/
faq-regulatory-compliance.yml
130 lines (86 loc) · 8.73 KB
/
faq-regulatory-compliance.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
### YamlMime:FAQ
metadata:
title: Common questions - regulatory compliance questions
description: Frequently asked general questions about regulatory compliance
services: defender-for-cloud
author: elkrieger
ms.author: elkrieger
manager: raynew
ms.topic: faq
ms.date: 06/20/2023
title: Common questions about regulatory compliance questions
summary: |
sections:
- name: Ignored
questions:
- question: |
How do I know which benchmark or standard to use?
answer: |
[Microsoft cloud security benchmark](/security/benchmark/azure/introduction) (MCSB) is the canonical set of security recommendations and best practices defined by Microsoft, aligned with common compliance control frameworks including [CIS Control Framework](https://www.cisecurity.org/benchmark/azure/), [NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) and PCI-DSS. MCSB is a comprehensive cloud agnostic set of security principles designed to recommend the most up-to-date technical guidelines for Azure along with other clouds such as AWS and GCP. We recommend MCSB to customers who want to maximize their security posture and align their compliance status with industry standards.
The [CIS Benchmark](https://www.cisecurity.org/benchmark/azure/) is authored by an independent entity - Center for Internet Security (CIS) - and contains recommendations on a subset of core Azure services. We work with CIS to try to ensure that their recommendations are up to date with the latest enhancements in Azure, but they're sometimes delayed and can become outdated. Nonetheless, some customers like to use this objective, third-party assessment from CIS as their initial and primary security baseline.
Since we've released the Microsoft cloud security benchmark, many customers have chosen to migrate to it as a replacement for CIS benchmarks.
- question: |
What standards are supported in the compliance dashboard?
answer: |
By default, the regulatory compliance dashboard shows you the Microsoft cloud security benchmark. The Microsoft cloud security benchmark is the Microsoft-authored guidelines for security, and compliance best practices based on common compliance frameworks. Learn more in the [Microsoft cloud security benchmark introduction](../security/benchmarks/introduction.md).
To track your compliance with any other standard, you'll need to explicitly add them to your dashboard.
For a list of available regulatory standards, see [What regulatory compliance standards are available in Defender for Cloud](update-regulatory-compliance-packages.yml).
**AWS**: When users onboard, every AWS account has the AWS Foundational Security Best Practices assigned. This is the AWS-specific guideline for security and compliance best practices based on common compliance frameworks.
Users that have one Defender bundle enabled can enable other standards.
To add regulatory compliance standards on AWS accounts:
1. Navigate to **Environment settings**.
1. Select the relevant account.
1. Select **Standards**.
1. Select **Add** and choose **Standard**.
1. Choose a standard from the drop-down menu.
1. Select **Save**.
:::image type="content" source="media/update-regulatory-compliance-packages/add-aws-regulatory-compliance.png" alt-text="Screenshot of adding regulatory compliance standard to AWS account." lightbox="media/update-regulatory-compliance-packages/add-aws-regulatory-compliance.png":::
More standards will be added to the dashboard and included in the information on [Customize the set of standards in your regulatory compliance dashboard](update-regulatory-compliance-packages.yml).
- question: |
Why do some controls appear grayed out?
answer: |
For each compliance standard in the dashboard, there's a list of the standard's controls. For the applicable controls, you can view the details of passing and failing assessments.
Some controls are grayed out. These controls don't have any Defender for Cloud assessments associated with them. Some might be procedure or process-related, and so can't be verified by Defender for Cloud. Some don't have any automated policies or assessments implemented yet, but will have in the future. And some controls might be the platform's responsibility as explained in [Shared responsibility in the cloud](../security/fundamentals/shared-responsibility.md).
- question: |
How can I remove a built-in standard, like PCI-DSS, ISO 27001, or SOC2 TSP from the dashboard?
answer: |
To customize the regulatory compliance dashboard, and focus only on the standards that are applicable to you, you can remove any of the displayed regulatory standards that aren't relevant to your organization. To remove a standard, follow the instructions in [Remove a standard from your dashboard](update-regulatory-compliance-packages.yml).
- question: |
I made the suggested changes based on the recommendation, but it isn't being reflected in the dashboard?
answer: |
After you take action to resolve recommendations, wait 12 hours to see the changes to your compliance data. Assessments are run approximately every 12 hours, so you'll see the effect on your compliance data only after the assessments run.
- question: |
What permissions do I need to access the compliance dashboard?
answer: |
To access all compliance data in your tenant, you need to have at least a **Reader** level of permissions on the applicable scope of your tenant, or all relevant subscriptions.
The minimum set of roles for accessing the dashboard and managing standards is **Resource Policy Contributor** and **Security Admin**.
- question: |
The regulatory compliance dashboard isn't loading for me
answer: |
To use the regulatory compliance dashboard, Defender for Cloud must be enabled at the subscription level. If the dashboard isn't loading correctly, try the following steps:
1. Clear your browser's cache.
1. Try a different browser.
1. Try opening the dashboard from a different network location.
- question: |
How can I view a report of passing and failing controls per standard in my dashboard?
answer: |
On the main dashboard, you can see a report of passing and failing controls for (1) the 'top 4' lowest compliance standards in the dashboard. To see all the passing/failing controls status, select (2) **Show all _x_** (where x is the number of standards you're tracking). A context plane displays the compliance status for every one of your tracked standards.
:::image type="content" source="media/regulatory-compliance-dashboard/summaries-of-compliance-standards.png" alt-text="Summary section of the regulatory compliance dashboard.":::
- question: |
How can I download a report with compliance data in a format other than PDF?
answer: |
When you select **Download report**, select the standard and the format (PDF or CSV). The resulting report will reflect the current set of subscriptions you've selected in the portal's filter.
- The PDF report shows a summary status for the standard you selected
- The CSV report provides detailed results per resource, as it relates to policies associated with each control
Currently, there's no support for downloading a report for a custom policy; only for the supplied regulatory standards.
- question: |
How can I create exceptions for some of the policies in the regulatory compliance dashboard?
answer: |
For MCSB recommendations that are included in the secure score, you can create exemptions for one or more resources directly in the portal as explained in [Exempting resources and recommendations from your secure score](exempt-resource.md).
For other recommendations, you can create an exemption directly in the recommendation itself, by following the instructions in [Azure Policy exemption structure](../governance/policy/concepts/exemption-structure.md).
- question: |
What Microsoft Defender plans or licenses do I need to use the regulatory compliance dashboard?
answer: |
If you've got *any* of the Microsoft Defender plans (except for Defender for Servers Plan 1) enabled on *any* of your Azure resources, you can access Defender for Cloud's regulatory compliance dashboard and all of its data.
> [!NOTE]
> For Defender for Servers you'll get regulatory compliance only for plan 2. Plan 1 doesn't include regulatory compliance.