CGPulse

Sign In

ISO 27001: Information Security

Azure 54 automated checks

Information security management controls aligned with ISO/IEC 27001:2022 Annex A

Access Control (A.9)

Storage account must disable anonymous blob public access A.9.1.2 · Critical
Key Vault should use RBAC authorization A.9.2.3 · Medium
SQL Server should use Azure AD-only authentication A.9.2.1 · High
Cosmos DB should disable local authentication A.9.4.2 · High
Container Registry must disable admin user A.9.2.3 · High
AKS cluster must enable RBAC A.9.1.2 · Critical
Organization should perform periodic access reviews A.9.2.5 · High

Asset Management (A.8)

Key Vault must enable purge protection A.8.2.3 · High
IAM password policy must require minimum length of 14 A.8.1 · Medium
Organization should conduct periodic risk assessments A.8.2.1 · High
Organization should maintain a data classification policy A.8.2.1 · Medium

Business Continuity (A.17)

Organization should have a business continuity and disaster recovery plan A.17.1.1 · High

Communications Security (A.13)

Key Vault should disable public network access A.13.1.1 · High
SQL Server should disable public network access A.13.1.1 · High
Cosmos DB should disable public network access A.13.1.1 · High
AKS cluster should be a private cluster A.13.1.1 · High

Cryptography (A.10)

Storage account must enforce HTTPS transfer A.10.1.1 · High
Storage account must use TLS 1.2 minimum A.10.1.1 · High
Storage account should use customer-managed keys A.10.1.2 · Medium
App Service must enforce HTTPS only A.10.1.1 · High
Redis Cache must use TLS 1.2 minimum A.10.1.1 · High
PostgreSQL should disable public network access A.10.1.1 · High

Human Resource Security (A.7)

Organization should conduct security awareness training A.7.2.2 · Medium
Organization should implement HR security controls A.7.1.1 · Medium

Information Security Incident Management (A.16)

Organization should have a documented incident response plan A.16.1 · High

ISMS Audit

Organization should conduct internal information security audits 9.2 · High

Operations Security (A.12)

App Service should enable HTTP/2 A.12.6.1 · Low
Organization should have a formal change management process A.12.1.2 · Medium

Organizational Controls (A.5)

IAM password policy must require minimum length of 14 A.5.1 · Medium
IAM password policy must require minimum length of 14 A.5.24 · Medium
IAM password policy must require minimum length of 14 A.5.29 · Medium
IAM password policy must require minimum length of 14 A.5.31 · Medium
Organization should maintain an information security policy approved by management A.5.1 · High
Organization should define information security roles and responsibilities A.5.2 · High
Organization should maintain contact with relevant authorities A.5.5 · Medium
Organization should collect and analyze threat intelligence A.5.7 · Medium
Organization should integrate security into project management A.5.8 · Medium
Organization should maintain an inventory of information assets A.5.9 · High
Organization should classify information according to confidentiality requirements A.5.12 · High
Organization should manage information security in supplier relationships A.5.19 · High
Organization should establish incident management procedures A.5.24 · Critical
Organization should have procedures for evidence collection and preservation A.5.28 · Medium
Organization should integrate security into business continuity management A.5.29 · High
Organization should identify applicable legal and regulatory requirements A.5.31 · High

People Controls (A.6)

IAM password policy must require minimum length of 14 A.6.3 · Medium
Organization should perform personnel screening A.6.1 · Medium
Organization should provide information security awareness and training A.6.3 · High
Organization should have a disciplinary process for security violations A.6.4 · Medium
Organization should define security responsibilities upon termination A.6.5 · High

Physical Controls (A.7)

Organization should define and protect physical security perimeters A.7.1 · Medium
Organization should implement clear desk and clear screen policies A.7.7 · Low
Organization should manage removable media securely A.7.10 · Medium

Physical Security (A.11)

Organization should implement physical security controls A.11.1.1 · Medium

Supplier Relationships (A.15)

Organization should assess third-party vendor security A.15.1.1 · Medium

Measure your ISO 27001: Information Security posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation