEC TR 60601-4-5

• Azure IEC/ISO 27701:2019

• Azure NAIC Insurance Data Security Model Law

• Azure NIST CSF v2.0

• Azure NIS 2 Directive

• Azure NIST SP 800-82 R3 (high)

• Azure UK Cyber Essentials

• Azure China Cybersecurity Law

• Azure Spanish Royal Decree 311/2022

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure NIST Privacy Framework

• Azure SCF-Z Zero Trust Architecture (ZTA)

• Azure COBIT 2019

• Azure NIST SP 800-161

• Azure NIST SP 800-207

• Azure HIPAA

• Azure OWASP Top 10 - 2021

• Azure Shared Assessments SIG Questionnaire

• Azure TISAX ISA

• Azure CIS Foundations v. 3.0.0

• Azure NIST SP 800-171 R3

D9.AWS.OPE.10

Ensure AWS Mainframe Modernization Environment Status is Healthy

Low

New

• CloudGuard AWS All Rules Ruleset

D9.AWS.OPE.11

Ensure AWS Mainframe Modernization App Version Statuses are Healthy

High

New

• CloudGuard AWS All Rules Ruleset

D9.AZU.AAA.120

Ensure Azure Health Data Workspace Statuses are Healthy

High

New

• CloudGuard Azure All Rules Ruleset

D9.AZU.NET.18

Ensure Azure Health Data Workspace Private Endpoint Connection Statuses are Healthy

Low

New

• CloudGuard Azure All Rules Ruleset

D9.AZU.NET.10

Ensure Azure Health Data Service does not have public network access

High

New

• CloudGuard Azure All Rules Ruleset

D9.AZU.NET.09

Ensure Azure Web PubSub does not have public network access

High

New

• CloudGuard Azure All Rules Ruleset

D9.AZU.NET.14

Ensure Azure Health Data Service Statuses are Healthy

Low

New

• CloudGuard Azure All Rules Ruleset

D9.AZU.NET.21

Ensure Azure Health Data Workspace Discom Service does not have public network access

High

New

• CloudGuard Azure All Rules Ruleset

D9.AZU.OPE.04

Ensure Azure Web PubSub Statuses are Healthy

Low

New

• CloudGuard Azure All Rules Ruleset

D9.TF.AWS.CRY.51

Ensure that AWS SNS topic is encrypted using Customer-managed KMS Key instead of AWS-owned KMS Key

Low

Modification

• Name

• Ensure that AWS SNS topic is encrypted using KMS Key instead of AWS-owned AWS KMS Key

• Ensure that AWS SNS topic is encrypted using Customer-managed KMS Key instead of AWS-owned KMS Key

• Terraform CIS AWS Foundations Benchmarks

D9.TF.AWS.CRY.52

Ensure that AWS SQS is encrypted using Customer-managed KMS Key instead of AWS-owned key

Low

Modification

• Name

• Ensure that AWS SQS is encrypted using KMS Key instead of AWS-owned key

• Ensure that AWS SQS is encrypted using Customer-managed KMS Key instead of AWS-owned key

• Terraform CIS AWS Foundations Benchmarks

D9.AZU.VTM.15

Ensure that Microsoft Defender for Container Registries is set to 'On'

High

Removal

• Azure CIS Foundations Benchmark v1.4.0

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CRI Profile v1.2

• Azure FedRAMP R5 (moderate)

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure DORA

• Azure NIST CSF v2.0

• Azure NIST SP 800-82 R3 (high)

• Azure NIST CSF v1.1

• Azure OWASP Top 10 - 2021

• Azure Shared Assessments SIG Questionnaire

• Azure CloudGuard Best Practices

• Azure Microsoft Cloud Security Benchmark (MCSB) v1

• Azure CIS Foundations Benchmark v1.3.0

• Azure CIS Foundations Benchmark v1.3.1

D9.AWS.AAA.160

Ensure continuous monitoring of Direct Connect Connection state

Low

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AWS.OPE.05

Ensure continuous monitoring of Fault Injection Simulator Experiment state

High

New

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ENS 2022 Spain

• AWS ASD Essential Eight

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS PIPEDA

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

• AWS SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.CAM.88

Ensure that 'Public access level' is Disabled for Blob Containers

High

Modification

• Logic

• Severity

• StorageBlobContainer should not have publicAccess in ('Blob', 'Container')

• Medium

• StorageBlobContainer where id split('/') getValue(8) in (getResources('StorageAccount') with [ allowBlobPublicAccess=true ] getValues('name') ) should not have publicAccess in ('Blob', 'Container')

• High

• Azure CIS Foundations Benchmark v1.4.0

• Azure CIS Foundations Benchmark v1.5.0

• Azure NIST SP 800-53 R5

• Azure CIS Foundations Benchmark v2.0.0

• CloudGuard Azure All Rules Ruleset

• CloudGuard Azure Default Ruleset

• Azure CMMC 2.0 v1.02

• Azure CRI Profile v1.2

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure RMiT Malaysia

• Azure ACSC ISM

• Azure CIS Critical Security Controls v8

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure NIST SP 800-172

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure ISO 27002:2022

• Azure New Zealand ISM v3.6

• Azure MPA Content Security Program

• Azure DORA

• Azure IEC/ISO 27701:2019

• Azure NIST CSF v2.0

• Azure NIST SP 800-82 R3 (high)

• Azure China Cybersecurity Law

• Azure Spanish Royal Decree 311/2022

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure ISO/SAE 21434:2021

• Azure ISO/IEC 42001:2023

• Azure NIST Privacy Framework

• Azure SCF-Z Zero Trust Architecture (ZTA)

• Azure COBIT 2019

• Azure NIST SP 800-160 Vol. 1

• Azure NIST SP 800-161

• Azure NIST SP 800-207

• Azure Shared Assessments SIG Questionnaire

• Azure TISAX ISA

• Azure NIST SP 800-171 R3

• Azure CloudGuard Best Practices

• Azure Microsoft Cloud Security Benchmark (MCSB) v1

D9.AWS.NET.06

Ensure that AWS Direct Connect Connection has encryption enabled

High

New

• AWS NIST SP 800-53 R5

• CloudGuard AWS All Rules Ruleset

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS FedRAMP R5 (moderate)

• AWS Secure Controls Framework (SCF) v2024.1

D9.AWS.OPE.08

Ensure continuous monitoring of Direct Connect Virtual Interface state

High

New

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• CloudGuard AWS All Rules Ruleset

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS FedRAMP R5 (moderate)

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

D9.AZU.AAA.123

Ensure continuous monitoring of Managed Grafana state

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.AAA.122

Ensure continuous monitoring of HDS Deid Service state

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.AAA.118

Ensure continuous monitoring of Managed Applications Application state

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.AZU.NET.25

Ensure public network access is disabled for Managed Grafana

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure FFIEC Cybersecurity Assessment Tool (CAT)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.NET.06

Disable public network access for HDS Deid Service

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

D9.AZU.OPE.03

Ensure 'skipVerify' is disabled for SMTP in Managed Grafana

High

New

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure ENS 2022 Spain

• Azure ASD Essential Eight

• Azure CMMC 2.0 v1.02

• Azure NIST SP 800-171 R2

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure SWIFT Customer Security Programme CSCF

• Azure NIST SP 800-172

• Azure PIPEDA

• Azure Secure Controls Framework (SCF) v2024.1

• Azure EU GDPR

• Azure NIST CSF v1.1

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure HIPAA

D9.GCP.AAA.55

Ensure continuous monitoring of Firebase Hosting Site state

Low

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP FFIEC Cybersecurity Assessment Tool (CAT)

• GCP Secure Controls Framework (SCF) v2024.1

• GCP NIST SP 800-171 R2

• GCP NY DFS 23 CRR 500

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.GCP.OPE.14

Ensure continuous monitoring of Migrate to Virtual Machines Source state

Medium

New

• GCP NIST SP 800-53 R5

• GCP PCI DSS v4

• CloudGuard GCP All Rules Ruleset

• GCP CSA CCM v4

• GCP ENS 2022 Spain

• GCP ACSC ISM

• GCP FedRAMP R5 (moderate)

• GCP ISO 27017:2015

• GCP SWIFT Customer Security Programme CSCF

• GCP NIST SP 800-172

• GCP PIPEDA

• GCP Secure Controls Framework (SCF) v2024.1

• GCP ASD Essential Eight

• GCP CMMC 2.0 v1.02

• GCP NIST SP 800-171 R2

• GCP NIST CSF v1.1

• GCP SOC 2 (AICPA TSC 2017 Controls)

• GCP HIPAA

• GCP EU GDPR

D9.AZU.PMT.06

Ensure that 'Java version' is the latest, if used to run the Linux Web App (Linux)

Low

Modification

• Logic

• WebApp where config.linuxFxVersion regexMatch /JAVA/ should have config.linuxFxVersion regexMatch /[1-2][1-9]/

• WebApp where config.linuxFxVersion regexMatch /JAVA/ should have config.linuxFxVersion in ($Java_Supported_Versions)

• Azure CIS Foundations Benchmark v1.4.0

• Azure CIS Foundations Benchmark v1.5.0

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure APRA 234

• Azure ISO 27001:2022

• Azure ASD Essential Eight

• Azure ACSC ISM

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure DORA

• Azure NIST CSF v2.0

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure Shared Assessments SIG Questionnaire

• Azure CloudGuard Best Practices

• Azure CIS Foundations Benchmark v1.2.0

• Azure CIS Foundations Benchmark v1.3.0

• Azure CIS Foundations Benchmark v1.3.1

D9.AZU.PMT.07

Ensure that 'PHP version' is the latest, if used to run a Linux Web App (Linux)

Low

Modification

• Logic

• WebApp where config.linuxFxVersion regexMatch /PHP/ should have config.linuxFxVersion regexMatch /(8\x2e[2-9]|9\x2e[0-9])/

• WebApp where config.linuxFxVersion regexMatch /PHP/ should have config.linuxFxVersion in ($PHP_Supported_Versions)

• Azure CIS Foundations Benchmark v1.4.0

• Azure CIS Foundations Benchmark v1.5.0

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• CIS Microsoft Azure Compute Services Benchmark v1.0.0

• Azure APRA 234

• Azure ISO 27001:2022

• Azure ASD Essential Eight

• Azure ACSC ISM

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure DORA

• Azure NIST CSF v2.0

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure Shared Assessments SIG Questionnaire

• Azure CloudGuard Best Practices

• Azure CIS Foundations Benchmark v1.2.0

• Azure CIS Foundations Benchmark v1.3.0

• Azure CIS Foundations Benchmark v1.3.1

D9.AZU.PMT.08

Ensure that 'Python version' is the latest stable version, if used to run a Linux Web App (Linux)

Low

Modification

• Logic

• WebApp where config.linuxFxVersion regexMatch /PYTHON/ should have config.linuxFxVersion regexMatch /(3\x2e([8-9]|1[0-9]))/

• WebApp where config.linuxFxVersion regexMatch /PYTHON/ should have config.linuxFxVersion in ($Python_Supported_Versions)

• Azure CIS Foundations Benchmark v1.4.0

• Azure CIS Foundations Benchmark v1.5.0

• Azure CIS Foundations Benchmark v2.0.0

• CloudGuard Azure All Rules Ruleset

• CIS Microsoft Azure Compute Services Benchmark v1.0.0

• Azure APRA 234

• Azure ISO 27001:2022

• Azure MLPS 2.0 (Level 3)

• Azure ASD Essential Eight

• Azure RMiT Malaysia

• Azure ACSC ISM

• Azure CIS Critical Security Controls v8

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure CIS Foundations Benchmark v2.1.0

• Azure DORA

• Azure NIST CSF v2.0

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure Shared Assessments SIG Questionnaire

• Azure CloudGuard Best Practices

• Azure CIS Foundations Benchmark v1.2.0

• Azure CIS Foundations Benchmark v1.3.0

• Azure CIS Foundations Benchmark v1.3.1

D9.AZU.PMT.09

Ensure that 'Java version' is the latest, if used to run the Web App (Windows)

Low

Modification

• Logic

• WebApp where not config.javaVersion isEmpty() should have config.javaVersion>=11

• WebApp where not config.javaVersion isEmpty() should have config.javaVersion in ($Java_Supported_Versions)

• Azure CIS Foundations Benchmark v1.4.0

• Azure CIS Foundations Benchmark v1.5.0

• Azure NIST SP 800-53 R5

• Azure PCI DSS v4

• Azure CIS Foundations Benchmark v2.0.0

• CloudGuard Azure All Rules Ruleset

• CIS Microsoft Azure Compute Services Benchmark v1.0.0

• Azure APRA 234

• Azure ISO 27001:2022

• Azure MLPS 2.0 (Level 3)

• Azure ASD Essential Eight

• Azure RMiT Malaysia

• Azure ACSC ISM

• Azure CIS Critical Security Controls v8

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure CIS Foundations Benchmark v2.1.0

• Azure DORA

• Azure NIST CSF v2.0

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure Shared Assessments SIG Questionnaire

• Azure CloudGuard Best Practices

• Azure CIS Foundations Benchmark v1.2.0

• Azure CIS Foundations Benchmark v1.3.0

• Azure CIS Foundations Benchmark v1.3.1

D9.AWS.OPE.18

Ensure continuous monitoring of CodeDeploy Deploy state

Low

New

• AWS NIST SP 800-53 R5

• CloudGuard AWS All Rules Ruleset

• AWS NIST SP 800-171 R2

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS Secure Controls Framework (SCF) v2024.1

• AWS NIST CSF v1.1

D9.AZU.CAM.136

Ensure Azure Batch Account pools are deployed in a specific subnet

High

New

• Azure NIST SP 800-53 R5

• CloudGuard Azure All Rules Ruleset

• Azure CMMC 2.0 v1.02

• Azure ACSC ISM

• Azure NIST SP 800-172

• Azure Secure Controls Framework (SCF) v2024.1

D9.AZU.CAM.38

Ensure there is more than one owner assigned to your Microsoft Azure subscription

High

Modification

• Logic

• List<RoleAssignment> where items with [getResources('RoleDefinition', properties.roleDefinitionId, 'id' ) getValues('properties.roleName') contain [ 'Owner' ]] should have length() >=2

• List<User> should have items with [ assignmentRoles with [ roleName like 'Owner' ] ] length() >= 2

• Azure PCI DSS v4

• CloudGuard Azure All Rules Ruleset

• Azure CSA CCM v4

• Azure NIST SP 800-171 R2

• Azure NY DFS 23 CRR 500

• Azure ACSC ISM

• Azure FedRAMP R5 (moderate)

• Azure ISO 27017:2015

• Azure NIST SP 800-172

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure ISO 27002:2022

• Azure New Zealand ISM v3.6

• Azure EU GDPR

• Azure DORA

• Azure ENISA Technical Guideline on Security Measures

• Azure NAIC Insurance Data Security Model Law

• Azure NIST CSF v2.0

• Azure NIS 2 Directive

• Azure Spanish Royal Decree 311/2022

• Azure NIST AI RMF

• Azure NIST Privacy Framework

• Azure SCF-Z Zero Trust Architecture (ZTA)

• Azure NIST SP 800-37

• Azure SOC 2 (AICPA TSC 2017 Controls)

• Azure COBIT 2019

• Azure NIST SP 800-161

• Azure NIST SP 800-207

• Azure Shared Assessments SIG Questionnaire

• Azure TISAX ISA

• Azure NIST SP 800-171 R3

D9.OCI.NET.03

Ensure the default security list of every VCN restricts all traffic except ICMP

High

Modification

• Logic

• SecurityList where name regexMatch /Default.*vcn/i should have ingressSecurityRules contain-none [ tcpOptions or udpOptions or protocol !='1' or icmpOptions isEmpty() ]

• SecurityList where compartmentId != getResource('Compartment', 'ManagedCompartmentForPaaS', 'name').id and name regexMatch /Default.*vcn/i should have ingressSecurityRules contain-none [ tcpOptions or udpOptions or protocol !='1' or icmpOptions isEmpty() ]

• OCI CIS Foundations Benchmark v1.2.0

• CloudGuard OCI All Rules Ruleset

• OCI CIS Foundations Benchmark v2.0.0

• OCI ISO 27001:2022

• OCI NIST SP 800-53 R5

• OCI HIPAA

• OCI PCI DSS v4

• OCI SOC 2 (AICPA TSC 2017 Controls)

• OCI MPA Content Security Program

• OCI DORA

• OCI IEC/ISO 27701:2019

• OCI NIST CSF v2.0

• OCI ISO 27002:2022

• OCI Secure Controls Framework (SCF) v2024.1

• OCI SOX (Section 404)

• OCI FedRAMP R5 (moderate)

• OCI ISO 27017:2015

• OCI NIST SP 800-171 R2

• OCI SWIFT Customer Security Programme CSCF

• OCI New Zealand ISM v3.6

• OCI CMMC 2.0 v1.02

• OCI NY DFS 23 CRR 500

• OCI NIST SP 800-82 R3 (high)

• OCI UK Cyber Essentials

• OCI Spanish Royal Decree 311/2022

• OCI NIST Privacy Framework

• OCI SCF-Z Zero Trust Architecture (ZTA)

• OCI COBIT 2019

• OCI NIST SP 800-161

• OCI NIST SP 800-207

• OCI Shared Assessments SIG Questionnaire

• OCI TISAX ISA

• OCI NIST SP 800-171 R3

D9.AZU.PMT.03

Ensure that PostgreSQL database servers are using the latest major version of PostgreSQL database

High

Modification

• Logic

• PostgreSQL should have version='11'

• PostgreSQL should have version in ($SQL_POSTGRES_Supported_Versions)

• CloudGuard Azure All Rules Ruleset

• Azure ASD Essential Eight

• Azure ACSC ISM

• Azure SOX (Section 404)

• Azure Secure Controls Framework (SCF) v2024.1

• Azure DORA

• Azure NIST CSF v2.0

• Azure Security for Industrial Automation and Control Systems, Part 4-2

• Azure Shared Assessments SIG Questionnaire

D9.GCP.PMT.04

Ensure that PostgreSQL database servers are using the latest major version of PostgreSQL database

Low

Modification

• Logic

• CloudSql where databaseVersion regexMatch /POSTGRES.*/ should have databaseVersion regexMatch /POSTGRES_(1[5-9]|[2-9]\d+|\d{3,})/

• CloudSql where databaseVersion regexMatch /POSTGRES.*/ should have databaseVersion in ($SQL_POSTGRES_Supported_Versions)

• CloudGuard GCP All Rules Ruleset

• GCP CIS Critical Security Controls v8

• GCP APRA 234

• GCP ACSC ISM

• GCP SOX (Section 404)

• GCP Secure Controls Framework (SCF) v2024.1

• GCP ASD Essential Eight

• GCP DORA

• GCP NIST CSF v2.0

• GCP Security for Industrial Automation and Control Systems, Part 4-2

• GCP Shared Assessments SIG Questionnaire

D9.AWS.AAA.44

Ensure KMS Key configuration changes are being monitored using CloudWatch alarms

Medium

Modification

• Name

• Ensure AWS CMK configuration changes are being monitored using CloudWatch alarms

• Ensure KMS Key configuration changes are being monitored using CloudWatch alarms

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS PCI DSS v4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS NIST SP 800-171 R2

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS DORA

• AWS NIST CSF v2.0

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS COBIT 2019

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

D9.AWS.AAA.74

Ensure disabling or scheduled deletion of KMS Keys is monitored

Low

Modification

• Name

• Ensure disabling or scheduled deletion of customer created CMKs is monitored

• Ensure disabling or scheduled deletion of KMS Keys is monitored

• AWS HIPAA

• AWS LGPD

• AWS NIST SP 800-53 R5

• AWS CIS Foundations Benchmark v1.5.0

• AWS MITRE ATT&CK Framework v11.3

• AWS CIS Foundations Benchmark v1.1.0

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS NIST SP 800-53 R4

• AWS CSA CCM v4

• AWS CIS Foundations Benchmark v2.0.0

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS ENS 2022 Spain

• AWS MLPS 2.0 (Level 3)

• AWS PCI DSS v3.2.1

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS CSA CCM v3

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS CIS Foundations Benchmark v3.0.0

• AWS FedRAMP R5 (low)

• AWS DORA

• AWS ENISA Technical Guideline on Security Measures

• AWS CIS Foundations Benchmark v1.0.0

• AWS ISO 27001:2013

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Spanish Royal Decree 311/2022

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS ISO/SAE 21434:2021

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-37

• AWS COBIT 2019

• AWS NIST SP 800-161

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS CIS Foundations Benchmark v1.2.0

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS CIS Foundations Benchmark v4.0.0

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS CCPA

• AWS MAS TRM

• AWS NIST SP 800-171 R1

• AWS CIS Foundations Benchmark v1.3.0

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS CIS Foundations Benchmark v1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.03

Ensure that S3 Buckets are encrypted with KMS Key

Medium

Modification

• Name

• Ensure that S3 Buckets are encrypted with CMK

• Ensure that S3 Buckets are encrypted with KMS Key

• AWS HIPAA

• CloudGuard AWS Dashboards

• AWS LGPD

• AWS CloudGuard S3 Bucket Security

• AWS NIST SP 800-53 R5

• AWS CIS Foundations Benchmark v1.5.0

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS NIST SP 800-53 R4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS APRA 234

• AWS MLPS 2.0 (Level 3)

• AWS CMMC 2.0 v1.02

• AWS PCI DSS v3.2.1

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS CSA CCM v3

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS FFIEC Cybersecurity Assessment Tool (CAT)

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS ISO 27001:2013

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS Shared Assessments SIG Questionnaire

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS Dashboard System Ruleset

• AWS CCPA

• AWS MAS TRM

• AWS NIST SP 800-171 R1

• AWS CIS Foundations Benchmark v1.3.0

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS CIS Foundations Benchmark v1.4.0

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.15

Use KMS Keys for Redshift clusters

High

Modification

• Name

• Use KMS CMK customer-managed keys for Redshift clusters

• Use KMS Keys for Redshift clusters

• AWS HIPAA

• AWS Security Risk Management

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS NIST SP 800-53 R4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS Foundational Security Best Practices (FSBP)

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS PCI DSS v3.2.1

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS CSA CCM v3

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS ISO 27001:2013

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS CloudGuard CheckUp

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM

• AWS NIST SP 800-171 R1

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.21

AWS Kinesis streams are encrypted with KMS Key

Low

Modification

• Name

• AWS Kinesis streams are encrypted with customer managed CMK

• AWS Kinesis streams are encrypted with KMS Key

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS NIST SP 800-53 R4

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS PCI DSS v3.2.1

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS CSA CCM v3

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS ISO 27001:2013

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS CloudGuard CheckUp

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM

• AWS NIST SP 800-171 R1

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.23

Ensure that your Amazon EFS file systems are encrypted using KMS Keys

Low

Modification

• Name

• Ensure that your Amazon EFS file systems are encrypted using KMS CMK customer-managed keys

• Ensure that your Amazon EFS file systems are encrypted using KMS Keys

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS NIST SP 800-53 R4

• AWS CIS Critical Security Controls v8

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS Foundational Security Best Practices (FSBP)

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS PCI DSS v3.2.1

• AWS CRI Profile v1.2

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS RMiT Malaysia

• AWS CSA CCM v3

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS ISO 27001:2013

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM

• AWS NIST SP 800-171 R1

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.30

Ensure AWS DynamoDB is encrypted using KMS Key that is customer-managed

Low

Modification

• Name

• Ensure that AWS DynamoDB is encrypted using customer-managed CMK

• Ensure AWS DynamoDB is encrypted using KMS Key that is customer-managed

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS CloudGuard CheckUp

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10

D9.AWS.CRY.36

Ensure SageMaker notebook instance storage volumes are encrypted with KMS Keys that are customer-managed

High

Modification

• Name

• Ensure SageMaker notebook instance storage volumes are encrypted with Amazon KMS Customer Master Keys (CMKs)

• Ensure SageMaker notebook instance storage volumes are encrypted with KMS Keys that are customer-managed

• AWS HIPAA

• AWS NIST SP 800-53 R5

• AWS MITRE ATT&CK Framework v11.3

• AWS PCI DSS v4

• AWS HITRUST CSF v11.0

• AWS CSA CCM v4

• CloudGuard AWS All Rules Ruleset

• AWS EU GDPR

• AWS ISO 27001:2022

• AWS APRA 234

• AWS ENS 2022 Spain

• AWS CMMC 2.0 v1.02

• AWS NIST SP 800-171 R2

• AWS NY DFS 23 CRR 500

• AWS New Zealand ISM v3.6

• AWS ACSC ISM

• AWS FedRAMP R5 (moderate)

• AWS ISO 27017:2015

• AWS SWIFT Customer Security Programme CSCF

• AWS NIST SP 800-172

• AWS SOX (Section 404)

• AWS Secure Controls Framework (SCF) v2024.1

• AWS ISO 27002:2022

• AWS FedRAMP R5 (low)

• AWS MPA Content Security Program

• AWS DORA

• AWS GLBA

• AWS IEC/ISO 27701:2019

• AWS NAIC Insurance Data Security Model Law

• AWS NIST CSF v2.0

• AWS NIS 2 Directive

• AWS NIST SP 800-82 R3 (high)

• AWS NIST CSF v1.1

• AWS Security for Industrial Automation and Control Systems, Part 4-2

• AWS NIST SP 800-171A R3

• AWS NIST Privacy Framework

• AWS SCF-Z Zero Trust Architecture (ZTA)

• AWS NIST SP 800-207

• AWS OWASP Top 10 - 2021

• AWS Shared Assessments SIG Questionnaire

• AWS TISAX ISA

• AWS NIST SP 800-171 R3

• AWS Well-Architected Framework

• AWS CloudGuard Best Practices

• AWS MAS TRM

• AWS HITRUST CSF v9.2

• AWS ITSG-33 Canada

• AWS MITRE ATT&CK Framework v10