{
  "schemaVersion": 2,
  "reviewedAt": "2026-09-12",
  "publisher": "AWS and Microsoft",
  "scope": "Selected AWS Security Hub CSPM and Azure MCSB v2 preview controls with publisher-documented relationships; not a framework equivalence crosswalk.",
  "frameworks": [
    "NIST SP 800-53 Rev. 5",
    "CIS AWS Foundations Benchmark v5.0.0",
    "PCI DSS v4.0.1",
    "CIS Controls v8.1",
    "ISO/IEC 27001:2022"
  ],
  "controls": [
    {
      "id": "IAM.1",
      "title": "Restrict broad administrator policies",
      "service": "IAM",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-2(1)",
            "AC-3",
            "AC-3(15)",
            "AC-3(7)",
            "AC-5",
            "AC-6",
            "AC-6(10)",
            "AC-6(2)",
            "AC-6(3)"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "IAM.2",
      "title": "Assign permissions through groups or roles",
      "service": "IAM",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-2",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-2(1)",
            "AC-3",
            "AC-3(15)",
            "AC-3(7)",
            "AC-6",
            "AC-6(3)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "1.14"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "IAM.3",
      "title": "Rotate long-lived access keys",
      "service": "IAM",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-3",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(1)",
            "AC-2(3)",
            "AC-3(15)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "1.13"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "8.3.9",
            "8.6.3"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "IAM.4",
      "title": "Remove root account access keys",
      "service": "IAM",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-4",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(1)",
            "AC-3(15)",
            "AC-3(7)",
            "AC-6",
            "AC-6(10)",
            "AC-6(2)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "1.3"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "IAM.5",
      "title": "Require MFA for console users",
      "service": "IAM",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-5",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(1)",
            "AC-3(15)",
            "IA-2(1)",
            "IA-2(2)",
            "IA-2(6)",
            "IA-2(8)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "1.9"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "8.4.2"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "S3.1",
      "title": "Block public access at account level",
      "service": "S3",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-21",
            "AC-3",
            "AC-3(7)",
            "AC-4",
            "AC-4(21)",
            "AC-6",
            "SC-7",
            "SC-7(11)",
            "SC-7(16)",
            "SC-7(20)",
            "SC-7(21)",
            "SC-7(3)",
            "SC-7(4)",
            "SC-7(9)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "2.1.4"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "1.4.4"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "S3.2",
      "title": "Prevent public reads from buckets",
      "service": "S3",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-2",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-21",
            "AC-3",
            "AC-3(7)",
            "AC-4",
            "AC-4(21)",
            "AC-6",
            "SC-7",
            "SC-7(11)",
            "SC-7(16)",
            "SC-7(20)",
            "SC-7(21)",
            "SC-7(3)",
            "SC-7(4)",
            "SC-7(9)"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "S3.3",
      "title": "Prevent public writes to buckets",
      "service": "S3",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-3",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-21",
            "AC-3",
            "AC-3(7)",
            "AC-4",
            "AC-4(21)",
            "AC-6",
            "SC-7",
            "SC-7(11)",
            "SC-7(16)",
            "SC-7(20)",
            "SC-7(21)",
            "SC-7(3)",
            "SC-7(4)",
            "SC-7(9)"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "S3.5",
      "title": "Enforce HTTPS for bucket requests",
      "service": "S3",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-17(2)",
            "AC-4",
            "IA-5(1)",
            "SC-12(3)",
            "SC-13",
            "SC-23",
            "SC-23(3)",
            "SC-7(4)",
            "SC-8",
            "SC-8(1)",
            "SC-8(2)",
            "SI-7(6)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "2.1.1"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "4.2.1"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "S3.6",
      "title": "Restrict sensitive cross-account bucket actions",
      "service": "S3",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "CA-9(1)",
            "CM-2"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "CloudTrail.1",
      "title": "Record management events across regions",
      "service": "CloudTrail",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(4)",
            "AC-4(26)",
            "AC-6(9)",
            "AU-10",
            "AU-12",
            "AU-2",
            "AU-3",
            "AU-6(3)",
            "AU-6(4)",
            "AU-14(1)",
            "CA-7",
            "SC-7(9)",
            "SI-3(8)",
            "SI-4(20)",
            "SI-7(8)",
            "SA-8(22)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "3.1"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "CloudTrail.2",
      "title": "Protect stored trail logs with KMS",
      "service": "CloudTrail",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-2",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AU-9",
            "CA-9(1)",
            "CM-3(6)",
            "SC-13",
            "SC-28",
            "SC-28(1)",
            "SC-7(10)",
            "SI-7(6)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "3.5"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "10.3.2"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "CloudTrail.3",
      "title": "Maintain an enabled audit trail",
      "service": "CloudTrail",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-3",
      "mappings": [
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "10.2.1"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "CloudTrail.4",
      "title": "Validate the integrity of trail logs",
      "service": "CloudTrail",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-4",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AU-9",
            "SI-4",
            "SI-7(1)",
            "SI-7(3)",
            "SI-7(7)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "3.2"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "10.3.2"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "CloudTrail.5",
      "title": "Send audit events to CloudWatch Logs",
      "service": "CloudTrail",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-5",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(4)",
            "AC-4(26)",
            "AC-6(9)",
            "AU-10",
            "AU-12",
            "AU-2",
            "AU-3",
            "AU-6(1)",
            "AU-6(3)",
            "AU-6(4)",
            "AU-6(5)",
            "AU-7(1)",
            "CA-7",
            "SC-7(9)",
            "SI-20",
            "SI-3(8)",
            "SI-4(20)",
            "SI-4(5)",
            "SI-7(8)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "3.4"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "KMS.1",
      "title": "Limit decryption permissions to specific keys",
      "service": "KMS",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-2(1)",
            "AC-3",
            "AC-3(15)",
            "AC-3(7)",
            "AC-5",
            "AC-6",
            "AC-6(3)"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "KMS.3",
      "title": "Guard against accidental encryption-key deletion",
      "service": "KMS",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-3",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SC-12",
            "SC-12(2)"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "KMS.4",
      "title": "Enable rotation of encryption-key material",
      "service": "KMS",
      "source": "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-4",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SC-12",
            "SC-12(2)",
            "SC-28(3)"
          ]
        },
        {
          "framework": "CIS AWS Foundations Benchmark v5.0.0",
          "requirements": [
            "3.6"
          ]
        },
        {
          "framework": "PCI DSS v4.0.1",
          "requirements": [
            "3.7.4"
          ]
        }
      ],
      "cloud": "AWS",
      "publisher": "AWS",
      "catalog": "AWS Security Hub CSPM",
      "reviewedAt": "2026-09-11",
      "relation": "AWS-published related requirement"
    },
    {
      "id": "IM-1",
      "title": "Centralize identities with isolation boundaries",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-3",
            "AC-4",
            "AC-6",
            "SC-2",
            "SC-7"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "6.7",
            "12.5",
            "16.1"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.16",
            "A.8.2"
          ]
        }
      ]
    },
    {
      "id": "IM-2",
      "title": "Harden the identity control plane",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-2",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-3",
            "IA-2",
            "IA-4",
            "IA-5",
            "IA-8",
            "SI-4"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "5.4",
            "6.3",
            "6.5",
            "8.2"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.16",
            "A.5.17",
            "A.8.5"
          ]
        }
      ]
    },
    {
      "id": "IM-3",
      "title": "Automate secure workload identities",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-3",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-3",
            "IA-2",
            "IA-4",
            "IA-5",
            "IA-9",
            "SC-12",
            "SC-13"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "6.7",
            "12.5",
            "16.1",
            "16.9"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.8.3",
            "A.8.5"
          ]
        }
      ]
    },
    {
      "id": "IM-4",
      "title": "Verify service and server identities",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-4",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "IA-9",
            "SC-8",
            "SC-13",
            "SC-23"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "3.10",
            "9.2",
            "13.3"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.14",
            "A.8.24"
          ]
        }
      ]
    },
    {
      "id": "IM-5",
      "title": "Federate application sign-ins",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-5",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "IA-2",
            "IA-4",
            "IA-8",
            "AC-2"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "6.3",
            "6.5",
            "12.5"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.16"
          ]
        }
      ]
    },
    {
      "id": "IM-6",
      "title": "Require phishing-resistant authentication",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-6",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-3",
            "IA-2",
            "IA-5",
            "IA-8",
            "IA-11"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "6.3",
            "6.4",
            "6.5"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.17",
            "A.5.18"
          ]
        }
      ]
    },
    {
      "id": "IM-7",
      "title": "Evaluate access using trusted context",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-7",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2",
            "AC-3",
            "AC-6",
            "AC-16"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "3.3",
            "6.4",
            "6.8",
            "13.5"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.18",
            "A.8.2",
            "A.8.3"
          ]
        }
      ]
    },
    {
      "id": "IM-8",
      "title": "Keep application secrets out of code",
      "cloud": "Azure",
      "service": "Identity management",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-identity-management#im-8",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "IA-5",
            "SI-4",
            "RA-5",
            "SC-12",
            "SC-13",
            "SC-28"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "16.9",
            "16.10",
            "16.12"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.8.3",
            "A.8.24"
          ]
        }
      ]
    },
    {
      "id": "DP-3",
      "title": "Protect data during transmission",
      "cloud": "Azure",
      "service": "Data protection",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-data-protection#dp-3",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SC-8"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "3.10"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.24"
          ]
        }
      ]
    },
    {
      "id": "DP-4",
      "title": "Encrypt stored data by default",
      "cloud": "Azure",
      "service": "Data protection",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-data-protection#dp-4",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SC-28"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "3.11"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.24"
          ]
        }
      ]
    },
    {
      "id": "DP-6",
      "title": "Govern encryption-key lifecycles",
      "cloud": "Azure",
      "service": "Data protection",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-data-protection#dp-6",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "IA-5",
            "SC-12",
            "SC-28"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.24",
            "A.8.3"
          ]
        }
      ]
    },
    {
      "id": "DP-8",
      "title": "Protect key and certificate vaults",
      "cloud": "Azure",
      "service": "Data protection",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-data-protection#dp-8",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "IA-5",
            "SC-12",
            "SC-17"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.3",
            "A.8.24"
          ]
        }
      ]
    },
    {
      "id": "NS-1",
      "title": "Separate workloads with network boundaries",
      "cloud": "Azure",
      "service": "Network security",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-network-security#ns-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SC-7",
            "SC-32",
            "AC-4",
            "CM-7"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "12.1",
            "12.2",
            "12.6"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.20",
            "A.8.21"
          ]
        }
      ]
    },
    {
      "id": "NS-2",
      "title": "Restrict network access to cloud services",
      "cloud": "Azure",
      "service": "Network security",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-network-security#ns-2",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SC-7(4)",
            "SC-7(5)",
            "AC-4(21)"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "12.4",
            "12.7"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.20",
            "A.8.22"
          ]
        }
      ]
    },
    {
      "id": "PA-1",
      "title": "Isolate and minimize administrative accounts",
      "cloud": "Azure",
      "service": "Privileged access",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-privileged-access#pa-1",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(1)",
            "AC-2(7)",
            "AC-5",
            "AC-6(1)",
            "AC-6(5)"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "5.4",
            "6.7",
            "6.8"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.18",
            "A.8.2"
          ]
        }
      ]
    },
    {
      "id": "PA-2",
      "title": "Replace permanent privileges with temporary access",
      "cloud": "Azure",
      "service": "Privileged access",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-privileged-access#pa-2",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-2(1)",
            "AC-5",
            "AC-6(2)",
            "AC-6(5)",
            "AC-16"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "5.4",
            "6.8"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.5.18",
            "A.8.2"
          ]
        }
      ]
    },
    {
      "id": "AI-4",
      "title": "Limit permissions available to AI agents",
      "cloud": "Azure",
      "service": "AI security",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-artificial-intelligence-security#ai-4",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "AC-6",
            "AC-3",
            "CM-7"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "5.4",
            "6.8"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.15",
            "A.8.3"
          ]
        }
      ]
    },
    {
      "id": "AI-5",
      "title": "Require human oversight of AI actions",
      "cloud": "Azure",
      "service": "AI security",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-artificial-intelligence-security#ai-5",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "IA-9",
            "AC-2",
            "AU-6"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "6.7",
            "8.11"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.5.17",
            "A.6.8"
          ]
        }
      ]
    },
    {
      "id": "AI-6",
      "title": "Detect suspicious AI activity",
      "cloud": "Azure",
      "service": "AI security",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-artificial-intelligence-security#ai-6",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "SI-4",
            "AU-6",
            "IR-4"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "8.5",
            "13.1"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.16",
            "A.8.15"
          ]
        }
      ]
    },
    {
      "id": "AI-7",
      "title": "Continuously test AI attack resistance",
      "cloud": "Azure",
      "service": "AI security",
      "publisher": "Microsoft",
      "catalog": "Microsoft cloud security benchmark v2 (preview)",
      "reviewedAt": "2026-09-12",
      "relation": "Microsoft-published control mapping (MCSB v2 preview)",
      "source": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-artificial-intelligence-security#ai-7",
      "mappings": [
        {
          "framework": "NIST SP 800-53 Rev. 5",
          "requirements": [
            "CA-8",
            "SI-2",
            "RA-5"
          ]
        },
        {
          "framework": "CIS Controls v8.1",
          "requirements": [
            "15.1",
            "18.5"
          ]
        },
        {
          "framework": "ISO/IEC 27001:2022",
          "requirements": [
            "A.8.8",
            "A.5.7"
          ]
        }
      ]
    }
  ]
}