CGPulse

Sign In

NIST 800-53: Cloud Security Controls

Azure 50 automated checks

Security and privacy controls mapped to NIST SP 800-53 Rev. 5 for cloud resources

Access Control (AC)

Storage account must disable anonymous blob public access AC-3 · Critical
Key Vault should use RBAC authorization AC-3 · Medium
Container Registry must disable admin user AC-3 · High
Organization should perform periodic access reviews AC-2 · High
Organization should establish access control policies (AC-1) AC-1 · High
Organization should manage information system accounts (AC-2) AC-2 · High
Organization should enforce separation of duties (AC-5) AC-5 · High

Audit and Accountability (AU)

Organization should review and analyze audit records (AU-6) AU-6 · High

Awareness & Training (AT)

IAM password policy must require minimum length of 14 AT-2 · Medium

Awareness and Training (AT)

Organization should conduct security awareness training AT-2 · Medium
Organization should provide security awareness training (AT-2) AT-2 · High
Organization should provide role-based security training (AT-3) AT-3 · Medium

Configuration Management (CM)

Virtual Machine OS disk must use managed disks CM-7 · High
Organization should have a formal change management process CM-3 · Medium
Organization should establish configuration management policy (CM-1) CM-1 · High

Contingency Planning (CP)

IAM password policy must require minimum length of 14 CP-2 · Medium
Organization should have a business continuity and disaster recovery plan CP-2 · High
Organization should develop a contingency plan (CP-2) CP-2 · High
Organization should test the contingency plan (CP-4) CP-4 · High

Identification & Authentication (IA)

SQL Server should use Azure AD-only authentication IA-2 · High
Cosmos DB should disable local authentication IA-2 · High

Incident Response (IR)

IAM password policy must require minimum length of 14 IR-1 · Medium
Organization should have a documented incident response plan IR-1 · High
Organization should develop an incident response plan (IR-1) IR-1 · Critical
Organization should train incident response personnel (IR-2) IR-2 · High
Organization should test incident response capability (IR-3) IR-3 · High

Planning (PL)

IAM password policy must require minimum length of 14 PL-2 · Medium
Organization should develop a system security plan (PL-2) PL-2 · High

Program Management (PM)

IAM password policy must require minimum length of 14 PM-9 · Medium

Risk Assessment (RA)

IAM password policy must require minimum length of 14 RA-3 · Medium
Organization should conduct periodic risk assessments RA-3 · High
Organization should conduct risk assessments (RA-3) RA-3 · Critical
Organization should perform vulnerability scanning (RA-5) RA-5 · High

Security Assessment (CA)

Organization should conduct security assessments (CA-2) CA-2 · High
Organization should maintain a Plan of Action and Milestones (CA-5) CA-5 · High

System & Communications Protection (SC)

Storage account must enforce HTTPS transfer SC-8 · High
Storage account must use TLS 1.2 minimum SC-8 · High
Storage account must deny public network access by default SC-7 · High
Key Vault should disable public network access SC-7 · High
SQL Server should disable public network access SC-7 · High
SQL Server must use TLS 1.2 or higher SC-8 · High
Virtual Machine must enable encryption at host SC-28 · High
Container Registry should restrict public network access SC-7 · High
App Service must enforce HTTPS only SC-8 · High
App Service must use TLS 1.2 or higher SC-8 · High
App Service must disable FTP or require FTPS only SC-8 · High
Redis Cache must disable non-SSL port SC-8 · High

System & Information Integrity (SI)

Key Vault must enable soft delete SI-12 · High
Key Vault must enable purge protection SI-12 · High

System and Services Acquisition (SA)

Organization should manage supply chain risks (SA-12) SA-12 · Medium

Measure your NIST 800-53: Cloud Security Controls posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation