Regulatory Compliance¶
Defender for Cloud's Regulatory Compliance dashboard shows how the tenant's resources measure against named standards. Each standard is an Azure Policy initiative assigned in audit mode. Its controls map to the same assessments that drive the Secure Score.
- Azure Policy (EPAC)
- Defender for Cloud Secure Score
- Access Tiering Model: where NIST SP 800-53 controls are used in the platform design.
Status: partly in place
Three standards are assigned. NIST SP 800-53, which the platform documentation cites throughout, is not yet assigned as a measured standard.
Standards assigned today¶
All are assigned through EPAC at mg-intermediate-root, audit-only.
| Standard | EPAC assignment | Why |
|---|---|---|
| Microsoft Cloud Security Benchmark v2 | psa-sec-MsftCloudSecurityBenchmarkV2 |
Microsoft's baseline for Azure. It is also the basis of the Secure Score. |
| ISO/IEC 27001 | psa-reg-Iso27001 |
A widely required information security management standard |
| Spain ENS | psa-reg-EnsSpain |
The Spanish National Security Framework |
Recommended addition: NIST SP 800-53 Rev. 5¶
The platform's design pages justify their controls with NIST SP 800-53: AC-2, AC-5, AC-6, AU-2, AU-6 and AU-11, among others. Assigning the built-in NIST SP 800-53 Rev. 5 initiative in audit mode would turn those references into measured results. That is evidence rather than a claim.
Add it as a new assignment under policyAssignments/regulatorycompliance/, following the same pattern as the ISO 27001 assignment.
Reading the dashboard¶
- A passed control isn't proof of compliance. Many controls include manual or procedural requirements that Azure can't assess. These show as "no automated assessments" and need separate evidence.
- Scores move for the same reasons as the Secure Score. New resources, new plans, benchmark updates and viewing scope all change them. See why the score jumps.
- Audit-only means detection only. A failing control stays failing until someone fixes it, or until the matching guardrail is promoted to enforcement.
Evidence sources¶
| Evidence | Where |
|---|---|
| Policy compliance state | Azure Policy and EPAC's generated documentation |
| Sign-in and directory change history | log-platform-prod, about 2 years (Entra ID Diagnostic Settings) |
| Resource change history | log-platform-prod, about 2 years (Subscription Activity Logs) |
| Access reviews | Entra ID Governance (Access Reviews) |
| Change approval | GitLab MR history |