CGPulse

Sign In

Critical Security Controls v8

Azure 36 automated checks

Critical security controls v8 mapped to cloud resource configurations

Access Management

Key Vault should use RBAC authorization 6.8 · Medium
AKS cluster must enable RBAC 6.8 · Critical

Account Management

SQL Server should use Azure AD-only authentication 5.1 · High
Cosmos DB should disable local authentication 5.3 · High

Application Security

IAM password policy must require minimum length of 14 16.1 · Medium
App Service must enforce HTTPS only 16.11 · High

Asset Inventory

Virtual Machine OS disk must use managed disks 1.1 · High
Container Registry must not allow anonymous pull for asset control 1.2 · High

Audit Log Management

Key Vault should disable public network access 8.2 · High

CIS 10: Malware Defenses

Organization should deploy and maintain anti-malware software CIS 10.1 · High

CIS 11: Data Recovery

Organization should establish a data recovery process CIS 11.1 · High

CIS 13: Network Monitoring

Organization should establish network monitoring and defense CIS 13.1 · Medium

CIS 14: Security Awareness

Organization should establish a security awareness program CIS 14.1 · High

CIS 17: Incident Response

Organization should establish an incident response program CIS 17.1 · Critical

CIS 18: Penetration Testing

Organization should conduct penetration testing CIS 18.1 · High

CIS 1: Enterprise Asset Inventory

Organization should maintain an inventory of enterprise hardware assets CIS 1.1 · High

CIS 2: Software Asset Inventory

Organization should maintain an inventory of enterprise software assets CIS 2.1 · High

CIS 3: Data Protection

Organization should establish a data management process CIS 3.1 · High

CIS 4: Secure Configuration

Organization should establish a secure configuration process CIS 4.1 · High

CIS 5: Account Management

Organization should establish an account management process CIS 5.1 · High

CIS 6: Access Control

Organization should establish an access control process CIS 6.1 · High

CIS 8: Audit Log Management

Organization should establish an audit log management process CIS 8.1 · High

CIS 9: Email and Web Browser

Organization should implement email security protections CIS 9.1 · Medium

Data Protection

Storage account must disable anonymous blob public access 3.3 · Critical
Storage account should use customer-managed keys 3.11 · Medium
Virtual Machine must enable encryption at host 7.3 · High

Data Recovery

Key Vault must enable purge protection 11.2 · High

Email & Browser Protections

IAM password policy must require minimum length of 14 9.2 · Medium

Incident Response

IAM password policy must require minimum length of 14 17.1 · Medium

Malware Defenses

Virtual Machine must have endpoint protection installed 10.1 · High

Network Monitoring

AKS cluster should be a private cluster 13.4 · High

Secure Configuration

Storage account must use TLS 1.2 minimum 4.1 · High
App Service must disable FTP or require FTPS only 4.8 · High
Redis Cache must disable non-SSL port 4.8 · High

Security Awareness Training

IAM password policy must require minimum length of 14 14.1 · Medium

Software Inventory

Container Registry must disable admin user 2.3 · High

Measure your Critical Security Controls v8 posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation