Refer to this page for information about version-specific improvements to SD Elements and associated content.

2024.2 | 2024.1 | 2023.4 | 2023.3 | 2023.2 | 2023.1 | 2022.4 | 2022.3 | 2022.2 | 5.20 | 5.19 | 5.18 | 5.17 | 5.16 | 5.15 | 5.14 | 5.13 | 5.12 | 5.11 | 5.10 | 5.9 | 5.8 | 5.7 | 5.6 | 5.5 | 5.4 | 5.3 | 5.2 | 5.1 | 5.0

2024.2

July 6, 2024

New features and enhancements

• Library Weaknesses

  • Added the following Library Weakness UI enhancements:
    • Improved content management user experience
    • Ability to copy an existing Weakness when creating a new one
    • Display when a Weakness was edited last and by whom
    • New applicability rule user experience when viewing, adding, or editing match conditions
    • New dedicated page for related Countermeasures of a Weakness
  • Added the API capability to POST, PATCH and DELETE Weaknesses

• Library Profiles

  • The Library Profile page has been replaced with a new page that uses modern controls

• Project Classifications

  • Added the ability to create new classifications in addition to the five built-in options via the UI and API
  • Added the ability to reorder project classifications via the API
  • Added GET, POST, and PATCH for new project classifications

• Team Onboarding

  • Added a new getting started option to Scan a Repository within a Project
    • Added the ability to connect to GitHub within SD Elements via OAuth
    • Added the ability to select a Repo and Branch for an Authenticated GitHub connection to scan and answer the survey
    • This includes repo scan API features released June 8

• Python 3.12 upgrade

  • Container images now use Python 3.12
  • Remote Integration Agent (RIA) now uses Python 3.12
    • Deprecated Python 3.8
    • Existing deployments of RIA should continue to work, but only Python 3.12 RIA downloads will be available

Updates

August 3, 2024

• Scan a Repository

  • Added the ability to select Scan a Repository from the Project Survey page

• New Content Updates Available widget

  • Added the ability to selectively accept pending Countermeasure changes

August 17, 2024

• Update CWEs on Weaknesses
  • Added the ability for a user to update the CWE mappings on a Weakness
  • Added the ability for a user to revert CWE changes back to the latest content updates

Content improvements summary

• EU AI Act

  • This is the first regulatory framework aimed at ensuring the safety and fundamental rights of people and businesses while fostering the adoption of Artificial Intelligence (AI). Added 22 Countermeasures to cover related articles of the Act.

• LLM-based Code Generation countermeasures

  • Added three Countermeasures to cover the recommendations for the common use cases of code generation using AI.

• ANSI/ISA 62443 4-1 (SDLA 312)

  • Added a new compliance regulation for 62443 4-1 along with amendments and test amendments.

• CWEs

  • Updated the CWEs to v4.14.

• AWS Services

  • Added content for Certificate Manager, CloudFormation, Elastic Container Registry, Elastic File System, ElastiCache, Managed Streaming for Apache Kafka, MQ, OpenSearch Service, RedShift, Secrets Manager, Simple Email Service, Step Functions, Systems Manager, Transfer Family, App Mesh, Bedrock, S3 Glacier, Glue, and Lake Formation.

• Azure Services

  • Added content for Azure AI Bot Service, Azure Databricks, Azure Machine Learning, Azure OpenAI Service, Azure Analysis Services, Azure Data Explorer, Azure Data Lake Analytics, Azure Event Hubs, Azure Stream Analytics, Azure Synapse Analytics, Azure App Service, Azure Batch, Azure Linux Virtual Machines, Azure Spring Apps, Azure Virtual Desktop, Azure Virtual Machine Scale Sets, Azure VMware Solution, Azure Windows Virtual Machines, Azure Container Apps, Azure Container Instances, Azure Container Registry, Azure Red Hat OpenShift, Azure Cache for Redis, Azure Cosmos DB, Azure Data Factory, Azure Database for MariaDB, Azure Database for MySQL, Azure Managed Instance for Apache Cassandra, Azure SQL, Azure App Configuration, Azure DevTest Labs, Azure Arc, Azure Stack Edge, Azure Active Directory External Identities, Azure API Management, Azure Event Grid, Azure Logic Apps, Azure Service Bus, Azure Web PubSub, Azure IoT Central, Azure IoT Hub, Azure Notification Hubs, Azure Automation, Azure Cloud Shell, Azure Cost Management, Azure Lighthouse, Azure Managed Applications, Azure Policy, Azure Purview, Azure Resource Manager templates, Azure Resource Mover, Azure Media Services, Azure Database Migration Service, Azure Migrate, Azure Site Recovery, Azure Digital Twins, Azure Remote Rendering, Azure Spatial Anchors, Azure Application Gateway, Azure Bastion, Azure Communications Gateway, Azure Content Delivery Network, Azure DDoS Protection, Azure DNS, Azure Firewall, Azure Firewall Manager, Azure Front Door, Azure Load Balancer, Azure NAT Gateway, Azure Network Watcher, Azure Private Link, Azure Traffic Manager, Azure Virtual WAN, Azure VPN Gateway, Azure Web Application Firewall, Azure PostgreSQL Database, Azure Attestation, Azure Dedicated HSM, Azure Defender for Cloud, Azure Information Protection, Azure Key Vault Managed HSM, Azure Sentinel, Azure Backup, Azure Data Box, Azure Data Share, Azure HPC Cache, Azure Managed Lustre, Azure NetApp Files, Azure Communication Services, Azure SignalR Service, Azure Blob Storage, and Azure Data Lake Storage.

• Databases

  • Added content for InfluxDB, Neo4j, MariaDB, CockroachDB, Apache Cassandra, MarkLogic, and SQLite.

• Network

  • Added content for Directory Server, DNS Server, Firewall, FTP Server, IDS/IPS, Load Balancer, Message Broker, File Transfer Protocol (FTP), Virtual Private Network (VPN), Proxy Server, Router, Service Bus, Virtual Private Network (VPN) Server, 3G, 4G/LTE, 5G, LoRa, Modbus, Advanced Message Queuing Protocol (AMQP), Content Delivery Network (CDN)

• Compliance Regulations and Mappings

  • CIS GitHub Benchmark 1.0.0

Content additions and updates (as of June 19, 2024):

• Compliance Regulations and Mappings

  • Added ANSI/ISA 62443-4-1 (ISASecure SDLA 312)
  • Added CIS GitHub Benchmark 1.0.0
  • Added EU AI Act

• Content Packs

  • Added InfluxDB
  • Added Neo4j
  • Added MariaDB
  • Added CockroachDB
  • Added Apache Cassandra
  • Added MarkLogic
  • Added PostgreSQL
  • Added GitHub
  • Added EU AI Act
  • Added Network

• T38: Bind variables in SQL statements

  • I1891: Use parameterized commands when an application interacts with the database (PostgreSQL) [Added]
  • I1892: Prevent injection attacks by using parameterized commands (InfluxDB) [Added]
  • I1893: Use parameterized commands when an application accesses the database (MariaDB) [Added]
  • I1894: Use parameterized commands when an application interacts with the database (CockroachDB) [Added]
  • I1895: Use parameterized commands when an application interacts with the database [Added]
• T177: Allow users to review and update their personal information
  • TA6554: OWASP best practices for changing user account details [Added]
• T796: Configure DNS for Root Domain (AWS Route53) [Updated]
  • INFO: Updated the title.
  • P896: Misconfiguration of DNS for Root Domain (AWS Route53) [Updated]
    • INFO: Updated the title and cwe set.
• T829: Test that DNS for Root Domain is configured correctly (AWS Route53) [Updated]
  • INFO: Updated the title.
  • P896: Misconfiguration of DNS for Root Domain (AWS Route53) [Updated]
    • INFO: Updated the title and cwe set.
• T1366: Identify applicable compliance regulations
  • TA6823: SDLA 312 Requirement (SM-3) [Added]
  • TA6825: SDLA 312 Requirement (SM-5) [Added]
• T1373: Maintain the integrity of all software code
  • TA6826: SDLA 312 Requirement (SM-6) [Added]
• T1374: Ensure the integrity of software release and update delivery
  • TA6827: SDLA 312 Requirement (SM-7) [Added]
  • TA6834: SDLA 312 Requirement (SUM-1) [Added]
  • TA6837: SDLA 312 Requirement (SUM-4) [Added]
  • TA6838: SDLA 312 Requirement (SUM-5) [Added]
• T1376: Provide and maintain guidance on secure installation, maintenance, and configuration of all software components
  • TA6808: SDLA 312 Requirement (SG-1) [Added]
  • TA6809: SDLA 312 Requirement (SG-2) [Added]
  • TA6810: SDLA 312 Requirement (SG-3) [Added]
  • TA6811: SDLA 312 Requirement (SG-4) [Added]
  • TA6812: SDLA 312 Requirement (SG-5) [Added]
  • TA6813: SDLA 312 Requirement (SG-6) [Added]
  • TA6814: SDLA 312 Requirement (SG-7) [Added]
• T1377: Establish and maintain a bi-directional communication channel for receiving security reports and sending security notifications
  • TA6798: SDLA 312 Requirement (DM-1) [Added]
  • TA6802: SDLA 312 Requirement (DM-5) [Added]
• T1378: Release a change summary for each software update
  • TA6835: SDLA 312 Requirement (SUM-2) [Added]
  • TA6836: SDLA 312 Requirement (SUM-3) [Added]
• T1387: Ensure the security of products acquired through the supply chain and contractors
  • TA6818: SDLA 312 Requirement (SM-10) [Added]
• T1388: Triage and fix vulnerabilities discovered during automated and manual security tests
  • TA6799: SDLA 312 Requirement (DM-2) [Added]
  • TA6800: SDLA 312 Requirement (DM-3) [Added]
  • TA6801: SDLA 312 Requirement (DM-4) [Added]
  • TA6803: SDLA 312 Requirement (DM-6) [Added]
  • TA6819: SDLA 312 Requirement (SM-11) [Added]
  • TA6820: SDLA 312 Requirement (SM-12) [Added]
  • TA6821: SDLA 312 Requirement (SM-13) [Added]
• T1389: Perform penetration testing
  • TA6841: SDLA 312 Requirement (SVV-3) [Added]
  • TA6842: SDLA 312 Requirement (SVV-4) [Added]
  • TA6843: SDLA 312 Requirement (SVV-5) [Added]
• T1453: Validate user input before transmitting it to the SQL server (Microsoft SQL Server) [Updated]
  • INFO: Updated the text.
• T1892: Perform a Threat and Risk Assessment (TRA)
  • TA6830: SDLA 312 Requirement (SR-2) [Added]
• T1921: Track and manage usage of third-party and commercial off the shelf (COTS) hardware or software
  • TA6828: SDLA 312 Requirement (SM-9) [Added]
• T2343: Define security-related roles and provide role-base training
  • TA6822: SDLA 312 Requirement (SM-2) [Added]
  • TA6824: SDLA 312 Requirement (SM-4) [Added]
• T2345: Define and implement criteria for software security checks
  • TA6815: SDLA 312 Requirement (SI-1) [Added]
• T2351: Verify that security-related roles and responsibilities are properly defined and assigned
  • TA6867: SDLA 312 Test Requirement (SM-2) [Added]
  • TA6869: SDLA 312 Test Requirement (SM-4) [Added]
• T2353: Verify that proper criteria for software security checks are defined and implemented
  • TA6860: SDLA 312 Test Requirement (SI-1) [Added]
• T2498: Provide clear definitions for each component
  • TA6829: SDLA 312 Requirement (SR-1) [Added]
• T2499: Verify that clear definitions for each component exist
  • TA6874: SDLA 312 Test Requirement (SR-1) [Added]
• T2500: Verify that a Threat and Risk Assessment (TRA) is performed
  • TA6875: SDLA 312 Test Requirement (SR-2) [Added]
• T2510: Define cybersecurity goals and requirements for a component
  • TA6804: SDLA 312 Requirement (SD-1) [Added]
  • TA6805: SDLA 312 Requirement (SD-2) [Added]
  • TA6806: SDLA 312 Requirement (SD-3) [Added]
  • TA6807: SDLA 312 Requirement (SD-4) [Added]
  • TA6817: SDLA 312 Requirement (SM-1) [Added]
  • TA6831: SDLA 312 Requirement (SR-3) [Added]
  • TA6832: SDLA 312 Requirement (SR-4) [Added]
  • TA6833: SDLA 312 Requirement (SR-5) [Added]
• T2513: Verify whether cybersecurity goals and requirements are clearly defined for a component
  • TA6850: SDLA 312 Test Requirement (SD-1) [Added]
  • TA6851: SDLA 312 Test Requirement (SD-2) [Added]
  • TA6852: SDLA 312 Test Requirement (SD-3) [Added]
  • TA6853: SDLA 312 Test Requirement (SD-4) [Added]
  • TA6862: SDLA 312 Test Requirement (SM-1) [Added]
  • TA6876: SDLA 312 Test Requirement (SR-3) [Added]
  • TA6877: SDLA 312 Test Requirement (SR-4) [Added]
  • TA6878: SDLA 312 Test Requirement (SR-5) [Added]
• T2514: Establish coding and testing guidelines
  • TA6816: SDLA 312 Requirement (SI-2) [Added]
  • TA6839: SDLA 312 Requirement (SVV-1) [Added]
  • TA6840: SDLA 312 Requirement (SVV-2) [Added]
• T2515: Verify coding and testing guidelines
  • TA6861: SDLA 312 Test Requirement (SI-2) [Added]
  • TA6884: SDLA 312 Test Requirement (SVV-1) [Added]
  • TA6885: SDLA 312 Test Requirement (SVV-2) [Added]
• T2615: Limit network access by blocking connections from unknown IP addresses (PostgreSQL) [Added]
• T2616: Use a secure authentication mechanism for database connections (PostgreSQL) [Added]
  • P1771: Weak authentication for database users [Added]
• T2617: Create dedicated database user accounts with minimum privileges (PostgreSQL) [Added]
• T2618: Remove unecessary superuser accounts (PostgreSQL) [Added]
  • P1773: Overuse of superuser accounts (PostgreSQL) [Added]
• T2619: Ensure that row-level security is correctly configured (PostgreSQL) [Added]
  • P1774: Incorrect configuration of row-level security (PostgreSQL) [Added]
• T2620: Protect data in transit with TLS (PostgreSQL) [Added]
• T2621: Use file volume encryption and consider in-database encryption with pgcrypto (PostgreSQL) [Added]
• T2622: Monitor database activity and enable audit logging (PostgreSQL) [Added]
  • P1772: Failure to monitor database activity [Added]
• T2623: Schedule regular database backups to protect availability (PostgreSQL) [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2624: Change insecure configuration defaults and remove unnecessary features (InfluxDB) [Added]
• T2625: Follow best practices for token management (InfluxDB) [Added]
• T2626: Use volume encryption as a partial mitigation (InfluxDB) [Added]
• T2627: Protect data in transit with TLS (InfluxDB) [Added]
• T2628: Schedule regular database backups to protect availability (InfluxDB) [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2629: Monitor database activity and enable audit logging (InfluxDB) [Added]
  • P1772: Failure to monitor database activity [Added]
• T2630: Change insecure configuration defaults and remove unnecessary features (Neo4j) [Added]
• T2631: Restrict unecessary plugins and functions that use Neo4j's internal APIs (Neo4j) [Added]
  • P1776: Unrestricted plugins (Neo4j) [Added]
• T2632: Use a secure authentication mechanism for database connections (Neo4j) [Added]
  • P1771: Weak authentication for database users [Added]
• T2633: Create dedicated database user accounts with minimum privileges (Neo4j) [Added]
• T2634: Disable credential caching (Neo4j) [Added]
  • P1777: Credentials stored in clear text in the browser (Neo4j) [Added]
• T2635: Use volume encryption as a partial mitigation (Neo4j) [Added]
• T2636: Use TLS for Bolt or HTTPS communication (Neo4j) [Added]
• T2637: Schedule regular database backups to protect availability (Neo4j) [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2638: Monitor database activity and enable audit logging (Neo4j) [Added]
  • P1772: Failure to monitor database activity [Added]
• T2639: Enable authentication and create at least one database user (MongoDB) [Added]
  • P1778: Lack of authentication for database users (MongoDB) [Added]
• T2640: Implement RBAC with dedicated database user accounts (MongoDB) [Added]
• T2641: Protect sensitive data at rest with encryption (MongoDB) [Added]
• T2642: Protect data in transit with TLS (MongoDB) [Added]
• T2643: Monitor database activity and enable audit logging (MongoDB) [Added]
  • P1772: Failure to monitor database activity [Added]
• T2644: Change insecure configuration defaults and remove unnecessary features (MongoDB) [Added]
• T2645: Create dedicated database user accounts with minimum privileges (MariaDB) [Added]
• T2646: Disable command history logging (MariaDB) [Added]
  • P1779: Leaking sensitive information in the command history (MariaDB) [Added]
• T2647: Protect sensitive data at rest with encryption (MariaDB) [Added]
• T2648: Protect data in transit with TLS (MariaDB) [Added]
• T2649: Schedule regular database backups to protect availability (MariaDB) [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2650: Monitor database activity and enable audit logging (MariaDB) [Added]
  • P1772: Failure to monitor database activity [Added]
• T2651: Change insecure configuration defaults and remove unnecessary features (MariaDB) [Added]
• T2652: Consider adding plugins for stronger authentication protocols and stricter password complexity rules (MariaDB) [Added]
  • P1771: Weak authentication for database users [Added]
• T2653: Do not use insecure mode (CockroadDB) [Added]
• T2654: Limit network access by blocking connections from unknown IP addresses (CockroachDB) [Added]
• T2655: Use a secure authentication mechanism for database connections (CockroachDB) [Added]
  • P1771: Weak authentication for database users [Added]
• T2656: Create dedicated database user accounts with minimum privileges CockroachDB) [Added]
• T2657: Protect data in transit with TLS (CockroachDB) [Added]
• T2658: Protect sensitive data at rest with encryption (CockroachDB) [Added]
• T2659: Monitor database security logs and consider audit logging (CockroachDB) [Added]
  • P1772: Failure to monitor database activity [Added]
• T2660: Schedule regular database backups to protect availability (CockroachDB) [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2661: Change insecure configuration defaults and remove unnecessary features [Added]
• T2662: Restrict network access to the database server [Added]
• T2663: Use a secure authentication mechanism for database connections [Added]
  • P1771: Weak authentication for database users [Added]
• T2664: Create dedicated database user accounts with minimum privileges [Added]
• T2665: Protect sensitive data at rest with encryption [Added]
• T2666: Protect data in transit with TLS [Added]
• T2667: Schedule regular database backups to protect availability [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2668: Monitor database activity and enable audit logging [Added]
  • P1772: Failure to monitor database activity [Added]
• T2669: Schedule regular database backups to protect availability (MongoDB) [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T2670: Verify that applicable compliance regulations are identified [Added]
  • TA6868: SDLA 312 Test Requirement (SM-3) [Added]
  • TA6870: SDLA 312 Test Requirement (SM-5) [Added]
• T2671: Verify that the integrity of all software code is maintained [Added]
  • TA6871: SDLA 312 Test Requirement (SM-6) [Added]
• T2672: Verify that the integrity of software release and update delivery is protected [Added]
  • TA6872: SDLA 312 Test Requirement (SM-7) [Added]
  • TA6879: SDLA 312 Test Requirement (SUM-1) [Added]
  • TA6882: SDLA 312 Test Requirement (SUM-4) [Added]
  • TA6883: SDLA 312 Test Requirement (SUM-5) [Added]
• T2673: Verify that usage third-party and commercial off the shelf (COTS) hardware or software is tracked and managed [Added]
  • TA6873: SDLA 312 Test Requirement (SM-9) [Added]
• T2674: Verify that products acquired through the supply chain and contractors are secure [Added]
  • TA6863: SDLA 312 Test Requirement (SM-10) [Added]
• T2675: Verify that vulnerabilities discovered during automated and manual security tests are triaged and fixed [Added]
  • TA6845: SDLA 312 Test Requirement (DM-2) [Added]
  • TA6846: SDLA 312 Test Requirement (DM-3) [Added]
  • TA6847: SDLA 312 Test Requirement (DM-4) [Added]
  • TA6849: SDLA 312 Test Requirement (DM-6) [Added]
  • TA6864: SDLA 312 Test Requirement (SM-11) [Added]
  • TA6865: SDLA 312 Test Requirement (SM-12) [Added]
  • TA6866: SDLA 312 Test Requirement (SM-13) [Added]
• T2676: Verify that a bi-directional communication channel is established and maintained for receiving security reports and sending notifications [Added]
  • TA6844: SDLA 312 Test Requirement (DM-1) [Added]
  • TA6848: SDLA 312 Test Requirement (DM-5) [Added]
• T2677: Verify that a change summary is released for each software update [Added]
  • TA6880: SDLA 312 Test Requirement (SUM-2) [Added]
  • TA6881: SDLA 312 Test Requirement (SUM-3) [Added]
• T2678: Verify that guidance is provided and maintained for secure installation, maintenance and configuration of all software components [Added]
  • TA6854: SDLA 312 Test Requirement (SG-1) [Added]
  • TA6855: SDLA 312 Test Requirement (SG-2) [Added]
  • TA6856: SDLA 312 Test Requirement (SG-3) [Added]
  • TA6857: SDLA 312 Test Requirement (SG-4) [Added]
  • TA6858: SDLA 312 Test Requirement (SG-6) [Added]
  • TA6859: SDLA 312 Test Requirement (SG-7) [Added]
• T2679: Verify that penetration testing has been performed [Added]
  • TA6886: SDLA 312 Test Requirement (SVV-3) [Added]
  • TA6887: SDLA 312 Test Requirement (SVV-4) [Added]
  • TA6888: SDLA 312 Test Requirement (SVV-5) [Added]
• T2680: Establish network segmentation boundaries (Azure) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2681: Secure cloud native services with network controls (Azure) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2682: Deploy firewall at the edge of enterprise network (Azure) [Added]
  • P1782: Uncontrolled network access (Cloud) [Added]
• T2683: Deploy intrusion detection/intrusion prevention systems (IDS/IPS) (Azure) [Added]
  • P1783: Unmonitored network traffic vulnerability (Cloud) [Added]
• T2684: Deploy DDOS protection (Azure) [Added]
  • P1784: Insufficient traffic filtering and rate limiting (Cloud) [Added]
• T2685: Deploy web application firewall (Azure) [Added]
  • P1785: Unprotected web applications (Cloud) [Added]
• T2686: Simplify network security configuration (Azure) [Added]
  • P1786: Overly complex network security configurations (Cloud) [Added]
• T2687: Detect and disable insecure services and protocols (Azure) [Added]
  • P1787: Outdated and vulnerable network services (Cloud) [Added]
• T2688: Connect on-premises or cloud network privately (Azure) [Added]
  • P1788: Unsecured public network connections (Cloud) [Added]
• T2689: Ensure Domain Name System (DNS) security (Azure) [Added]
  • P1789: Unsecured Domain Name System (DNS) (Cloud) [Added]
• T2690: Use centralized identity and authentication system (Azure) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T2691: Protect identity and authentication systems (Azure) [Added]
  • P1791: Unsecured identity and authentication systems (Cloud) [Added]
• T2692: Manage application identities securely and automatically (Azure) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2693: Authenticate server and services (Azure) [Added]
  • P1793: Unverified server identity (Cloud) [Added]
• T2694: Use single sign-on (SSO) for application access (Azure) [Added]
  • P1794: Insufficient authentication protocols (Cloud) [Added]
• T2695: Use strong authentication controls (Azure) [Added]
  • P1795: Weak password-based authentication (Cloud) [Added]
• T2696: Restrict resource access based on conditions (Azure) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T2697: Restrict the exposure of credentials and secrets (Azure) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T2698: Secure user access to existing applications (Azure) [Added]
  • P1798: Unsecured access to legacy applications (Cloud) [Added]
• T2699: Separate and limit highly privileged/administrative users (Azure) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T2700: Avoid standing access for user accounts and permissions (Azure) [Added]
  • P1800: Overly broad access permissions (Cloud) [Added]
• T2701: Manage lifecycle of identities and entitlements (Azure) [Added]
  • P1801: Uncontrolled identity and access management (Cloud) [Added]
• T2702: Review and reconcile user access regularly (Azure) [Added]
  • P1802: Unmonitored privileged access (Cloud) [Added]
• T2703: Set up emergency access (Azure) [Added]
  • P1803: Insufficient emergency access management (Cloud) [Added]
• T2704: Use privileged access workstations (Azure) [Added]
  • P1804: Insufficiently secured administrative access (Cloud) [Added]
• T2705: Follow just enough administration (least privilege) principle (Azure) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T2706: Determine access process for cloud provider support (Azure) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T2707: Discover, classify, and label sensitive data (Azure) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T2708: Monitor anomalies and threats targeting sensitive data (Azure) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T2709: Encrypt sensitive data in transit (Azure) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T2710: Enable data at rest encryption by default (Azure) [Added]
  • P1810: Unprotected data at rest (Cloud) [Added]
• T2711: Use customer-managed key option in data at rest encryption when required (Azure) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2712: Use a secure key management process (Azure) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2713: Use a secure certificate management process (Azure) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T2714: Ensure security of key and certificate repository (Azure) [Added]
  • P1814: Unsecured key and certificate repository (Cloud) [Added]
• T2715: Track asset inventory and their risks (Azure) [Added]
  • P1815: Untracked and unmonitored cloud assets (Cloud) [Added]
• T2716: Use only approved services (Azure) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2717: Ensure security of asset lifecycle management (Azure) [Added]
  • P1817: Outdated security configurations (Cloud) [Added]
• T2718: Limit access to asset management (Azure) [Added]
  • P1818: Unauthorized access to asset management (Cloud) [Added]
• T2719: Use only approved applications in virtual machine (Azure) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T2720: Enable threat detection capabilities (Azure) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T2721: Enable threat detection for identity and access management (Azure) [Added]
  • P1821: Unmonitored identity and access management systems (Cloud) [Added]
• T2722: Enable logging for security investigation (Azure) [Added]
  • P1822: Insufficient logging and monitoring (Cloud) [Added]
• T2723: Enable network logging for security investigation (Azure) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2724: Centralize security log management and analysis (Azure) [Added]
  • P1824: Decentralized security log management (Cloud) [Added]
• T2725: Configure log storage retention (Azure) [Added]
  • P1825: Insufficient log storage retention periods (Cloud) [Added]
• T2726: Use approved time synchronization sources (Azure) [Added]
  • P1826: Unreliable logging timestamps (Cloud) [Added]
• T2727: Preparation - update incident response plan and handling process (Azure) [Added]
  • P1827: Inadequate incident response planning (Cloud) [Added]
• T2728: Preparation - setup incident notification (Azure) [Added]
  • P1828: Inadequate incident notification setup (Cloud) [Added]
• T2729: Detection and analysis - create incidents based on high-quality alerts (Azure) [Added]
  • P1829: Insufficient alert quality management (Cloud) [Added]
• T2730: Detection and analysis - investigate an incident (Azure) [Added]
  • P1830: Inadequate data collection and analysis (Cloud) [Added]
• T2731: Detection and analysis - prioritize incidents (Azure) [Added]
  • P1831: Insufficient incident prioritization (Cloud) [Added]
• T2732: Containment, eradication and recovery - automate the incident handling (Azure) [Added]
  • P1832: Inefficient manual incident handling processes (Cloud) [Added]
• T2733: Post-incident activity - conduct lessons learned and retain evidence (Azure) [Added]
  • P1833: Failure to document incident response efforts (Cloud) [Added]
• T2734: Define and establish secure configurations (Azure) [Added]
  • P1834: Inconsistent cloud resource configurations (Cloud) [Added]
• T2735: Audit and enforce secure configurations (Azure) [Added]
  • P1835: Unsecured system configurations (Cloud) [Added]
• T2736: Define and establish secure configurations for compute resources (Azure) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T2737: Audit and enforce secure configurations for compute resources (Azure) [Added]
  • P1837: Unsecured compute resource configurations (Cloud) [Added]
• T2738: Perform vulnerability assessments (Azure) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T2739: Rapidly and automatically remediate vulnerabilities (Azure) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T2740: Conduct regular red team operations (Azure) [Added]
  • P1840: Overreliance on traditional vulnerability scanning (Cloud) [Added]
• T2741: Use Endpoint Detection and Response (EDR) (Azure) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T2742: Use modern anti-malware software (Azure) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T2743: Ensure anti-malware software and signatures are updated (Azure) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T2744: Ensure regular automated backups (Azure) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T2745: Protect backup and recovery data (Azure) [Added]
  • P1845: Unsecured backup and recovery data (Cloud) [Added]
• T2746: Monitor backups (Azure) [Added]
  • P1846: Inadequate backup monitoring (Cloud) [Added]
• T2747: Regularly test backup (Azure) [Added]
  • P1847: Inadequate backup verification (Cloud) [Added]
• T2748: Conduct threat modeling (Azure) [Added]
  • P1848: Inadequate threat identification and mitigation (Cloud) [Added]
• T2749: Ensure software supply chain security (Azure) [Added]
  • P1849: Unsecured software supply chain (Cloud) [Added]
• T2750: Secure DevOps infrastructure (Azure) [Added]
  • P1850: Unsecured DevOps infrastructure (Cloud) [Added]
• T2751: Integrate static application security testing into DevOps pipeline (Azure) [Added]
  • P1851: Insufficient code review and testing (Cloud) [Added]
• T2752: Integrate dynamic application security testing into DevOps pipeline (Azure) [Added]
  • P1852: Insufficient security testing in CI/CD pipelines (Cloud) [Added]
• T2753: Enforce security of workload throughout DevOps lifecycle (Azure) [Added]
  • P1853: Inadequate DevOps security practices (Cloud) [Added]
• T2754: Enable logging and monitoring in DevOps (Azure) [Added]
  • P1854: Inadequate logging and monitoring in DevOps (Cloud) [Added]
• T2755: Align organization roles, responsibilities and accountabilities (Azure) [Added]
  • P1855: Lack of defined security roles and responsibilities (Cloud) [Added]
• T2756: Define and implement enterprise segmentation/separation of duties strategy (Azure) [Added]
  • P1856: Insufficient access control and segmentation (Cloud) [Added]
• T2757: Define and implement data protection strategy (Azure) [Added]
  • P1857: Inadequate data protection strategy (Cloud) [Added]
• T2758: Define and implement network security strategy (Azure) [Added]
  • P1858: Lack of unified network security strategy (Cloud) [Added]
• T2759: Define and implement security posture management strategy (Azure) [Added]
  • P1859: Inadequate cloud security configuration (Cloud) [Added]
• T2760: Define and implement identity and privileged access strategy (Azure) [Added]
  • P1860: Inadequate identity and access management (Cloud) [Added]
• T2761: Define and implement logging, threat detection and incident response strategy (Azure) [Added]
  • P1861: Inadequate logging and incident response (Cloud) [Added]
• T2762: Define and implement backup and recovery strategy (Azure) [Added]
  • P1862: Inadequate data backup and recovery processes (Cloud) [Added]
• T2763: Define and implement endpoint security strategy (Azure) [Added]
  • P1863: Unsecured endpoints (Cloud) [Added]
• T2764: Define and implement DevOps security strategy (Azure) [Added]
  • P1864: Inadequate DevOps security strategy (Cloud) [Added]
• T2765: Define and implement multi-cloud security strategy (Azure) [Added]
  • P1865: Lack of unified cloud security management (Cloud) [Added]
• T2766: Establish network segmentation boundaries (AWS) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2767: Secure cloud native services with network controls (AWS) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2768: Deploy firewall at the edge of enterprise network (AWS) [Added]
  • P1782: Uncontrolled network access (Cloud) [Added]
• T2769: Deploy intrusion detection/intrusion prevention systems (IDS/IPS) (AWS) [Added]
  • P1783: Unmonitored network traffic vulnerability (Cloud) [Added]
• T2770: Deploy DDOS protection (AWS) [Added]
  • P1784: Insufficient traffic filtering and rate limiting (Cloud) [Added]
• T2771: Deploy web application firewall (AWS) [Added]
  • P1785: Unprotected web applications (Cloud) [Added]
• T2772: Simplify network security configuration (AWS) [Added]
  • P1786: Overly complex network security configurations (Cloud) [Added]
• T2773: Detect and disable insecure services and protocols (AWS) [Added]
  • P1787: Outdated and vulnerable network services (Cloud) [Added]
• T2774: Connect on-premises or cloud network privately (AWS) [Added]
  • P1788: Unsecured public network connections (Cloud) [Added]
• T2775: Ensure Domain Name System (DNS) security (AWS) [Added]
  • P1789: Unsecured Domain Name System (DNS) (Cloud) [Added]
• T2776: Use centralized identity and authentication system (AWS) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T2777: Protect identity and authentication systems (AWS) [Added]
  • P1791: Unsecured identity and authentication systems (Cloud) [Added]
• T2778: Manage application identities securely and automatically (AWS) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2779: Authenticate server and services (AWS) [Added]
  • P1793: Unverified server identity (Cloud) [Added]
• T2780: Use single sign-on (SSO) for application access (AWS) [Added]
  • P1794: Insufficient authentication protocols (Cloud) [Added]
• T2781: Use strong authentication controls (AWS) [Added]
  • P1795: Weak password-based authentication (Cloud) [Added]
• T2782: Restrict resource access based on conditions (AWS) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T2783: Restrict the exposure of credentials and secrets (AWS) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T2784: Secure user access to existing applications (AWS) [Added]
  • P1798: Unsecured access to legacy applications (Cloud) [Added]
• T2785: Separate and limit highly privileged/administrative users (AWS) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T2786: Avoid standing access for user accounts and permissions (AWS) [Added]
  • P1800: Overly broad access permissions (Cloud) [Added]
• T2787: Manage lifecycle of identities and entitlements (AWS) [Added]
  • P1801: Uncontrolled identity and access management (Cloud) [Added]
• T2788: Review and reconcile user access regularly (AWS) [Added]
  • P1802: Unmonitored privileged access (Cloud) [Added]
• T2789: Set up emergency access (AWS) [Added]
  • P1803: Insufficient emergency access management (Cloud) [Added]
• T2790: Use privileged access workstations (AWS) [Added]
  • P1804: Insufficiently secured administrative access (Cloud) [Added]
• T2791: Follow just enough administration (least privilege) principle (AWS) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T2792: Determine access process for cloud provider support (AWS) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T2793: Discover, classify, and label sensitive data (AWS) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T2794: Monitor anomalies and threats targeting sensitive data (AWS) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T2795: Encrypt sensitive data in transit (AWS) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T2796: Enable data at rest encryption by default (AWS) [Added]
  • P1810: Unprotected data at rest (Cloud) [Added]
• T2797: Use customer-managed key option in data at rest encryption when required (AWS) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2798: Use a secure key management process (AWS) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2799: Use a secure certificate management process (AWS) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T2800: Ensure security of key and certificate repository (AWS) [Added]
  • P1814: Unsecured key and certificate repository (Cloud) [Added]
• T2801: Track asset inventory and their risks (AWS) [Added]
  • P1815: Untracked and unmonitored cloud assets (Cloud) [Added]
• T2802: Use only approved services (AWS) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2803: Ensure security of asset lifecycle management (AWS) [Added]
  • P1817: Outdated security configurations (Cloud) [Added]
• T2804: Limit access to asset management (AWS) [Added]
  • P1818: Unauthorized access to asset management (Cloud) [Added]
• T2805: Use only approved applications in virtual machine (AWS) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T2806: Enable threat detection capabilities (AWS) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T2807: Enable threat detection for identity and access management (AWS) [Added]
  • P1821: Unmonitored identity and access management systems (Cloud) [Added]
• T2808: Enable logging for security investigation (AWS) [Added]
  • P1822: Insufficient logging and monitoring (Cloud) [Added]
• T2809: Enable network logging for security investigation (AWS) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2810: Centralize security log management and analysis (AWS) [Added]
  • P1824: Decentralized security log management (Cloud) [Added]
• T2811: Configure log storage retention (AWS) [Added]
  • P1825: Insufficient log storage retention periods (Cloud) [Added]
• T2812: Use approved time synchronization sources (AWS) [Added]
  • P1826: Unreliable logging timestamps (Cloud) [Added]
• T2813: Preparation - update incident response plan and handling process (AWS) [Added]
  • P1827: Inadequate incident response planning (Cloud) [Added]
• T2814: Preparation - setup incident notification (AWS) [Added]
  • P1828: Inadequate incident notification setup (Cloud) [Added]
• T2815: Detection and analysis - create incidents based on high-quality alerts (AWS) [Added]
  • P1829: Insufficient alert quality management (Cloud) [Added]
• T2816: Detection and analysis - investigate an incident (AWS) [Added]
  • P1830: Inadequate data collection and analysis (Cloud) [Added]
• T2817: Detection and analysis - prioritize incidents (AWS) [Added]
  • P1831: Insufficient incident prioritization (Cloud) [Added]
• T2818: Containment, eradication and recovery - automate the incident handling (AWS) [Added]
  • P1832: Inefficient manual incident handling processes (Cloud) [Added]
• T2819: Post-incident activity - conduct lessons learned and retain evidence (AWS) [Added]
  • P1833: Failure to document incident response efforts (Cloud) [Added]
• T2820: Define and establish secure configurations (AWS) [Added]
  • P1834: Inconsistent cloud resource configurations (Cloud) [Added]
• T2821: Audit and enforce secure configurations (AWS) [Added]
  • P1835: Unsecured system configurations (Cloud) [Added]
• T2822: Define and establish secure configurations for compute resources (AWS) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T2823: Audit and enforce secure configurations for compute resources (AWS) [Added]
  • P1837: Unsecured compute resource configurations (Cloud) [Added]
• T2824: Perform vulnerability assessments (AWS) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T2825: Rapidly and automatically remediate vulnerabilities (AWS) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T2826: Conduct regular red team operations (AWS) [Added]
  • P1840: Overreliance on traditional vulnerability scanning (Cloud) [Added]
• T2827: Use Endpoint Detection and Response (EDR) (AWS) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T2828: Use modern anti-malware software (AWS) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T2829: Ensure anti-malware software and signatures are updated (AWS) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T2830: Ensure regular automated backups (AWS) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T2831: Protect backup and recovery data (AWS) [Added]
  • P1845: Unsecured backup and recovery data (Cloud) [Added]
• T2832: Monitor backups (AWS) [Added]
  • P1846: Inadequate backup monitoring (Cloud) [Added]
• T2833: Regularly test backup (AWS) [Added]
  • P1847: Inadequate backup verification (Cloud) [Added]
• T2834: Conduct threat modeling (AWS) [Added]
  • P1848: Inadequate threat identification and mitigation (Cloud) [Added]
• T2835: Ensure software supply chain security (AWS) [Added]
  • P1849: Unsecured software supply chain (Cloud) [Added]
• T2836: Secure DevOps infrastructure (AWS) [Added]
  • P1850: Unsecured DevOps infrastructure (Cloud) [Added]
• T2837: Integrate static application security testing into DevOps pipeline (AWS) [Added]
  • P1851: Insufficient code review and testing (Cloud) [Added]
• T2838: Integrate dynamic application security testing into DevOps pipeline (AWS) [Added]
  • P1852: Insufficient security testing in CI/CD pipelines (Cloud) [Added]
• T2839: Enforce security of workload throughout DevOps lifecycle (AWS) [Added]
  • P1853: Inadequate DevOps security practices (Cloud) [Added]
• T2840: Enable logging and monitoring in DevOps (AWS) [Added]
  • P1854: Inadequate logging and monitoring in DevOps (Cloud) [Added]
• T2841: Align organization roles, responsibilities and accountabilities (AWS) [Added]
  • P1855: Lack of defined security roles and responsibilities (Cloud) [Added]
• T2842: Define and implement enterprise segmentation/separation of duties strategy (AWS) [Added]
  • P1856: Insufficient access control and segmentation (Cloud) [Added]
• T2843: Define and implement data protection strategy (AWS) [Added]
  • P1857: Inadequate data protection strategy (Cloud) [Added]
• T2844: Define and implement network security strategy (AWS) [Added]
  • P1858: Lack of unified network security strategy (Cloud) [Added]
• T2845: Define and implement security posture management strategy (AWS) [Added]
  • P1859: Inadequate cloud security configuration (Cloud) [Added]
• T2846: Define and implement identity and privileged access strategy (AWS) [Added]
  • P1860: Inadequate identity and access management (Cloud) [Added]
• T2847: Define and implement logging, threat detection and incident response strategy (AWS) [Added]
  • P1861: Inadequate logging and incident response (Cloud) [Added]
• T2848: Define and implement backup and recovery strategy (AWS) [Added]
  • P1862: Inadequate data backup and recovery processes (Cloud) [Added]
• T2849: Define and implement endpoint security strategy (AWS) [Added]
  • P1863: Unsecured endpoints (Cloud) [Added]
• T2850: Define and implement DevOps security strategy (AWS) [Added]
  • P1864: Inadequate DevOps security strategy (Cloud) [Added]
• T2851: Define and implement multi-cloud security strategy (AWS) [Added]
  • P1865: Lack of unified cloud security management (Cloud) [Added]
• T2852: Establish network segmentation boundaries (GCP) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2853: Secure cloud native services with network controls (GCP) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2854: Deploy firewall at the edge of enterprise network (GCP) [Added]
  • P1782: Uncontrolled network access (Cloud) [Added]
• T2855: Deploy intrusion detection/intrusion prevention systems (IDS/IPS) (GCP) [Added]
  • P1783: Unmonitored network traffic vulnerability (Cloud) [Added]
• T2856: Deploy DDOS protection (GCP) [Added]
  • P1784: Insufficient traffic filtering and rate limiting (Cloud) [Added]
• T2857: Deploy web application firewall (GCP) [Added]
  • P1785: Unprotected web applications (Cloud) [Added]
• T2858: Simplify network security configuration (GCP) [Added]
  • P1786: Overly complex network security configurations (Cloud) [Added]
• T2859: Detect and disable insecure services and protocols (GCP) [Added]
  • P1787: Outdated and vulnerable network services (Cloud) [Added]
• T2860: Connect on-premises or cloud network privately (GCP) [Added]
  • P1788: Unsecured public network connections (Cloud) [Added]
• T2861: Ensure Domain Name System (DNS) security (GCP) [Added]
  • P1789: Unsecured Domain Name System (DNS) (Cloud) [Added]
• T2862: Use centralized identity and authentication system (GCP) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T2863: Protect identity and authentication systems (GCP) [Added]
  • P1791: Unsecured identity and authentication systems (Cloud) [Added]
• T2864: Manage application identities securely and automatically (GCP) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2865: Authenticate server and services (GCP) [Added]
  • P1793: Unverified server identity (Cloud) [Added]
• T2866: Use single sign-on (SSO) for application access (GCP) [Added]
  • P1794: Insufficient authentication protocols (Cloud) [Added]
• T2867: Use strong authentication controls (GCP) [Added]
  • P1795: Weak password-based authentication (Cloud) [Added]
• T2868: Restrict resource access based on conditions (GCP) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T2869: Restrict the exposure of credentials and secrets (GCP) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T2870: Secure user access to existing applications (GCP) [Added]
  • P1798: Unsecured access to legacy applications (Cloud) [Added]
• T2871: Separate and limit highly privileged/administrative users (GCP) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T2872: Avoid standing access for user accounts and permissions (GCP) [Added]
  • P1800: Overly broad access permissions (Cloud) [Added]
• T2873: Manage lifecycle of identities and entitlements (GCP) [Added]
  • P1801: Uncontrolled identity and access management (Cloud) [Added]
• T2874: Review and reconcile user access regularly (GCP) [Added]
  • P1802: Unmonitored privileged access (Cloud) [Added]
• T2875: Set up emergency access (GCP) [Added]
  • P1803: Insufficient emergency access management (Cloud) [Added]
• T2876: Use privileged access workstations (GCP) [Added]
  • P1804: Insufficiently secured administrative access (Cloud) [Added]
• T2877: Follow just enough administration (least privilege) principle (GCP) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T2878: Determine access process for cloud provider support (GCP) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T2879: Discover, classify, and label sensitive data (GCP) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T2880: Monitor anomalies and threats targeting sensitive data (GCP) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T2881: Encrypt sensitive data in transit (GCP) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T2882: Enable data at rest encryption by default (GCP) [Added]
  • P1810: Unprotected data at rest (Cloud) [Added]
• T2883: Use customer-managed key option in data at rest encryption when required (GCP) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2884: Use a secure key management process (GCP) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2885: Use a secure certificate management process (GCP) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T2886: Ensure security of key and certificate repository (GCP) [Added]
  • P1814: Unsecured key and certificate repository (Cloud) [Added]
• T2887: Track asset inventory and their risks (GCP) [Added]
  • P1815: Untracked and unmonitored cloud assets (Cloud) [Added]
• T2888: Use only approved services (GCP) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2889: Ensure security of asset lifecycle management (GCP) [Added]
  • P1817: Outdated security configurations (Cloud) [Added]
• T2890: Limit access to asset management (GCP) [Added]
  • P1818: Unauthorized access to asset management (Cloud) [Added]
• T2891: Use only approved applications in virtual machine (GCP) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T2892: Enable threat detection capabilities (GCP) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T2893: Enable threat detection for identity and access management (GCP) [Added]
  • P1821: Unmonitored identity and access management systems (Cloud) [Added]
• T2894: Enable logging for security investigation (GCP) [Added]
  • P1822: Insufficient logging and monitoring (Cloud) [Added]
• T2895: Enable network logging for security investigation (GCP) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2896: Centralize security log management and analysis (GCP) [Added]
  • P1824: Decentralized security log management (Cloud) [Added]
• T2897: Configure log storage retention (GCP) [Added]
  • P1825: Insufficient log storage retention periods (Cloud) [Added]
• T2898: Use approved time synchronization sources (GCP) [Added]
  • P1826: Unreliable logging timestamps (Cloud) [Added]
• T2899: Preparation - update incident response plan and handling process (GCP) [Added]
  • P1827: Inadequate incident response planning (Cloud) [Added]
• T2900: Preparation - setup incident notification (GCP) [Added]
  • P1828: Inadequate incident notification setup (Cloud) [Added]
• T2901: Detection and analysis - create incidents based on high-quality alerts (GCP) [Added]
  • P1829: Insufficient alert quality management (Cloud) [Added]
• T2902: Detection and analysis - investigate an incident (GCP) [Added]
  • P1830: Inadequate data collection and analysis (Cloud) [Added]
• T2903: Detection and analysis - prioritize incidents (GCP) [Added]
  • P1831: Insufficient incident prioritization (Cloud) [Added]
• T2904: Containment, eradication and recovery - automate the incident handling (GCP) [Added]
  • P1832: Inefficient manual incident handling processes (Cloud) [Added]
• T2905: Post-incident activity - conduct lessons learned and retain evidence (GCP) [Added]
  • P1833: Failure to document incident response efforts (Cloud) [Added]
• T2906: Define and establish secure configurations (GCP) [Added]
  • P1834: Inconsistent cloud resource configurations (Cloud) [Added]
• T2907: Audit and enforce secure configurations (GCP) [Added]
  • P1835: Unsecured system configurations (Cloud) [Added]
• T2908: Define and establish secure configurations for compute resources (GCP) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T2909: Audit and enforce secure configurations for compute resources (GCP) [Added]
  • P1837: Unsecured compute resource configurations (Cloud) [Added]
• T2910: Perform vulnerability assessments (GCP) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T2911: Rapidly and automatically remediate vulnerabilities (GCP) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T2912: Conduct regular red team operations (GCP) [Added]
  • P1840: Overreliance on traditional vulnerability scanning (Cloud) [Added]
• T2913: Use Endpoint Detection and Response (EDR) (GCP) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T2914: Use modern anti-malware software (GCP) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T2915: Ensure anti-malware software and signatures are updated (GCP) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T2916: Ensure regular automated backups (GCP) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T2917: Protect backup and recovery data (GCP) [Added]
  • P1845: Unsecured backup and recovery data (Cloud) [Added]
• T2918: Monitor backups (GCP) [Added]
  • P1846: Inadequate backup monitoring (Cloud) [Added]
• T2919: Regularly test backup (GCP) [Added]
  • P1847: Inadequate backup verification (Cloud) [Added]
• T2920: Conduct threat modeling (GCP) [Added]
  • P1848: Inadequate threat identification and mitigation (Cloud) [Added]
• T2921: Ensure software supply chain security (GCP) [Added]
  • P1849: Unsecured software supply chain (Cloud) [Added]
• T2922: Secure DevOps infrastructure (GCP) [Added]
  • P1850: Unsecured DevOps infrastructure (Cloud) [Added]
• T2923: Integrate static application security testing into DevOps pipeline (GCP) [Added]
  • P1851: Insufficient code review and testing (Cloud) [Added]
• T2924: Integrate dynamic application security testing into DevOps pipeline (GCP) [Added]
  • P1852: Insufficient security testing in CI/CD pipelines (Cloud) [Added]
• T2925: Enforce security of workload throughout DevOps lifecycle (GCP) [Added]
  • P1853: Inadequate DevOps security practices (Cloud) [Added]
• T2926: Enable logging and monitoring in DevOps (GCP) [Added]
  • P1854: Inadequate logging and monitoring in DevOps (Cloud) [Added]
• T2927: Align organization roles, responsibilities and accountabilities (GCP) [Added]
  • P1855: Lack of defined security roles and responsibilities (Cloud) [Added]
• T2928: Define and implement enterprise segmentation/separation of duties strategy (GCP) [Added]
  • P1856: Insufficient access control and segmentation (Cloud) [Added]
• T2929: Define and implement data protection strategy (GCP) [Added]
  • P1857: Inadequate data protection strategy (Cloud) [Added]
• T2930: Define and implement network security strategy (GCP) [Added]
  • P1858: Lack of unified network security strategy (Cloud) [Added]
• T2931: Define and implement security posture management strategy (GCP) [Added]
  • P1859: Inadequate cloud security configuration (Cloud) [Added]
• T2932: Define and implement identity and privileged access strategy (GCP) [Added]
  • P1860: Inadequate identity and access management (Cloud) [Added]
• T2933: Define and implement logging, threat detection and incident response strategy (GCP) [Added]
  • P1861: Inadequate logging and incident response (Cloud) [Added]
• T2934: Define and implement backup and recovery strategy (GCP) [Added]
  • P1862: Inadequate data backup and recovery processes (Cloud) [Added]
• T2935: Define and implement endpoint security strategy (GCP) [Added]
  • P1863: Unsecured endpoints (Cloud) [Added]
• T2936: Define and implement DevOps security strategy (GCP) [Added]
  • P1864: Inadequate DevOps security strategy (Cloud) [Added]
• T2937: Define and implement multi-cloud security strategy (GCP) [Added]
  • P1865: Lack of unified cloud security management (Cloud) [Added]
• T2938: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Bastion) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T2939: Configure Azure Policy Support (Azure Bastion) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2940: Configure Key Management in Azure Key Vault (Azure Bastion) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2941: Configure Network Security Group Support (Azure Bastion) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2942: Configure Azure Resource Logs (Azure Bastion) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2943: Configure Virtual Network Integration (Azure Bastion) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2944: Configure Azure Policy Support (Azure Key Vault Managed HSM) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2945: Configure Conditional Access for Data Plane (Azure Key Vault Managed HSM) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T2946: Configure Data at Rest Encryption Using CMK (Azure Key Vault Managed HSM) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2947: Configure Disable Public Network Access (Azure Key Vault Managed HSM) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2948: Configure Key Management in Azure Key Vault (Azure Key Vault Managed HSM) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2949: Configure Service Native Backup Capability (Azure Key Vault Managed HSM) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T2950: Configure Azure Private Link (Azure Key Vault Managed HSM) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2951: Configure Azure Resource Logs (Azure Key Vault Managed HSM) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2952: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Databricks) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T2953: Configure Azure Policy Support (Azure Databricks) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2954: Configure Customer Lockbox (Azure Databricks) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T2955: Configure Data at Rest Encryption Using CMK (Azure Databricks) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2956: Configure Data in Transit Encryption (Azure Databricks) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T2957: Configure Disable Public Network Access (Azure Databricks) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2958: Configure Key Management in Azure Key Vault (Azure Databricks) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2959: Configure Service Native Backup Capability (Azure Databricks) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T2960: Configure Network Security Group Support (Azure Databricks) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2961: Configure Azure Resource Logs (Azure Databricks) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2962: Configure Service Principals (Azure Databricks) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2963: Configure Virtual Network Integration (Azure Databricks) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2964: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Key Vault) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T2965: Configure Azure Policy Support (Azure Key Vault) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T2966: Configure Azure RBAC for Data Plane (Azure Key Vault) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T2967: Configure Certificate Management in Azure Key Vault (Azure Key Vault) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T2968: Configure Conditional Access for Data Plane (Azure Key Vault) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T2969: Configure Data at Rest Encryption Using CMK (Azure Key Vault) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2970: Configure Microsoft Defender for Service / Product Offering (Azure Key Vault) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T2971: Configure Disable Public Network Access (Azure Key Vault) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2972: Configure Key Management in Azure Key Vault (Azure Key Vault) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2973: Configure Managed Identities (Azure Key Vault) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2974: Configure Service Native Backup Capability (Azure Key Vault) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T2975: Configure Network Security Group Support (Azure Key Vault) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2976: Configure Azure Private Link (Azure Key Vault) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2977: Configure Azure Resource Logs (Azure Key Vault) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2978: Configure Service Principals (Azure Key Vault) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2979: Configure Virtual Network Integration (Azure Key Vault) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2980: Configure Azure RBAC for Data Plane (Azure Resource Mover) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T2981: Configure Managed Identities (Azure Resource Mover) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2982: Configure Service Principals (Azure Resource Mover) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2983: Configure Azure AD Authentication Required for Data Plane Access (Azure Database for MySQL) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T2984: Configure Conditional Access for Data Plane (Azure Database for MySQL) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T2985: Configure Customer Lockbox (Azure Database for MySQL) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T2986: Configure Data at Rest Encryption Using CMK (Azure Database for MySQL) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T2987: Configure Disable Public Network Access (Azure Database for MySQL) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T2988: Configure Key Management in Azure Key Vault (Azure Database for MySQL) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T2989: Configure Network Security Group Support (Azure Database for MySQL) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2990: Configure Azure Resource Logs (Azure Database for MySQL) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2991: Configure Virtual Network Integration (Azure Database for MySQL) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2992: Configure Azure AD Authentication Required for Data Plane Access (Azure Spring Apps) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T2993: Configure Azure RBAC for Data Plane (Azure Spring Apps) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T2994: Configure Certificate Management in Azure Key Vault (Azure Spring Apps) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T2995: Configure Customer Lockbox (Azure Spring Apps) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T2996: Configure Managed Identities (Azure Spring Apps) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T2997: Configure Network Security Group Support (Azure Spring Apps) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T2998: Configure Azure Resource Logs (Azure Spring Apps) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T2999: Configure Service Principals (Azure Spring Apps) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3000: Configure Virtual Network Integration (Azure Spring Apps) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3001: Configure Azure Policy Support (Azure Virtual Network) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3002: Configure Azure Resource Logs (Azure Virtual Network) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3003: Configure Azure AD Authentication Required for Data Plane Access (Azure Functions) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3004: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Functions) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3005: Configure Azure Policy Support (Azure Functions) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3006: Configure Azure RBAC for Data Plane (Azure Functions) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3007: Configure Certificate Management in Azure Key Vault (Azure Functions) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3008: Configure Conditional Access for Data Plane (Azure Functions) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3009: Configure Customer Lockbox (Azure Functions) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3010: Configure Data at Rest Encryption Using CMK (Azure Functions) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3011: Configure Data in Transit Encryption (Azure Functions) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3012: Configure Microsoft Defender for Service / Product Offering (Azure Functions) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3013: Configure Disable Public Network Access (Azure Functions) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3014: Configure Key Management in Azure Key Vault (Azure Functions) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3015: Configure Managed Identities (Azure Functions) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3016: Configure Service Native Backup Capability (Azure Functions) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3017: Configure Network Security Group Support (Azure Functions) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3018: Configure Azure Private Link (Azure Functions) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3019: Configure Azure Resource Logs (Azure Functions) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3020: Configure Service Principals (Azure Functions) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3021: Configure Virtual Network Integration (Azure Functions) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3022: Configure Azure AD Authentication Required for Data Plane Access (Azure DevTest Labs) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3023: Configure Microsoft Defender for Cloud - Adaptive Application Controls (Azure DevTest Labs) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T3024: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure DevTest Labs) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3025: Configure Anti-Malware Solution (Azure DevTest Labs) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3026: Configure Anti-Malware Solution Health Monitoring (Azure DevTest Labs) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3027: Configure Azure Automation State Configuration (Azure DevTest Labs) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3028: Configure Azure Automation Update Management (Azure DevTest Labs) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T3029: Configure Azure Backup (Azure DevTest Labs) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3030: Configure Azure Policy Guest Configuration Agent (Azure DevTest Labs) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3031: Configure Azure Policy Support (Azure DevTest Labs) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3032: Configure Azure RBAC for Data Plane (Azure DevTest Labs) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3033: Configure Certificate Management in Azure Key Vault (Azure DevTest Labs) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3034: Configure Conditional Access for Data Plane (Azure DevTest Labs) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3035: Configure Disable Public Network Access (Azure DevTest Labs) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3036: Configure Key Management in Azure Key Vault (Azure DevTest Labs) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3037: Configure Managed Identities (Azure DevTest Labs) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3038: Configure Network Security Group Support (Azure DevTest Labs) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3039: Configure Service Principals (Azure DevTest Labs) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3040: Configure Vulnerability Assessment using Microsoft Defender (Azure DevTest Labs) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T3041: Configure Azure Policy Support (Azure Load Balancer) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3042: Configure Network Security Group Support (Azure Load Balancer) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3043: Configure Virtual Network Integration (Azure Load Balancer) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3044: Configure Azure Policy Support (Azure Content Delivery Network) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3045: Configure Azure RBAC for Data Plane (Azure Content Delivery Network) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3046: Configure Certificate Management in Azure Key Vault (Azure Content Delivery Network) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3047: Configure Data in Transit Encryption (Azure Content Delivery Network) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3048: Configure Azure Resource Logs (Azure Content Delivery Network) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3049: Configure Azure Policy Support (Azure Private Link) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3050: Configure Network Security Group Support (Azure Private Link) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3051: Configure Azure Policy Support (Azure Digital Twins) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3052: Configure Azure RBAC for Data Plane (Azure Digital Twins) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3053: Configure Conditional Access for Data Plane (Azure Digital Twins) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3054: Configure Disable Public Network Access (Azure Digital Twins) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3055: Configure Managed Identities (Azure Digital Twins) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3056: Configure Azure Private Link (Azure Digital Twins) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3057: Configure Azure Resource Logs (Azure Digital Twins) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3058: Configure Service Principals (Azure Digital Twins) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3059: Configure Azure AD Authentication Required for Data Plane Access (Azure Kubernetes Service (AKS)) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3060: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Kubernetes Service (AKS)) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3061: Configure Azure Backup (Azure Kubernetes Service (AKS)) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3062: Configure Azure Policy Support (Azure Kubernetes Service (AKS)) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3063: Configure Azure RBAC for Data Plane (Azure Kubernetes Service (AKS)) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3064: Configure Certificate Management in Azure Key Vault (Azure Kubernetes Service (AKS)) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3065: Configure Conditional Access for Data Plane (Azure Kubernetes Service (AKS)) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3066: Configure Customer Lockbox (Azure Kubernetes Service (AKS)) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3067: Configure Data at Rest Encryption Using CMK (Azure Kubernetes Service (AKS)) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3068: Configure Data at Rest Encryption Using Platform Keys (Azure Kubernetes Service (AKS)) [Added]
  • P1810: Unprotected data at rest (Cloud) [Added]
• T3069: Configure Data in Transit Encryption (Azure Kubernetes Service (AKS)) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3070: Configure Data Leakage/Loss Prevention (Azure Kubernetes Service (AKS)) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3071: Configure Microsoft Defender for Service / Product Offering (Azure Kubernetes Service (AKS)) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3072: Configure Disable Public Network Access (Azure Kubernetes Service (AKS)) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3073: Configure Key Management in Azure Key Vault (Azure Kubernetes Service (AKS)) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3074: Configure Local Admin Accounts (Azure Kubernetes Service (AKS)) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3075: Configure Local Authentication Methods for Data Plane Access (Azure Kubernetes Service (AKS)) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3076: Configure Azure Private Link (Azure Kubernetes Service (AKS)) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3077: Configure Azure Resource Logs (Azure Kubernetes Service (AKS)) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3078: Configure Service Principals (Azure Kubernetes Service (AKS)) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3079: Configure Azure AD Authentication Required for Data Plane Access (Azure Media Services) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3080: Configure Azure Policy Support (Azure Media Services) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3081: Configure Azure RBAC for Data Plane (Azure Media Services) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3082: Configure Data at Rest Encryption Using CMK (Azure Media Services) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3083: Configure Disable Public Network Access (Azure Media Services) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3084: Configure Azure Private Link (Azure Media Services) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3085: Configure Azure Resource Logs (Azure Media Services) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3086: Configure Service Principals (Azure Media Services) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3087: Configure Azure Policy Support (Azure Data Lake Analytics) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3088: Configure Disable Public Network Access (Azure Data Lake Analytics) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3089: Configure Azure Policy Support (Azure Firewall Manager) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3090: Configure Certificate Management in Azure Key Vault (Azure Firewall Manager) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3091: Configure Azure AD Authentication Required for Data Plane Access (Azure IoT Central) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3092: Configure Azure Policy Support (Azure IoT Central) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3093: Configure Disable Public Network Access (Azure IoT Central) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3094: Configure Local Authentication Methods for Data Plane Access (Azure IoT Central) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3095: Configure Managed Identities (Azure IoT Central) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3096: Configure Azure Private Link (Azure IoT Central) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3097: Configure Service Principals (Azure IoT Central) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3098: Configure Azure AD Authentication Required for Data Plane Access (Azure Virtual Desktop) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3099: Configure Anti-Malware Solution (Azure Virtual Desktop) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3100: Configure Anti-Malware Solution Health Monitoring (Azure Virtual Desktop) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3101: Configure Azure Backup (Azure Virtual Desktop) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3102: Configure Azure Policy Support (Azure Virtual Desktop) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3103: Configure Azure RBAC for Data Plane (Azure Virtual Desktop) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3104: Configure Conditional Access for Data Plane (Azure Virtual Desktop) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3105: Configure Custom VM Images (Azure Virtual Desktop) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3106: Configure Data Leakage/Loss Prevention (Azure Virtual Desktop) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3107: Configure Microsoft Defender for Service / Product Offering (Azure Virtual Desktop) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3108: Configure EDR Solution (Azure Virtual Desktop) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T3109: Configure Local Admin Accounts (Azure Virtual Desktop) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3110: Configure Managed Identities (Azure Virtual Desktop) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3111: Configure Network Security Group Support (Azure Virtual Desktop) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3112: Configure Azure Private Link (Azure Virtual Desktop) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3113: Configure Azure Resource Logs (Azure Virtual Desktop) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3114: Configure Sensitive Data Discovery and Classification (Azure Virtual Desktop) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3115: Configure Service Principals (Azure Virtual Desktop) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3116: Configure Virtual Network Integration (Azure Virtual Desktop) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3117: Configure Vulnerability Assessment using Microsoft Defender (Azure Virtual Desktop) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T3118: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Stack Edge) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3119: Configure Azure Backup (Azure Stack Edge) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3120: Configure Azure Policy Support (Azure Stack Edge) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3121: Configure Data at Rest Encryption Using CMK (Azure Stack Edge) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3122: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Application Gateway) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3123: Configure Azure Policy Support (Azure Application Gateway) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3124: Configure Certificate Management in Azure Key Vault (Azure Application Gateway) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3125: Configure Data in Transit Encryption (Azure Application Gateway) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3126: Configure Network Security Group Support (Azure Application Gateway) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3127: Configure Azure Private Link (Azure Application Gateway) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3128: Configure Azure Resource Logs (Azure Application Gateway) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3129: Configure Azure AD Authentication Required for Data Plane Access (Azure Web PubSub) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3130: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Web PubSub) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3131: Configure Azure Policy Support (Azure Web PubSub) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3132: Configure Azure RBAC for Data Plane (Azure Web PubSub) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3133: Configure Conditional Access for Data Plane (Azure Web PubSub) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3134: Configure Disable Public Network Access (Azure Web PubSub) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3135: Configure Key Management in Azure Key Vault (Azure Web PubSub) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3136: Configure Managed Identities (Azure Web PubSub) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3137: Configure Azure Private Link (Azure Web PubSub) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3138: Configure Azure Resource Logs (Azure Web PubSub) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3139: Configure Service Principals (Azure Web PubSub) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3140: Configure Azure AD Authentication Required for Data Plane Access (Azure Container Apps) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3141: Configure Azure Policy Support (Azure Container Apps) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3142: Configure Data in Transit Encryption (Azure Container Apps) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3143: Configure Disable Public Network Access (Azure Container Apps) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3144: Configure Managed Identities (Azure Container Apps) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3145: Configure Network Security Group Support (Azure Container Apps) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3146: Configure Service Principals (Azure Container Apps) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3147: Configure Virtual Network Integration (Azure Container Apps) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3148: Configure Azure AD Authentication Required for Data Plane Access (Azure Purview) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3149: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Purview) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3150: Configure Azure Policy Support (Azure Purview) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3151: Configure Azure RBAC for Data Plane (Azure Purview) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3152: Configure Conditional Access for Data Plane (Azure Purview) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3153: Configure Disable Public Network Access (Azure Purview) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3154: Configure Key Management in Azure Key Vault (Azure Purview) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3155: Configure Managed Identities (Azure Purview) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3156: Configure Network Security Group Support (Azure Purview) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3157: Configure Azure Private Link (Azure Purview) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3158: Configure Azure Resource Logs (Azure Purview) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3159: Configure Service Principals (Azure Purview) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3160: Configure Virtual Network Integration (Azure Purview) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3161: Configure Azure AD Authentication Required for Data Plane Access (Azure VPN Gateway) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3162: Configure Azure Policy Support (Azure VPN Gateway) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3163: Configure Conditional Access for Data Plane (Azure VPN Gateway) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3164: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Virtual WAN) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3165: Configure Azure Policy Support (Azure Virtual WAN) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3166: Configure Data in Transit Encryption (Azure Virtual WAN) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3167: Configure Key Management in Azure Key Vault (Azure Virtual WAN) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3168: Configure Azure Resource Logs (Azure Virtual WAN) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3169: Configure Azure AD Authentication Required for Data Plane Access (Azure Site Recovery) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3170: Configure Azure Policy Support (Azure Site Recovery) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3171: Configure Azure RBAC for Data Plane (Azure Site Recovery) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3172: Configure Certificate Management in Azure Key Vault (Azure Site Recovery) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3173: Configure Data at Rest Encryption Using CMK (Azure Site Recovery) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3174: Configure Key Management in Azure Key Vault (Azure Site Recovery) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3175: Configure Azure Private Link (Azure Site Recovery) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3176: Configure Azure Resource Logs (Azure Site Recovery) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3177: Configure Service Principals (Azure Site Recovery) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3178: Configure Conditional Access for Data Plane (Azure Analysis Services) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3179: Configure Managed Identities (Azure Analysis Services) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3180: Configure Service Native Backup Capability (Azure Analysis Services) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3181: Configure Azure Resource Logs (Azure Analysis Services) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3182: Configure Service Principals (Azure Analysis Services) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3183: Configure Azure Policy Support (Azure Data Box) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3184: Configure Azure RBAC for Data Plane (Azure Data Box) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3185: Configure Customer Lockbox (Azure Data Box) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3186: Configure Data at Rest Encryption Using CMK (Azure Data Box) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3187: Configure Azure Policy Support (Azure Container Instances) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3188: Configure Azure RBAC for Data Plane (Azure Container Instances) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3189: Configure Conditional Access for Data Plane (Azure Container Instances) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3190: Configure Data at Rest Encryption Using CMK (Azure Container Instances) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3191: Configure Data at Rest Encryption Using Platform Keys (Azure Container Instances) [Added]
  • P1810: Unprotected data at rest (Cloud) [Added]
• T3192: Configure Key Management in Azure Key Vault (Azure Container Instances) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3193: Configure Managed Identities (Azure Container Instances) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3194: Configure Network Security Group Support (Azure Container Instances) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3195: Configure Azure Resource Logs (Azure Container Instances) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3196: Configure Virtual Network Integration (Azure Container Instances) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3197: Configure Azure Policy Support (Azure Arc) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3198: Configure Microsoft Defender for Service / Product Offering (Azure Arc) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3199: Configure Disable Public Network Access (Azure Arc) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3200: Configure Local Admin Accounts (Azure Arc) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3201: Configure Local Authentication Methods for Data Plane Access (Azure Arc) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3202: Configure Azure Private Link (Azure Arc) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3203: Configure Service Principals (Azure Arc) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3204: Configure Azure AD Authentication Required for Data Plane Access (Azure Logic Apps) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3205: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Logic Apps) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3206: Configure Azure Policy Support (Azure Logic Apps) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3207: Configure Certificate Management in Azure Key Vault (Azure Logic Apps) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3208: Configure Customer Lockbox (Azure Logic Apps) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3209: Configure Data at Rest Encryption Using CMK (Azure Logic Apps) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3210: Configure Microsoft Defender for Service / Product Offering (Azure Logic Apps) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3211: Configure Disable Public Network Access (Azure Logic Apps) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3212: Configure Key Management in Azure Key Vault (Azure Logic Apps) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3213: Configure Local Authentication Methods for Data Plane Access (Azure Logic Apps) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3214: Configure Managed Identities (Azure Logic Apps) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3215: Configure Network Security Group Support (Azure Logic Apps) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3216: Configure Azure Private Link (Azure Logic Apps) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3217: Configure Azure Resource Logs (Azure Logic Apps) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3218: Configure Service Principals (Azure Logic Apps) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3219: Configure Virtual Network Integration (Azure Logic Apps) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3220: Configure Azure Policy Support (Azure Monitor) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3221: Configure Conditional Access for Data Plane (Azure Monitor) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3222: Configure Customer Lockbox (Azure Monitor) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3223: Configure Data at Rest Encryption Using CMK (Azure Monitor) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3224: Configure Data in Transit Encryption (Azure Monitor) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3225: Configure Disable Public Network Access (Azure Monitor) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3226: Configure Managed Identities (Azure Monitor) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3227: Configure Network Security Group Support (Azure Monitor) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3228: Configure Azure Private Link (Azure Monitor) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3229: Configure Service Principals (Azure Monitor) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3230: Configure Virtual Network Integration (Azure Monitor) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3231: Configure Azure AD Authentication Required for Data Plane Access (Azure App Configuration) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3232: Configure Azure Policy Support (Azure App Configuration) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3233: Configure Azure RBAC for Data Plane (Azure App Configuration) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3234: Configure Conditional Access for Data Plane (Azure App Configuration) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3235: Configure Data at Rest Encryption Using CMK (Azure App Configuration) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3236: Configure Disable Public Network Access (Azure App Configuration) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3237: Configure Managed Identities (Azure App Configuration) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3238: Configure Network Security Group Support (Azure App Configuration) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3239: Configure Azure Private Link (Azure App Configuration) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3240: Configure Azure Resource Logs (Azure App Configuration) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3241: Configure Service Principals (Azure App Configuration) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3242: Configure Virtual Network Integration (Azure App Configuration) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3243: Configure Azure AD Authentication Required for Data Plane Access (Azure API Management) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3244: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure API Management) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3245: Configure Azure Policy Support (Azure API Management) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3246: Configure Azure RBAC for Data Plane (Azure API Management) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3247: Configure Certificate Management in Azure Key Vault (Azure API Management) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3248: Configure Customer Lockbox (Azure API Management) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3249: Configure Disable Public Network Access (Azure API Management) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3250: Configure Key Management in Azure Key Vault (Azure API Management) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3251: Configure Local Admin Accounts (Azure API Management) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3252: Configure Local Authentication Methods for Data Plane Access (Azure API Management) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3253: Configure Managed Identities (Azure API Management) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3254: Configure Service Native Backup Capability (Azure API Management) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3255: Configure Network Security Group Support (Azure API Management) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3256: Configure Azure Private Link (Azure API Management) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3257: Configure Azure Resource Logs (Azure API Management) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3258: Configure Service Principals (Azure API Management) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3259: Configure Virtual Network Integration (Azure API Management) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3260: Configure Azure AD Authentication Required for Data Plane Access (Azure Windows Virtual Machines) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3261: Configure Microsoft Defender for Cloud - Adaptive Application Controls (Azure Windows Virtual Machines) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T3262: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Windows Virtual Machines) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3263: Configure Anti-Malware Solution (Azure Windows Virtual Machines) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3264: Configure Anti-Malware Solution Health Monitoring (Azure Windows Virtual Machines) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3265: Configure Azure Automation State Configuration (Azure Windows Virtual Machines) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3266: Configure Azure Automation Update Management (Azure Windows Virtual Machines) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T3267: Configure Azure Backup (Azure Windows Virtual Machines) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3268: Configure Azure Policy Guest Configuration Agent (Azure Windows Virtual Machines) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3269: Configure Azure Policy Support (Azure Windows Virtual Machines) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3270: Configure Azure RBAC for Data Plane (Azure Windows Virtual Machines) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3271: Configure Conditional Access for Data Plane (Azure Windows Virtual Machines) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3272: Configure Customer Lockbox (Azure Windows Virtual Machines) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3273: Configure Custom VM Images (Azure Windows Virtual Machines) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3274: Configure Data at Rest Encryption Using CMK (Azure Windows Virtual Machines) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3275: Configure Data in Transit Encryption (Azure Windows Virtual Machines) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3276: Configure Microsoft Defender for Service / Product Offering (Azure Windows Virtual Machines) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3277: Configure Disable Public Network Access (Azure Windows Virtual Machines) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3278: Configure EDR Solution (Azure Windows Virtual Machines) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T3279: Configure Key Management in Azure Key Vault (Azure Windows Virtual Machines) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3280: Configure Managed Identities (Azure Windows Virtual Machines) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3281: Configure Network Security Group Support (Azure Windows Virtual Machines) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3282: Configure Azure Resource Logs (Azure Windows Virtual Machines) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3283: Configure Service Principals (Azure Windows Virtual Machines) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3284: Configure Vulnerability Assessment using Microsoft Defender (Azure Windows Virtual Machines) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T3285: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Front Door) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3286: Configure Certificate Management in Azure Key Vault (Azure Front Door) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3287: Configure Key Management in Azure Key Vault (Azure Front Door) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3288: Configure Azure Private Link (Azure Front Door) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3289: Configure Azure Resource Logs (Azure Front Door) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3290: Configure Azure AD Authentication Required for Data Plane Access (Azure Data Factory) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3291: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Data Factory) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3292: Configure Azure Policy Support (Azure Data Factory) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3293: Configure Certificate Management in Azure Key Vault (Azure Data Factory) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3294: Configure Conditional Access for Data Plane (Azure Data Factory) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3295: Configure Customer Lockbox (Azure Data Factory) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3296: Configure Data at Rest Encryption Using CMK (Azure Data Factory) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3297: Configure Disable Public Network Access (Azure Data Factory) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3298: Configure Key Management in Azure Key Vault (Azure Data Factory) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3299: Configure Local Authentication Methods for Data Plane Access (Azure Data Factory) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3300: Configure Managed Identities (Azure Data Factory) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3301: Configure Service Native Backup Capability (Azure Data Factory) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3302: Configure Network Security Group Support (Azure Data Factory) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3303: Configure Azure Private Link (Azure Data Factory) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3304: Configure Sensitive Data Discovery and Classification (Azure Data Factory) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3305: Configure Service Principals (Azure Data Factory) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3306: Configure Virtual Network Integration (Azure Data Factory) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3307: Configure Azure AD Authentication Required for Data Plane Access (Azure Remote Rendering) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3308: Configure Azure RBAC for Data Plane (Azure Remote Rendering) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3309: Configure Service Principals (Azure Remote Rendering) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3310: Configure Azure Policy Support (Azure DDoS Protection) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3311: Configure Azure Resource Logs (Azure DDoS Protection) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3312: Configure Azure Policy Support (Azure Traffic Manager) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3313: Configure Azure Resource Logs (Azure Traffic Manager) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3314: Configure Azure Policy Support (Azure DNS) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3315: Configure Azure RBAC for Data Plane (Azure DNS) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3316: Configure Microsoft Defender for Service / Product Offering (Azure DNS) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3317: Configure Azure Resource Logs (Azure DNS) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3318: Configure Azure Policy Support (Azure Container Registry) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3319: Configure Customer Lockbox (Azure Container Registry) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3320: Configure Data at Rest Encryption Using CMK (Azure Container Registry) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3321: Configure Data Leakage/Loss Prevention (Azure Container Registry) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3322: Configure Microsoft Defender for Service / Product Offering (Azure Container Registry) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3323: Configure Disable Public Network Access (Azure Container Registry) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3324: Configure Local Admin Accounts (Azure Container Registry) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3325: Configure Local Authentication Methods for Data Plane Access (Azure Container Registry) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3326: Configure Managed Identities (Azure Container Registry) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3327: Configure Azure Private Link (Azure Container Registry) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3328: Configure Azure Resource Logs (Azure Container Registry) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3329: Configure Service Principals (Azure Container Registry) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3330: Configure Azure Policy Support (Azure Data Share) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3331: Configure Azure Resource Logs (Azure Data Share) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3332: Configure Azure AD Authentication Required for Data Plane Access (Azure Event Hubs) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3333: Configure Azure Policy Support (Azure Event Hubs) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3334: Configure Azure RBAC for Data Plane (Azure Event Hubs) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3335: Configure Conditional Access for Data Plane (Azure Event Hubs) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3336: Configure Data at Rest Encryption Using CMK (Azure Event Hubs) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3337: Configure Key Management in Azure Key Vault (Azure Event Hubs) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3338: Configure Managed Identities (Azure Event Hubs) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3339: Configure Network Security Group Support (Azure Event Hubs) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3340: Configure Azure Private Link (Azure Event Hubs) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3341: Configure Azure Resource Logs (Azure Event Hubs) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3342: Configure Service Principals (Azure Event Hubs) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3343: Configure Virtual Network Integration (Azure Event Hubs) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3344: Configure Azure AD Authentication Required for Data Plane Access (Azure Network Watcher) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3345: Configure Azure Policy Support (Azure Network Watcher) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3346: Configure Azure RBAC for Data Plane (Azure Network Watcher) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3347: Configure Azure Policy Support (Azure Defender for Cloud) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3348: Configure Azure RBAC for Data Plane (Azure Defender for Cloud) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3349: Configure Conditional Access for Data Plane (Azure Defender for Cloud) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3350: Configure Data at Rest Encryption Using CMK (Azure Defender for Cloud) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3351: Configure Key Management in Azure Key Vault (Azure Defender for Cloud) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3352: Configure Managed Identities (Azure Defender for Cloud) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3353: Configure Service Principals (Azure Defender for Cloud) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3354: Configure Azure Policy Support (Azure Cache for Redis) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3355: Configure Network Security Group Support (Azure Cache for Redis) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3356: Configure Azure Private Link (Azure Cache for Redis) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3357: Configure Azure Resource Logs (Azure Cache for Redis) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3358: Configure Virtual Network Integration (Azure Cache for Redis) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3359: Configure Azure RBAC for Data Plane (Azure Database Migration Service) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3360: Configure Network Security Group Support (Azure Database Migration Service) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3361: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Machine Learning) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3362: Configure Anti-Malware Solution (Azure Machine Learning) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3363: Configure Anti-Malware Solution Health Monitoring (Azure Machine Learning) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3364: Configure Azure Policy Guest Configuration Agent (Azure Machine Learning) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3365: Configure Azure Policy Support (Azure Machine Learning) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3366: Configure Azure RBAC for Data Plane (Azure Machine Learning) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3367: Configure Conditional Access for Data Plane (Azure Machine Learning) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3368: Configure Custom Containers Images (Azure Machine Learning) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3369: Configure Data at Rest Encryption Using CMK (Azure Machine Learning) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3370: Configure Data Leakage/Loss Prevention (Azure Machine Learning) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3371: Configure Disable Public Network Access (Azure Machine Learning) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3372: Configure Key Management in Azure Key Vault (Azure Machine Learning) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3373: Configure Managed Identities (Azure Machine Learning) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3374: Configure Network Security Group Support (Azure Machine Learning) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3375: Configure Azure Private Link (Azure Machine Learning) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3376: Configure Azure Resource Logs (Azure Machine Learning) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3377: Configure Sensitive Data Discovery and Classification (Azure Machine Learning) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3378: Configure Service Principals (Azure Machine Learning) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3379: Configure Virtual Network Integration (Azure Machine Learning) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3380: Configure Certificate Management in Azure Key Vault (Azure Automation) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3381: Configure Data at Rest Encryption Using CMK (Azure Automation) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3382: Configure Disable Public Network Access (Azure Automation) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3383: Configure Key Management in Azure Key Vault (Azure Automation) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3384: Configure Local Authentication Methods for Data Plane Access (Azure Automation) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3385: Configure Azure Private Link (Azure Automation) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3386: Configure Azure Resource Logs (Azure Automation) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3387: Configure Virtual Network Integration (Azure Automation) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3388: Configure Azure AD Authentication Required for Data Plane Access (Azure Linux Virtual Machines) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3389: Configure Microsoft Defender for Cloud - Adaptive Application Controls (Azure Linux Virtual Machines) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T3390: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Linux Virtual Machines) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3391: Configure Anti-Malware Solution (Azure Linux Virtual Machines) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3392: Configure Anti-Malware Solution Health Monitoring (Azure Linux Virtual Machines) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3393: Configure Azure Automation State Configuration (Azure Linux Virtual Machines) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3394: Configure Azure Automation Update Management (Azure Linux Virtual Machines) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T3395: Configure Azure Backup (Azure Linux Virtual Machines) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3396: Configure Azure Policy Guest Configuration Agent (Azure Linux Virtual Machines) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3397: Configure Azure Policy Support (Azure Linux Virtual Machines) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3398: Configure Azure RBAC for Data Plane (Azure Linux Virtual Machines) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3399: Configure Conditional Access for Data Plane (Azure Linux Virtual Machines) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3400: Configure Customer Lockbox (Azure Linux Virtual Machines) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3401: Configure Custom VM Images (Azure Linux Virtual Machines) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3402: Configure Data at Rest Encryption Using CMK (Azure Linux Virtual Machines) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3403: Configure Data in Transit Encryption (Azure Linux Virtual Machines) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3404: Configure Microsoft Defender for Service / Product Offering (Azure Linux Virtual Machines) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3405: Configure Disable Public Network Access (Azure Linux Virtual Machines) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3406: Configure EDR Solution (Azure Linux Virtual Machines) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T3407: Configure Key Management in Azure Key Vault (Azure Linux Virtual Machines) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3408: Configure Managed Identities (Azure Linux Virtual Machines) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3409: Configure Network Security Group Support (Azure Linux Virtual Machines) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3410: Configure Azure Resource Logs (Azure Linux Virtual Machines) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3411: Configure Service Principals (Azure Linux Virtual Machines) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3412: Configure Vulnerability Assessment using Microsoft Defender (Azure Linux Virtual Machines) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T3413: Configure Azure Policy Support (Azure Service Bus) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3414: Configure Azure RBAC for Data Plane (Azure Service Bus) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3415: Configure Conditional Access for Data Plane (Azure Service Bus) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3416: Configure Data at Rest Encryption Using CMK (Azure Service Bus) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3417: Configure Disable Public Network Access (Azure Service Bus) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3418: Configure Key Management in Azure Key Vault (Azure Service Bus) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3419: Configure Managed Identities (Azure Service Bus) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3420: Configure Network Security Group Support (Azure Service Bus) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3421: Configure Azure Private Link (Azure Service Bus) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3422: Configure Azure Resource Logs (Azure Service Bus) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3423: Configure Service Principals (Azure Service Bus) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3424: Configure Virtual Network Integration (Azure Service Bus) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3425: Configure Azure Policy Support (Azure SignalR Service) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3426: Configure Certificate Management in Azure Key Vault (Azure SignalR Service) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3427: Configure Disable Public Network Access (Azure SignalR Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3428: Configure Azure AD Authentication Required for Data Plane Access (Azure AI Bot Service) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3429: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure AI Bot Service) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3430: Configure Azure Policy Support (Azure AI Bot Service) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3431: Configure Data at Rest Encryption Using CMK (Azure AI Bot Service) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3432: Configure Disable Public Network Access (Azure AI Bot Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3433: Configure Key Management in Azure Key Vault (Azure AI Bot Service) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3434: Configure Local Authentication Methods for Data Plane Access (Azure AI Bot Service) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3435: Configure Managed Identities (Azure AI Bot Service) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3436: Configure Network Security Group Support (Azure AI Bot Service) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3437: Configure Azure Private Link (Azure AI Bot Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3438: Configure Azure Resource Logs (Azure AI Bot Service) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3439: Configure Service Principals (Azure AI Bot Service) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3440: Configure Virtual Network Integration (Azure AI Bot Service) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3441: Configure Azure Policy Support (Azure HPC Cache) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3442: Configure Data at Rest Encryption Using CMK (Azure HPC Cache) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3443: Configure Data in Transit Encryption (Azure HPC Cache) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3444: Configure Key Management in Azure Key Vault (Azure HPC Cache) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3445: Configure Managed Identities (Azure HPC Cache) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3446: Configure Network Security Group Support (Azure HPC Cache) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3447: Configure Azure AD Authentication Required for Data Plane Access (Azure Stream Analytics) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3448: Configure Azure Policy Support (Azure Stream Analytics) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3449: Configure Data at Rest Encryption Using CMK (Azure Stream Analytics) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3450: Configure Managed Identities (Azure Stream Analytics) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3451: Configure Service Native Backup Capability (Azure Stream Analytics) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3452: Configure Azure Private Link (Azure Stream Analytics) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3453: Configure Azure Resource Logs (Azure Stream Analytics) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3454: Configure Service Principals (Azure Stream Analytics) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3455: Configure Azure AD Authentication Required for Data Plane Access (Azure Virtual Machine Scale Sets) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3456: Configure Microsoft Defender for Cloud - Adaptive Application Controls (Azure Virtual Machine Scale Sets) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T3457: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Virtual Machine Scale Sets) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3458: Configure Anti-Malware Solution (Azure Virtual Machine Scale Sets) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3459: Configure Anti-Malware Solution Health Monitoring (Azure Virtual Machine Scale Sets) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3460: Configure Azure Automation State Configuration (Azure Virtual Machine Scale Sets) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3461: Configure Azure Backup (Azure Virtual Machine Scale Sets) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3462: Configure Azure Policy Guest Configuration Agent (Azure Virtual Machine Scale Sets) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3463: Configure Azure Policy Support (Azure Virtual Machine Scale Sets) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3464: Configure Azure RBAC for Data Plane (Azure Virtual Machine Scale Sets) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3465: Configure Customer Lockbox (Azure Virtual Machine Scale Sets) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3466: Configure Custom VM Images (Azure Virtual Machine Scale Sets) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3467: Configure Data at Rest Encryption Using CMK (Azure Virtual Machine Scale Sets) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3468: Configure Data in Transit Encryption (Azure Virtual Machine Scale Sets) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3469: Configure Microsoft Defender for Service / Product Offering (Azure Virtual Machine Scale Sets) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3470: Configure Disable Public Network Access (Azure Virtual Machine Scale Sets) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3471: Configure EDR Solution (Azure Virtual Machine Scale Sets) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T3472: Configure Key Management in Azure Key Vault (Azure Virtual Machine Scale Sets) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3473: Configure Managed Identities (Azure Virtual Machine Scale Sets) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3474: Configure Network Security Group Support (Azure Virtual Machine Scale Sets) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3475: Configure Azure Resource Logs (Azure Virtual Machine Scale Sets) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3476: Configure Service Principals (Azure Virtual Machine Scale Sets) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3477: Configure Vulnerability Assessment using Microsoft Defender (Azure Virtual Machine Scale Sets) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T3478: Configure Azure Backup (Azure VMware Solution) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3479: Configure Microsoft Defender for Service / Product Offering (Azure VMware Solution) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3480: Configure Local Admin Accounts (Azure VMware Solution) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3481: Configure Local Authentication Methods for Data Plane Access (Azure VMware Solution) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3482: Configure Service Native Backup Capability (Azure VMware Solution) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3483: Configure Network Security Group Support (Azure VMware Solution) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3484: Configure Virtual Network Integration (Azure VMware Solution) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3485: Configure Azure Policy Support (Azure Firewall) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3486: Configure Certificate Management in Azure Key Vault (Azure Firewall) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3487: Configure Data in Transit Encryption (Azure Firewall) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3488: Configure Azure Resource Logs (Azure Firewall) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3489: Configure Data in Transit Encryption (Azure Active Directory External Identities) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3490: Configure Local Authentication Methods for Data Plane Access (Azure Active Directory External Identities) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3491: Configure Network Security Group Support (Azure Active Directory External Identities) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3492: Configure Azure Resource Logs (Azure Active Directory External Identities) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3493: Configure Azure AD Authentication Required for Data Plane Access (Azure Spatial Anchors) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3494: Configure Azure Policy Support (Azure Spatial Anchors) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3495: Configure Azure RBAC for Data Plane (Azure Spatial Anchors) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3496: Configure Service Principals (Azure Spatial Anchors) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3497: Configure Azure AD Authentication Required for Data Plane Access (Azure Red Hat OpenShift) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3498: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Red Hat OpenShift) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3499: Configure Azure Policy Support (Azure Red Hat OpenShift) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3500: Configure Customer Lockbox (Azure Red Hat OpenShift) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3501: Configure Data at Rest Encryption Using CMK (Azure Red Hat OpenShift) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3502: Configure Disable Public Network Access (Azure Red Hat OpenShift) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3503: Configure Key Management in Azure Key Vault (Azure Red Hat OpenShift) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3504: Configure Service Native Backup Capability (Azure Red Hat OpenShift) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3505: Configure Azure Private Link (Azure Red Hat OpenShift) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3506: Configure Azure Resource Logs (Azure Red Hat OpenShift) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3507: Configure Service Principals (Azure Red Hat OpenShift) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3508: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Database for PostgreSQL) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3509: Configure Certificate Management in Azure Key Vault (Azure Database for PostgreSQL) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3510: Configure Conditional Access for Data Plane (Azure Database for PostgreSQL) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3511: Configure Data at Rest Encryption Using CMK (Azure Database for PostgreSQL) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3512: Configure Disable Public Network Access (Azure Database for PostgreSQL) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3513: Configure Key Management in Azure Key Vault (Azure Database for PostgreSQL) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3514: Configure Managed Identities (Azure Database for PostgreSQL) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3515: Configure Network Security Group Support (Azure Database for PostgreSQL) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3516: Configure Service Principals (Azure Database for PostgreSQL) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3517: Configure Virtual Network Integration (Azure Database for PostgreSQL) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3518: Configure Azure Policy Support (Azure Web Application Firewall) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3519: Configure Certificate Management in Azure Key Vault (Azure Web Application Firewall) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3520: Configure Data in Transit Encryption (Azure Web Application Firewall) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3521: Configure Microsoft Defender for Service / Product Offering (Azure Web Application Firewall) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3522: Configure Disable Public Network Access (Azure Web Application Firewall) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3523: Configure Network Security Group Support (Azure Web Application Firewall) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3524: Configure Azure Private Link (Azure Web Application Firewall) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3525: Configure Azure Resource Logs (Azure Web Application Firewall) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3526: Configure Sensitive Data Discovery and Classification (Azure Web Application Firewall) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3527: Configure Azure Policy Support (Azure Migrate) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3528: Configure Data at Rest Encryption Using CMK (Azure Migrate) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3529: Configure Disable Public Network Access (Azure Migrate) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3530: Configure Managed Identities (Azure Migrate) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3531: Configure Azure Private Link (Azure Migrate) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3532: Configure Service Principals (Azure Migrate) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3533: Configure Azure RBAC for Data Plane (Azure Sentinel) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3534: Configure Conditional Access for Data Plane (Azure Sentinel) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3535: Configure Data at Rest Encryption Using CMK (Azure Sentinel) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3536: Configure Data Leakage/Loss Prevention (Azure Sentinel) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3537: Configure Key Management in Azure Key Vault (Azure Sentinel) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3538: Configure Managed Identities (Azure Sentinel) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3539: Configure Azure Resource Logs (Azure Sentinel) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3540: Configure Sensitive Data Discovery and Classification (Azure Sentinel) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3541: Configure Service Principals (Azure Sentinel) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3542: Configure Azure Policy Support (Azure Managed Instance for Apache Cassandra) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3543: Configure Data at Rest Encryption Using CMK (Azure Managed Instance for Apache Cassandra) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3544: Configure Key Management in Azure Key Vault (Azure Managed Instance for Apache Cassandra) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3545: Configure Local Authentication Methods for Data Plane Access (Azure Managed Instance for Apache Cassandra) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3546: Configure Azure Resource Logs (Azure Managed Instance for Apache Cassandra) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3547: Configure Azure Policy Support (Azure Managed Lustre) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3548: Configure Data at Rest Encryption Using CMK (Azure Managed Lustre) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3549: Configure Key Management in Azure Key Vault (Azure Managed Lustre) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3550: Configure Azure Resource Logs (Azure Managed Lustre) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3551: Configure Azure AD Authentication Required for Data Plane Access (Azure Communication Services) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3552: Configure Azure RBAC for Data Plane (Azure Communication Services) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3553: Configure Azure Resource Logs (Azure Communication Services) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3554: Configure Service Principals (Azure Communication Services) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3555: Configure Azure AD Authentication Required for Data Plane Access (Azure Data Explorer) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3556: Configure Azure Policy Support (Azure Data Explorer) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3557: Configure Conditional Access for Data Plane (Azure Data Explorer) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3558: Configure Data at Rest Encryption Using CMK (Azure Data Explorer) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3559: Configure Data Leakage/Loss Prevention (Azure Data Explorer) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3560: Configure Disable Public Network Access (Azure Data Explorer) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3561: Configure Network Security Group Support (Azure Data Explorer) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3562: Configure Azure Private Link (Azure Data Explorer) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3563: Configure Azure Resource Logs (Azure Data Explorer) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3564: Configure Sensitive Data Discovery and Classification (Azure Data Explorer) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3565: Configure Virtual Network Integration (Azure Data Explorer) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3566: Configure Local Authentication Methods for Data Plane Access (Azure Dedicated HSM) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3567: Configure Azure Policy Support (Azure Database for MariaDB) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3568: Configure Microsoft Defender for Service / Product Offering (Azure Database for MariaDB) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3569: Configure Network Security Group Support (Azure Database for MariaDB) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3570: Configure Azure Private Link (Azure Database for MariaDB) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3571: Configure Azure AD Authentication Required for Data Plane Access (Azure Event Grid) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3572: Configure Azure Policy Support (Azure Event Grid) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3573: Configure Azure RBAC for Data Plane (Azure Event Grid) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3574: Configure Disable Public Network Access (Azure Event Grid) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3575: Configure Managed Identities (Azure Event Grid) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3576: Configure Network Security Group Support (Azure Event Grid) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3577: Configure Azure Private Link (Azure Event Grid) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3578: Configure Azure Resource Logs (Azure Event Grid) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3579: Configure Service Principals (Azure Event Grid) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3580: Configure Azure RBAC for Data Plane (Azure Cost Management) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3581: Configure Conditional Access for Data Plane (Azure Cost Management) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3582: Configure Service Principals (Azure Cost Management) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3583: Configure Azure Policy Support (Azure IoT Hub) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3584: Configure Azure RBAC for Data Plane (Azure IoT Hub) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3585: Configure Conditional Access for Data Plane (Azure IoT Hub) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3586: Configure Disable Public Network Access (Azure IoT Hub) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3587: Configure Key Management in Azure Key Vault (Azure IoT Hub) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3588: Configure Local Authentication Methods for Data Plane Access (Azure IoT Hub) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3589: Configure Managed Identities (Azure IoT Hub) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3590: Configure Azure Private Link (Azure IoT Hub) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3591: Configure Azure Resource Logs (Azure IoT Hub) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3592: Configure Service Principals (Azure IoT Hub) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3593: Configure Azure AD Authentication Required for Data Plane Access (Azure Cosmos DB) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3594: Configure Azure Policy Support (Azure Cosmos DB) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3595: Configure Azure RBAC for Data Plane (Azure Cosmos DB) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3596: Configure Conditional Access for Data Plane (Azure Cosmos DB) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3597: Configure Data at Rest Encryption Using CMK (Azure Cosmos DB) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3598: Configure Data Leakage/Loss Prevention (Azure Cosmos DB) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3599: Configure Microsoft Defender for Service / Product Offering (Azure Cosmos DB) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3600: Configure Disable Public Network Access (Azure Cosmos DB) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3601: Configure Key Management in Azure Key Vault (Azure Cosmos DB) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3602: Configure Managed Identities (Azure Cosmos DB) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3603: Configure Azure Private Link (Azure Cosmos DB) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3604: Configure Azure Resource Logs (Azure Cosmos DB) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3605: Configure Sensitive Data Discovery and Classification (Azure Cosmos DB) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3606: Configure Service Principals (Azure Cosmos DB) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3607: Configure Virtual Network Integration (Azure Cosmos DB) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3608: Configure Azure AD Authentication Required for Data Plane Access (Azure Synapse Analytics) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3609: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Synapse Analytics) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3610: Configure Azure Policy Support (Azure Synapse Analytics) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3611: Configure Conditional Access for Data Plane (Azure Synapse Analytics) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3612: Configure Customer Lockbox (Azure Synapse Analytics) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3613: Configure Data at Rest Encryption Using CMK (Azure Synapse Analytics) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3614: Configure Data Leakage/Loss Prevention (Azure Synapse Analytics) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3615: Configure Microsoft Defender for Service / Product Offering (Azure Synapse Analytics) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3616: Configure Disable Public Network Access (Azure Synapse Analytics) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3617: Configure Key Management in Azure Key Vault (Azure Synapse Analytics) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3618: Configure Local Admin Accounts (Azure Synapse Analytics) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3619: Configure Local Authentication Methods for Data Plane Access (Azure Synapse Analytics) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3620: Configure Service Native Backup Capability (Azure Synapse Analytics) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3621: Configure Network Security Group Support (Azure Synapse Analytics) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3622: Configure Azure Private Link (Azure Synapse Analytics) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3623: Configure Azure Resource Logs (Azure Synapse Analytics) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3624: Configure Sensitive Data Discovery and Classification (Azure Synapse Analytics) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3625: Configure Virtual Network Integration (Azure Synapse Analytics) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3626: Configure Azure Policy Support (Azure Resource Manager) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3627: Configure Microsoft Defender for Service / Product Offering (Azure Resource Manager) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3628: Configure Azure Private Link (Azure Resource Manager) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3629: Configure Azure Resource Logs (Azure Resource Manager) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3630: Configure Azure AD Authentication Required for Data Plane Access (Azure App Service) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3631: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure App Service) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3632: Configure Azure Backup (Azure App Service) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3633: Configure Azure Policy Support (Azure App Service) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3634: Configure Certificate Management in Azure Key Vault (Azure App Service) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3635: Configure Conditional Access for Data Plane (Azure App Service) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3636: Configure Customer Lockbox (Azure App Service) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3637: Configure Data at Rest Encryption Using CMK (Azure App Service) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3638: Configure Data in Transit Encryption (Azure App Service) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3639: Configure Microsoft Defender for Service / Product Offering (Azure App Service) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3640: Configure Disable Public Network Access (Azure App Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3641: Configure Key Management in Azure Key Vault (Azure App Service) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3642: Configure Local Authentication Methods for Data Plane Access (Azure App Service) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3643: Configure Managed Identities (Azure App Service) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3644: Configure Azure Private Link (Azure App Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3645: Configure Azure Private Link (Azure App Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3646: Configure Azure Resource Logs (Azure App Service) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3647: Configure Service Principals (Azure App Service) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3648: Configure Virtual Network Integration (Azure App Service) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3649: Configure Azure Policy Support (Azure NetApp Files) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3650: Configure Data in Transit Encryption (Azure NetApp Files) [Added]
  • P1809: Unprotected data in transit (Cloud) [Added]
• T3651: Configure Service Native Backup Capability (Azure NetApp Files) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3652: Configure Network Security Group Support (Azure NetApp Files) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3653: Configure Virtual Network Integration (Azure NetApp Files) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3654: Configure Azure Policy Support (Azure Lighthouse) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3655: Configure Managed Identities (Azure Policy) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3656: Configure Virtual Network Integration (Azure Cloud Shell) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3657: Configure Service Native Backup Capability (Azure Notification Hubs) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3658: Configure Azure Resource Logs (Azure Notification Hubs) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3659: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure OpenAI Service) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3660: Configure Azure Policy Support (Azure OpenAI Service) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3661: Configure Azure RBAC for Data Plane (Azure OpenAI Service) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3662: Configure Conditional Access for Data Plane (Azure OpenAI Service) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3663: Configure Customer Lockbox (Azure OpenAI Service) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3664: Configure Data at Rest Encryption Using CMK (Azure OpenAI Service) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3665: Configure Data Leakage/Loss Prevention (Azure OpenAI Service) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3666: Configure Disable Public Network Access (Azure OpenAI Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3667: Configure Key Management in Azure Key Vault (Azure OpenAI Service) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3668: Configure Local Authentication Methods for Data Plane Access (Azure OpenAI Service) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3669: Configure Managed Identities (Azure OpenAI Service) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3670: Configure Azure Private Link (Azure OpenAI Service) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3671: Configure Azure Resource Logs (Azure OpenAI Service) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3672: Configure Service Principals (Azure OpenAI Service) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3673: Configure Azure AD Authentication Required for Data Plane Access (Azure Batch) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3674: Configure Azure Policy Support (Azure Batch) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3675: Configure Azure RBAC for Data Plane (Azure Batch) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3676: Configure Certificate Management in Azure Key Vault (Azure Batch) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3677: Configure Custom Containers Images (Azure Batch) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3678: Configure Custom VM Images (Azure Batch) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3679: Configure Data at Rest Encryption Using CMK (Azure Batch) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3680: Configure Disable Public Network Access (Azure Batch) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3681: Configure Key Management in Azure Key Vault (Azure Batch) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3682: Configure Local Authentication Methods for Data Plane Access (Azure Batch) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3683: Configure Managed Identities (Azure Batch) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3684: Configure Azure Private Link (Azure Batch) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3685: Configure Azure Resource Logs (Azure Batch) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3686: Configure Service Principals (Azure Batch) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3687: Configure Virtual Network Integration (Azure Batch) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3688: Configure Azure AD Authentication Required for Data Plane Access (Azure SQL) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3689: Configure Azure Policy Support (Azure SQL) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3690: Configure Conditional Access for Data Plane (Azure SQL) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3691: Configure Customer Lockbox (Azure SQL) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3692: Configure Data at Rest Encryption Using CMK (Azure SQL) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3693: Configure Microsoft Defender for Service / Product Offering (Azure SQL) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3694: Configure Key Management in Azure Key Vault (Azure SQL) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3695: Configure Local Authentication Methods for Data Plane Access (Azure SQL) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3696: Configure Managed Identities (Azure SQL) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3697: Configure Network Security Group Support (Azure SQL) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3698: Configure Azure Private Link (Azure SQL) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3699: Configure Azure Resource Logs (Azure SQL) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3700: Configure Virtual Network Integration (Azure SQL) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3701: Configure Azure RBAC for Data Plane (Azure Attestation) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3702: Configure Azure Resource Logs (Azure Attestation) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3703: Configure Data at Rest Encryption Using CMK (Azure Communications Gateway) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3704: Configure Key Management in Azure Key Vault (Azure Communications Gateway) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3705: Configure Azure Policy Support (Azure NAT Gateway) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3706: Configure Virtual Network Integration (Azure NAT Gateway) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3707: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Backup) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3708: Configure Certificate Management in Azure Key Vault (Azure Backup) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3709: Configure Data at Rest Encryption Using CMK (Azure Backup) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3710: Configure Data Leakage/Loss Prevention (Azure Backup) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3711: Configure Disable Public Network Access (Azure Backup) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3712: Configure Key Management in Azure Key Vault (Azure Backup) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3713: Configure Azure Private Link (Azure Backup) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3714: Configure Azure Resource Logs (Azure Backup) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3715: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Information Protection) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3716: Configure Certificate Management in Azure Key Vault (Azure Information Protection) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3717: Configure Conditional Access for Data Plane (Azure Information Protection) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3718: Configure Data at Rest Encryption Using CMK (Azure Information Protection) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3719: Configure Data Leakage/Loss Prevention (Azure Information Protection) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3720: Configure Key Management in Azure Key Vault (Azure Information Protection) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3721: Configure Local Admin Accounts (Azure Information Protection) [Added]
  • P1799: Excessive privileged access (Cloud) [Added]
• T3722: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Storage) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3723: Configure Azure Backup (Azure Storage) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3724: Configure Azure Policy Support (Azure Storage) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3725: Configure Azure RBAC for Data Plane (Azure Storage) [Added]
  • P1805: Overly broad access privileges (Cloud) [Added]
• T3726: Configure Conditional Access for Data Plane (Azure Storage) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3727: Configure Customer Lockbox (Azure Storage) [Added]
  • P1806: Uncontrolled vendor access (Cloud) [Added]
• T3728: Configure Data at Rest Encryption Using CMK (Azure Storage) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3729: Configure Data Leakage/Loss Prevention (Azure Storage) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3730: Configure Microsoft Defender for Service / Product Offering (Azure Storage) [Added]
  • P1820: Inadequate threat detection and alerting (Cloud) [Added]
• T3731: Configure Disable Public Network Access (Azure Storage) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3732: Configure Key Management in Azure Key Vault (Azure Storage) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3733: Configure Local Authentication Methods for Data Plane Access (Azure Storage) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3734: Configure Managed Identities (Azure Storage) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3735: Configure Service Native Backup Capability (Azure Storage) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3736: Configure Azure Private Link (Azure Storage) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3737: Configure Azure Resource Logs (Azure Storage) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3738: Configure Sensitive Data Discovery and Classification (Azure Storage) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3739: Configure Service Principals (Azure Storage) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3740: Configure Microsoft Defender for Cloud - Adaptive Application Controls (Azure Managed Applications) [Added]
  • P1819: Uncontrolled execution of unauthorized software (Cloud) [Added]
• T3741: Configure Service Credential and Secrets Support Integration and Storage in Azure Key Vault (Azure Managed Applications) [Added]
  • P1797: Unsecured storage of credentials and secrets (Cloud) [Added]
• T3742: Configure Anti-Malware Solution (Azure Managed Applications) [Added]
  • P1842: Outdated malware protection mechanisms (Cloud) [Added]
• T3743: Configure Anti-Malware Solution Health Monitoring (Azure Managed Applications) [Added]
  • P1843: Outdated anti-malware signatures (Cloud) [Added]
• T3744: Configure Azure Automation State Configuration (Azure Managed Applications) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3745: Configure Azure Automation Update Management (Azure Managed Applications) [Added]
  • P1839: Unpatched vulnerabilities in cloud resources (Cloud) [Added]
• T3746: Configure Azure Backup (Azure Managed Applications) [Added]
  • P1844: Inadequate data backup practices (Cloud) [Added]
• T3747: Configure Azure Policy Guest Configuration Agent (Azure Managed Applications) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3748: Configure Azure Policy Support (Azure Managed Applications) [Added]
  • P1816: Uncontrolled cloud service provisioning (Cloud) [Added]
• T3749: Configure Certificate Management in Azure Key Vault (Azure Managed Applications) [Added]
  • P1813: Inadequate certificate management (Cloud) [Added]
• T3750: Configure Conditional Access for Data Plane (Azure Managed Applications) [Added]
  • P1796: Insufficient resource access control (Cloud) [Added]
• T3751: Configure Custom Containers Images (Azure Managed Applications) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3752: Configure Custom VM Images (Azure Managed Applications) [Added]
  • P1836: Inadequate compute resource configuration (Cloud) [Added]
• T3753: Configure Data at Rest Encryption Using CMK (Azure Managed Applications) [Added]
  • P1811: Unsecured data at rest encryption keys (Cloud) [Added]
• T3754: Configure Data Leakage/Loss Prevention (Azure Managed Applications) [Added]
  • P1808: Unmonitored sensitive data transfers (Cloud) [Added]
• T3755: Configure Disable Public Network Access (Azure Managed Applications) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3756: Configure EDR Solution (Azure Managed Applications) [Added]
  • P1841: Unmonitored endpoint activity (Cloud) [Added]
• T3757: Configure Key Management in Azure Key Vault (Azure Managed Applications) [Added]
  • P1812: Unsecured cryptographic key management (Cloud) [Added]
• T3758: Configure Local Authentication Methods for Data Plane Access (Azure Managed Applications) [Added]
  • P1790: Decentralized identity management (Cloud) [Added]
• T3759: Configure Managed Identities (Azure Managed Applications) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3760: Configure Network Security Group Support (Azure Managed Applications) [Added]
  • P1780: Insufficient network segmentation (Cloud) [Added]
• T3761: Configure Azure Private Link (Azure Managed Applications) [Added]
  • P1781: Unsecured cloud service access (Cloud) [Added]
• T3762: Configure Azure Resource Logs (Azure Managed Applications) [Added]
  • P1823: Insufficient network logging (Cloud) [Added]
• T3763: Configure Sensitive Data Discovery and Classification (Azure Managed Applications) [Added]
  • P1807: Unidentified and unprotected sensitive data (Cloud) [Added]
• T3764: Configure Service Principals (Azure Managed Applications) [Added]
  • P1792: Unsecured application identities (Cloud) [Added]
• T3765: Configure Vulnerability Assessment using Microsoft Defender (Azure Managed Applications) [Added]
  • P1838: Lack of vulnerability assessments (Cloud) [Added]
• T3766: Use SecureString for sensitive values in Parameter Store (AWS Systems Manager) [Added]
  • P1866: Sensitive parameter data stored in plaintext (AWS Systems Manager) [Added]
• T3767: Encrypt all data in S3 buckets (AWS Systems Manager) [Added]
  • P1867: Sensitive data stored in plaintext (AWS Systems Manager) [Added]
• T3768: Give the least privilege access to users (AWS Systems Manager) [Added]
  • P1868: Excessive user permissions (AWS Systems Manager) [Added]
• T3769: Set parameter constraints in an SSM document (AWS Systems Manager) [Added]
  • P1869: Allowing invalid or dangerous values in an SSM document (AWS Systems Manager) [Added]
• T3770: Block public sharing of SSM documents (AWS Systems Manager) [Added]
  • P1870: Leaking information about system configuration (AWS Systems Manager) [Added]
• T3771: Keep components up to date (AWS Systems Manager) [Added]
  • P1871: Out-of-date components (AWS Systems Manager) [Added]
• T3772: Restrict Session Manager commands with an SSM document (AWS Systems Manager) [Added]
  • P1872: Poor session management (AWS Systems Manager) [Added]
• T3773: Monitor sessions in Session Manager (AWS Systems Manager) [Added]
  • P1873: Suspicious session activity (AWS Systems Manager) [Added]
• T3774: Test the use of SecureString for sensitive values in Parameter Store (AWS Systems Manager) [Added]
  • P1866: Sensitive parameter data stored in plaintext (AWS Systems Manager) [Added]
• T3775: Test data ecnryption in S3 buckets (AWS Systems Manager) [Added]
  • P1867: Sensitive data stored in plaintext (AWS Systems Manager) [Added]
• T3776: Test least privilege access to users (AWS Systems Manager) [Added]
  • P1868: Excessive user permissions (AWS Systems Manager) [Added]
• T3777: Verify parameter constraints in an SSM document (AWS Systems Manager) [Added]
  • P1869: Allowing invalid or dangerous values in an SSM document (AWS Systems Manager) [Added]
• T3778: Verify public sharing of SSM documents (AWS Systems Manager) [Added]
  • P1870: Leaking information about system configuration (AWS Systems Manager) [Added]
• T3779: Verify components are up to date (AWS Systems Manager) [Added]
  • P1871: Out-of-date components (AWS Systems Manager) [Added]
• T3780: Verify the restriction of Session Manager commands with an SSM document (AWS Systems Manager) [Added]
  • P1872: Poor session management (AWS Systems Manager) [Added]
• T3781: Verify session monitoring in Session Manager (AWS Systems Manager) [Added]
  • P1873: Suspicious session activity (AWS Systems Manager) [Added]
• T3782: Replace sensitive values with dynamic references (AWS CloudFormation) [Added]
  • P1874: Hard-coded secrets in templates (AWS CloudFormation) [Added]
• T3783: Set parameter constraints (AWS CloudFormation) [Added]
  • P1875: Allowing invalid or dangerous values (AWS CloudFormation) [Added]
• T3784: Store templates in a version control system (AWS CloudFormation) [Added]
  • P1876: Lack of change tracking (AWS CloudFormation) [Added]
• T3785: Use a service role to implement least-privilege access (AWS CloudFormation) [Added]
  • P1877: Overly broad user permissions (AWS CloudFormation) [Added]
• T3786: Assign a stack policy to protect resources (AWS CloudFormation) [Added]
  • P1878: Stack resources can be accidentally updated or removed (AWS CloudFormation) [Added]
• T3787: Ensure CloudFormation events are logged (AWS CloudFormation) [Added]
  • P1879: Failing to monitor for security incidents and errors (AWS CloudFormation) [Added]
• T3788: Verify sensitive values replacement with dynamic references (AWS CloudFormation) [Added]
  • P1874: Hard-coded secrets in templates (AWS CloudFormation) [Added]
• T3789: Verify parameter constraints (AWS CloudFormation) [Added]
  • P1875: Allowing invalid or dangerous values (AWS CloudFormation) [Added]
• T3790: Verify template storage in a version control system (AWS CloudFormation) [Added]
  • P1876: Lack of change tracking (AWS CloudFormation) [Added]
• T3791: Verify the use of a service role to implement least-privilege access (AWS CloudFormation) [Added]
  • P1877: Overly broad user permissions (AWS CloudFormation) [Added]
• T3792: Verify resource protection by stack policies [Added]
  • P1878: Stack resources can be accidentally updated or removed (AWS CloudFormation) [Added]
• T3793: Verify logs of CloudFormation events (AWS CloudFormation) [Added]
  • P1879: Failing to monitor for security incidents and errors (AWS CloudFormation) [Added]
• T3794: Protect against leaking secrets in a shell window (AWS Secrets Manager) [Added]
  • P1880: Secret leaking from the shell command history (AWS Secrets Manager) [Added]
• T3795: Set a rotation schedule for secrets (AWS Secrets Manager) [Added]
  • P1881: Compromised secrets (AWS Secrets Manager) [Added]
• T3796: Use appropriate naming and documentation for secrets (AWS Secrets Manager) [Added]
  • P1882: Poor secret management (AWS Secrets Manager) [Added]
• T3797: Use CloudTrail to audit secrets (AWS Secrets Manager) [Added]
  • P1883: Failing to monitor secret usage (AWS Secrets Manager) [Added]
• T3798: Use a VPC endpoint to communicate (AWS Secrets Manager) [Added]
  • P1884: Communication over the public internet (AWS Secrets Manager) [Added]
• T3799: Verify secret leaking in a shell window (AWS Secrets Manager) [Added]
  • P1880: Secret leaking from the shell command history (AWS Secrets Manager) [Added]
• T3800: Test secret rotation schedule (AWS Secrets Manager) [Added]
  • P1881: Compromised secrets (AWS Secrets Manager) [Added]
• T3801: Verify naming and documentation for secrets (AWS Secrets Manager) [Added]
  • P1882: Poor secret management (AWS Secrets Manager) [Added]
• T3802: Verify secret audit (AWS Secrets Manager) [Added]
  • P1883: Failing to monitor secret usage (AWS Secrets Manager) [Added]
• T3803: Test VPC endpoint communication (AWS Secrets Manager) [Added]
  • P1884: Communication over the public internet (AWS Secrets Manager) [Added]
• T3804: Ensure state machines have the correct permissions (AWS Step Functions) [Added]
  • P1885: Excessive or insufficient permissions (AWS Step Functions) [Added]
• T3805: Choose an appropriate logging level for state machines (AWS Step Functions) [Added]
  • P1886: Failure to monitor events for errors and security incidents (AWS Step Functions) [Added]
• T3806: Verify permissions for state machines (AWS Step Functions) [Added]
  • P1885: Excessive or insufficient permissions (AWS Step Functions) [Added]
• T3807: Verify logging level for state machines (AWS Step Functions) [Added]
  • P1886: Failure to monitor events for errors and security incidents (AWS Step Functions) [Added]
• T3808: Do not use wildcard domain names in certificates (AWS Certificate Manager) [Added]
  • P1887: Single-point of failure and vulnerability to ALPACA exploits (AWS Certificate Manager) [Added]
• T3809: Monitor non-AWS certificates for expiry (AWS Certificate Manager) [Added]
  • P1888: Interruption in availability due to expired certificates (AWS Certificate Manager) [Added]
• T3810: Do not use certificate pinning (AWS Certificate Manager) [Added]
  • P1889: Obsolete and less-secure protocol (AWS Certificate Manager) [Added]
• T3811: Verify the use of wildcard domain names in certificates (AWS Certificate Manager) [Added]
  • P1887: Single-point of failure and vulnerability to ALPACA exploits (AWS Certificate Manager) [Added]
• T3812: Verify that non-AWS certificates are monitored for expiry (AWS Certificate Manager) [Added]
  • P1888: Interruption in availability due to expired certificates (AWS Certificate Manager) [Added]
• T3813: Verify the use of certificate pinning (AWS Certificate Manager) [Added]
  • P1889: Obsolete and less-secure protocol (AWS Certificate Manager) [Added]
• T3814: Follow standard domain security practices (AWS Route53) [Added]
  • P1890: Unprotected domain records (AWS Route53) [Added]
• T3815: Consider supporting DNSSEC signing with your domains (AWS Route53) [Added]
  • P1891: Vulnerability to domain spoofing (AWS Route53) [Added]
• T3816: Test standard domain security practices (AWS Route53) [Added]
  • P1890: Unprotected domain records (AWS Route53) [Added]
• T3817: Verify the support of DNSSEC signing with your domains (AWS Route53) [Added]
  • P1891: Vulnerability to domain spoofing (AWS Route53) [Added]
• T3818: Incorporate regular scanning to detect ECR image vulnerabilities (AWS Elastic Container Registry) [Added]
  • P1892: Undetected vulnerabilities in images (AWS Elastic Container Registry) [Added]
• T3819: Do not allow public access to ECR images (AWS Elastic Container Registry) [Added]
  • P1893: Information leaks through public images (AWS Elastic Container Registry) [Added]
• T3820: Consider using a customer-managed key for ECR encryption (AWS Elastic Container Registry) [Added]
  • P1894: Lack of control over encryption (AWS Elastic Container Registry) [Added]
• T3821: Verify ECR image vulnerability detection (AWS Elastic Container Registry) [Added]
  • P1892: Undetected vulnerabilities in images (AWS Elastic Container Registry) [Added]
• T3822: Verify public access to ECR images (AWS Elastic Container Registry) [Added]
  • P1893: Information leaks through public images (AWS Elastic Container Registry) [Added]
• T3823: Verify customer-managed keys for ECR encryption (AWS Elastic Container Registry) [Added]
  • P1894: Lack of control over encryption (AWS Elastic Container Registry) [Added]
• T3824: Enable encryption at rest (AWS Elastic File System) [Added]
  • P1895: Plaintext storage of data (AWS Elastic File System) [Added]
• T3825: Consider using a customer-managed key for encryption (AWS Elastic File System) [Added]
  • P1896: Lack of control over encryption (AWS Elastic File System) [Added]
• T3826: Mount volumes with TLS enabled (AWS Elastic File System) [Added]
  • P1897: Failure to provide encryption for data in transit (AWS Elastic File System) [Added]
• T3827: Enable and configure automatic backups (AWS Elastic File System) [Added]
  • P1898: Failure to safeguard data against failures and error (AWS Elastic File System) [Added]
• T3828: Use access points to segregate application access with shared data sets (AWS Elastic File System) [Added]
  • P1899: Excessive application permissions for file access (AWS Elastic File System) [Added]
• T3829: Verify encryption at rest (AWS Elastic File System) [Added]
  • P1895: Plaintext storage of data (AWS Elastic File System) [Added]
• T3830: Verify customer-managed key for encryption (AWS Elastic File System) [Added]
  • P1896: Lack of control over encryption (AWS Elastic File System) [Added]
• T3831: Verify mounted volumes security (AWS Elastic File System) [Added]
  • P1897: Failure to provide encryption for data in transit (AWS Elastic File System) [Added]
• T3832: Verify automatic backups configuration (AWS Elastic File System) [Added]
  • P1898: Failure to safeguard data against failures and error (AWS Elastic File System) [Added]
• T3833: Verify access points segregation to access shared data sets (AWS Elastic File System) [Added]
  • P1899: Excessive application permissions for file access (AWS Elastic File System) [Added]
• T3834: Enable DKIM to prevent email spoofing (AWS Simple Email Service) [Added]
  • P1900: Potential use of email domains in spam, spoofing, and phishing attacks (AWS Simple Email Service) [Added]
• T3835: Delete personal data when no longer in use (AWS Simple Email Service) [Added]
  • P1901: Potential disclosure of PII (AWS Simple Email Service) [Added]
• T3836: Restrict permissions with IAM conditions (AWS Simple Email Service) [Added]
  • P1902: Insufficient restrictions on email identities (AWS Simple Email Service) [Added]
• T3837: Review sending authorization policies to prevent unauthorized delegate senders (AWS Simple Email Service) [Added]
  • P1903: Unintended cross-account use of email identities (AWS Simple Email Service) [Added]
• T3838: Monitor sending activity (AWS Simple Email Service) [Added]
  • P1904: Undetected email delivery issues (AWS Simple Email Service) [Added]
• T3839: Use VPC endpoints to keep SMTP traffic off of the public internet (AWS Simple Email Service) [Added]
  • P1905: Exposed service communication with public endpoints (AWS Simple Email Service) [Added]
• T3840: Test email spoofing prevention (AWS Simple Email Service) [Added]
  • P1900: Potential use of email domains in spam, spoofing, and phishing attacks (AWS Simple Email Service) [Added]
• T3841: Verify unused personal data (AWS Simple Email Service) [Added]
  • P1901: Potential disclosure of PII (AWS Simple Email Service) [Added]
• T3842: Verify permissions restricted with IAM conditions (AWS Simple Email Service) [Added]
  • P1902: Insufficient restrictions on email identities (AWS Simple Email Service) [Added]
• T3843: Verify sending authorization policies (AWS Simple Email Service) [Added]
  • P1903: Unintended cross-account use of email identities (AWS Simple Email Service) [Added]
• T3844: Verify sending activity monitoring (AWS Simple Email Service) [Added]
  • P1904: Undetected email delivery issues (AWS Simple Email Service) [Added]
• T3845: Verify VPC endpoints (AWS Simple Email Service) [Added]
  • P1905: Exposed service communication with public endpoints (AWS Simple Email Service) [Added]
• T3846: Do not create FTP-enabled servers (AWS Transfer Family) [Added]
  • P1906: Unencrypted network connection (AWS Transfer Family) [Added]
• T3847: Use the strongest supported security policy for SFTP/FTPS encryption (AWS Transfer Family) [Added]
  • P1907: Potentially weak encryption (AWS Transfer Family) [Added]
• T3848: Grant permissions to users with managed policies (AWS Transfer Family) [Added]
  • P1908: Mismatched permissions (AWS Transfer Family) [Added]
• T3849: Verify FTP-enabled servers (AWS Transfer Family) [Added]
  • P1906: Unencrypted network connection (AWS Transfer Family) [Added]
• T3850: Verify security policy for SFTP/FTPS encryption (AWS Transfer Family) [Added]
  • P1907: Potentially weak encryption (AWS Transfer Family) [Added]
• T3851: Verify user permissions (AWS Transfer Family) [Added]
  • P1908: Mismatched permissions (AWS Transfer Family) [Added]
• T3852: Encrypt clusters when storing sensitive data (AWS RedShift) [Added]
  • P1909: Unencrypted data at rest (AWS RedShift) [Added]
• T3853: Require TLS to encrypt data in transit (AWS RedShift) [Added]
  • P1910: Failure to provide encryption for data in transit (AWS RedShift) [Added]
• T3854: Do not use default names for a database or the admin account (AWS RedShift) [Added]
  • P1911: Using the default database name and admin account name (AWS RedShift) [Added]
• T3855: Ensure clusters are not publicly accessible (AWS RedShift) [Added]
  • P1912: Publicly accessible clusters (AWS RedShift) [Added]
• T3856: Enable audit logging for databases (AWS RedShift) [Added]
  • P1913: Failure to monitor database activity (AWS RedShift) [Added]
• T3857: Use managed IAM policies to grant permissions to users (AWS RedShift) [Added]
  • P1914: Excessive permissions (AWS RedShift) [Added]
• T3858: Use an automated backup schedule with databases (AWS RedShift) [Added]
  • P1915: Failure to safeguard against data loss (AWS RedShift) [Added]
• T3859: Verify cluster encryption (AWS RedShift) [Added]
  • P1909: Unencrypted data at rest (AWS RedShift) [Added]
• T3860: Verify data in transit encryption(AWS RedShift) [Added]
  • P1910: Failure to provide encryption for data in transit (AWS RedShift) [Added]
• T3861: Verify names for database and admin account (AWS RedShift) [Added]
  • P1911: Using the default database name and admin account name (AWS RedShift) [Added]
• T3862: Verify cluster accessibility (AWS RedShift) [Added]
  • P1912: Publicly accessible clusters (AWS RedShift) [Added]
• T3863: Verify audit logging for databases (AWS RedShift) [Added]
  • P1913: Failure to monitor database activity (AWS RedShift) [Added]
• T3864: Verify users' IAM policies (AWS RedShift) [Added]
  • P1914: Excessive permissions (AWS RedShift) [Added]
• T3865: Verify automated backup schedule (AWS RedShift) [Added]
  • P1915: Failure to safeguard against data loss (AWS RedShift) [Added]
• T3866: Do not use publicly accessible MQ brokers (AWS MQ) [Added]
  • P1916: Publicly accessible brokers (AWS MQ) [Added]
• T3867: Block unnecessary protocols (AWS MQ) [Added]
  • P1917: Unnecessary features that create a larger attack surface (AWS MQ) [Added]
• T3868: Keep MQ current with automatic updates (AWS MQ) [Added]
  • P1918: Out-of-date software (AWS MQ) [Added]
• T3869: Ensure activity is logged (AWS MQ) [Added]
  • P1919: Failure to store a log of MQ events (AWS MQ) [Added]
• T3870: Verify MQ brokers accessibility(AWS MQ) [Added]
  • P1916: Publicly accessible brokers (AWS MQ) [Added]
• T3871: Verify protocols (AWS MQ) [Added]
  • P1917: Unnecessary features that create a larger attack surface (AWS MQ) [Added]
• T3872: Verify MQ automatic updates (AWS MQ) [Added]
  • P1918: Out-of-date software (AWS MQ) [Added]
• T3873: Verify activity logging (AWS MQ) [Added]
  • P1919: Failure to store a log of MQ events (AWS MQ) [Added]
• T3874: Enable at-rest encryption (AWS OpenSearch Service) [Added]
  • P1920: Sensitive information stored in plaintext (AWS OpenSearch Service) [Added]
• T3875: Enable node-to-node encryption (AWS OpenSearch Service) [Added]
  • P1921: Failure to provide encryption for data in transit (AWS OpenSearch Service) [Added]
• T3876: Do not expose a public endpoint to domains (AWS OpenSearch Service) [Added]
  • P1922: Exposed services with public endpoints (AWS OpenSearch Service) [Added]
• T3877: Restrict domains to known IP addresses (AWS OpenSearch Service) [Added]
  • P1923: Overly accessible OpenSearch domains (AWS OpenSearch Service) [Added]
• T3878: Enable audit logging with fine-grained access controls (AWS OpenSearch Service) [Added]
  • P1924: Failure to monitor events for errors and security incidents (AWS OpenSearch Service) [Added]
• T3879: Verify at-rest encryption (AWS OpenSearch Service) [Added]
  • P1920: Sensitive information stored in plaintext (AWS OpenSearch Service) [Added]
• T3880: Verify node-to-node encryption (AWS OpenSearch Service) [Added]
  • P1921: Failure to provide encryption for data in transit (AWS OpenSearch Service) [Added]
• T3881: Verify public endpoint to domain exposure (AWS OpenSearch Service) [Added]
  • P1922: Exposed services with public endpoints (AWS OpenSearch Service) [Added]
• T3882: Verify domain restrictions (AWS OpenSearch Service) [Added]
  • P1923: Overly accessible OpenSearch domains (AWS OpenSearch Service) [Added]
• T3883: Verify audit logging and access controls (AWS OpenSearch Service) [Added]
  • P1924: Failure to monitor events for errors and security incidents (AWS OpenSearch Service) [Added]
• T3884: Ensure provisioned clusters are not publicly accessible (AWS MSK) [Added]
  • P1925: Publicly accessible clusters (AWS MSK) [Added]
• T3885: Enable logs for provisioned clusters (AWS MSK) [Added]
  • P1926: Failure to monitor cluster activity (AWS MSK) [Added]
• T3886: Consider placing ZooKeper nodes in a separate security group (AWS MSK) [Added]
  • P1927: Overly permissive network access policy (AWS MSK) [Added]
• T3887: Verify provisioned clusters accessibility (AWS MSK) [Added]
  • P1925: Publicly accessible clusters (AWS MSK) [Added]
• T3888: Verify logs for provisioned clusters (AWS MSK) [Added]
  • P1926: Failure to monitor cluster activity (AWS MSK) [Added]
• T3889: Verify groups of ZooKeper nodes (AWS MSK) [Added]
  • P1927: Overly permissive network access policy (AWS MSK) [Added]
• T3890: Enable at-rest encryption for Redis clusters (AWS ElastiCache) [Added]
  • P1928: Plaintext storage of data (AWS ElastiCache) [Added]
• T3891: Enable in-transit encryption for Redis clusters (AWS ElastiCache) [Added]
  • P1929: Unencrypted transmission of data and lack of authentication (AWS ElastiCache) [Added]
• T3892: Enable Redis failover support for clusters that require high availability (AWS ElastiCache) [Added]
  • P1930: Lack of fault tolerance (AWS ElastiCache) [Added]
• T3893: Ensure you are using secure configuration defaults when creating a new ElastiCache cluster (AWS ElastiCache) [Added]
  • P1931: Poor configuration leading to reduced availability and exposure to known vulnerabilities (AWS ElastiCache) [Added]
• T3894: Monitor authentication metrics for Redis clusters (AWS ElastiCache) [Added]
  • P1932: Failure to monitor for security incidents (AWS ElastiCache) [Added]
• T3895: Verify at-rest encryption for Redis clusters is enabled (AWS ElastiCache) [Added]
  • P1928: Plaintext storage of data (AWS ElastiCache) [Added]
• T3896: Verify in-transit encryption for Redis clusters is enabled (AWS ElastiCache) [Added]
  • P1929: Unencrypted transmission of data and lack of authentication (AWS ElastiCache) [Added]
• T3897: Verify Redis failover support for clusters that require high availability is enabled (AWS ElastiCache) [Added]
  • P1930: Lack of fault tolerance (AWS ElastiCache) [Added]
• T3898: Verify secure configuration defaults are set for ElastiCache clusters (AWS ElastiCache) [Added]
  • P1931: Poor configuration leading to reduced availability and exposure to known vulnerabilities (AWS ElastiCache) [Added]
• T3899: Verify authentication metrics for Redis clusters are monitored (AWS ElastiCache) [Added]
  • P1932: Failure to monitor for security incidents (AWS ElastiCache) [Added]
• T3900: Implement and use code change management strategy (GitHub) [Added]
  • P1933: Inadequate code governance and security (GitHub) [Added]
  • TA6555: Ensure any changes to code are tracked in a version control platform [Added]
  • TA6556: Ensure any change to code can be traced back to its associated task [Added]
  • TA6557: Ensure any change to code receives approval of two strongly authenticated users [Added]
  • TA6558: Ensure previous approvals are dismissed when updates are introduced to a code change proposal [Added]
  • TA6559: Ensure there are restrictions on who can dismiss code change reviews [Added]
  • TA6560: Ensure code owners are set for extra sensitive code or configuration [Added]
  • TA6561: Ensure code owner's review is required when a change affects owned code [Added]
  • TA6562: Ensure inactive branches are periodically reviewed and removed [Added]
  • TA6563: Ensure all checks have passed before merging new code [Added]
  • TA6564: Ensure open Git branches are up to date before they can be merged into code base [Added]
  • TA6565: Ensure branch protection rules are enforced for administrators [Added]
  • TA6566: Ensure force push code to branches is denied [Added]
  • TA6567: Ensure branch deletions are denied [Added]
  • TA6568: Ensure any merging of code is automatically scanned for risks [Added]
  • TA6569: Ensure any changes to branch protection rules are audited [Added]
  • TA6570: Ensure branch protection is enforced on the default branch [Added]
  • TA6646: Ensure all open comments are resolved before allowing code change merging [Added]
  • TA6647: Ensure verification of signed commits for new changes before merging [Added]
  • TA6648: Ensure linear history is required [Added]
  • TA6649: Ensure pushing or merging of new code is restricted to specific individuals or teams [Added]
• T3901: Enforce repository management and security strategies (GitHub) [Added]
  • P1934: Insufficient repository management and security (GitHub) [Added]
  • TA6571: Ensure all public repositories contain a SECURITY.md file [Added]
  • TA6572: Ensure repository creation is limited to specific members [Added]
  • TA6573: Ensure repository deletion is limited to specific users [Added]
  • TA6574: Ensure issue deletion is limited to specific users [Added]
  • TA6575: Ensure all copies (forks) of code are tracked and accounted for [Added]
  • TA6576: Ensure all code projects are tracked for changes in visibility status [Added]
  • TA6577: Ensure inactive repositories are reviewed and archived periodically [Added]
• T3902: Ensure regular review and inactive users removal (GitHub) [Added]
  • P1935: Insufficient organizational and access controls (GitHub) [Added]
  • TA6578: Ensure team creation is limited to specific members [Added]
  • TA6579: Ensure minimum number of administrators are set for the organization [Added]
  • TA6580: Ensure strict base permissions are set for repositories [Added]
  • TA6581: Ensure anomalous code behavior is tracked [Added]
  • TA6650: Ensure inactive users are reviewed and removed periodically [Added]
  • TA6651: Ensure Multi-Factor Authentication (MFA) is required for contributors of new code [Added]
  • TA6652: Ensure the organization is requiring members to use Multi-Factor Authentication (MFA) [Added]
  • TA6653: Ensure new members are required to be invited using company-approved email [Added]
  • TA6654: Ensure two administrators are set for each repository [Added]
  • TA6655: Ensure an organization’s identity is confirmed with a “Verified” badge [Added]
  • TA6656: Ensure Source Code Management (SCM) email notifications are restricted to verified domains [Added]
  • TA6657: Ensure an organization provides SSH certificates [Added]
  • TA6658: Ensure Git access is limited based on IP addresses [Added]
• T3903: Implement application and webhook security strategies (GitHub) [Added]
  • P1936: Insufficient application and integration management (GitHub) [Added]
  • TA6582: Ensure administrator approval is required for every installed application [Added]
  • TA6583: Ensure stale applications are reviewed and inactive ones are removed [Added]
  • TA6584: Ensure the access granted to each installed application is limited to the least privilege needed [Added]
  • TA6585: Ensure only secured webhooks are used [Added]
• T3904: Implement comprehensive scanning and security measures (GitHub) [Added]
  • P1937: Inadequate automated security scanning (GitHub) [Added]
  • TA6659: Ensure scanners are in place to identify and prevent sensitive data in code [Added]
  • TA6660: Ensure scanners are in place to secure Continuous Integration (CI) pipeline instructions [Added]
  • TA6661: Ensure scanners are in place to secure Infrastructure as Code (IaC) instructions [Added]
  • TA6662: Ensure scanners are in place for code vulnerabilities [Added]
  • TA6663: Ensure scanners are in place for open-source vulnerabilities in used packages [Added]
  • TA6664: Ensure scanners are in place for open-source license issues in used packages [Added]
• T3905: Ensure pipeline efficiency and security (GitHub) [Added]
  • P1938: Insufficient build environment security and management (GitHub) [Added]
  • TA6586: Ensure all aspects of the pipeline infrastructure and configuration are immutable [Added]
  • TA6587: Ensure the build environment is logged [Added]
  • TA6588: Ensure the creation of the build environment is automated [Added]
  • TA6589: Ensure access to build environments is limited [Added]
  • TA6590: Ensure users must authenticate to access the build environment [Added]
  • TA6591: Ensure the build infrastructure is automatically scanned for vulnerabilities [Added]
  • TA6592: Ensure default passwords are not used [Added]
  • TA6593: Ensure webhooks of the build environment are secured [Added]
  • TA6594: Ensure minimum number of administrators are set for the build environment [Added]
  • TA6665: Ensure each pipeline has a single responsibility [Added]
  • TA6666: Ensure build secrets are limited to the minimal necessary scope [Added]
• T3906: Implement secure build worker management (GitHub) [Added]
  • P1939: Insufficient build worker security and management (GitHub) [Added]
  • TA6595: Ensure build workers are single-used [Added]
  • TA6596: Ensure build worker environments and commands are passed and not pulled [Added]
  • TA6597: Ensure the duties of each build worker are segregated [Added]
  • TA6598: Ensure build workers have minimal network connectivity [Added]
  • TA6599: Ensure run-time security is enforced for build workers [Added]
  • TA6600: Ensure build workers are automatically scanned for vulnerabilities [Added]
  • TA6601: Ensure build workers' deployment configuration is stored in a version control platform [Added]
  • TA6602: Ensure resource consumption of build workers is monitored [Added]
• T3907: Ensure pipeline definition and security (GitHub) [Added]
  • P1940: Inadequate pipeline security and configuration management (GitHub) [Added]
  • TA6603: Ensure all build steps are defined as code [Added]
  • TA6604: Ensure steps have clearly defined build stage input and output [Added]
  • TA6605: Ensure output is written to a separate, secured storage repository [Added]
  • TA6606: Ensure changes to pipeline files are tracked and reviewed [Added]
  • TA6607: Ensure access to build process triggering is minimized [Added]
  • TA6608: Ensure pipelines are automatically scanned for misconfigurations [Added]
  • TA6609: Ensure pipelines are automatically scanned for vulnerabilities [Added]
  • TA6667: Ensure scanners are in place to identify and prevent sensitive data in pipeline files [Added]
• T3908: Enforce artifact signing (GitHub) [Added]
  • P1941: Insufficient artifact and dependency security (GitHub) [Added]
  • TA6610: Ensure all artifacts on all releases are signed [Added]
  • TA6611: Ensure all external dependencies used in the build process are locked [Added]
  • TA6612: Ensure dependencies are validated before being used [Added]
  • TA6613: Ensure the build pipeline creates reproducible artifacts [Added]
  • TA6614: Ensure pipeline steps produce a Software Bill of Materials (SBOM) [Added]
  • TA6615: Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced [Added]
  • TA6668: Ensure all artifacts on all releases are signed (level 2) [Added]
• T3909: Ensure third-party artifact security (GitHub) [Added]
  • P1942: Insufficient third-party and open-source security (GitHub) [Added]
  • TA6616: Ensure third-party artifacts and open-source libraries are verified [Added]
  • TA6617: Ensure Software Bill of Materials (SBOM) is required from all third-party suppliers [Added]
  • TA6618: Ensure signed metadata of the build process is required and verified [Added]
  • TA6619: Ensure dependencies are monitored between open-source components [Added]
  • TA6620: Ensure trusted package managers and repositories are defined and prioritized [Added]
  • TA6621: Ensure a signed Software Bill of Materials (SBOM) of the code is supplied [Added]
  • TA6622: Ensure dependencies are pinned to a specific, verified version [Added]
  • TA6669: Ensure all packages used are more than 60 days old [Added]
• T3910: Implement dependency management strategy (GitHub) [Added]
  • P1943: Inadequate dependency management and security (GitHub) [Added]
  • TA6623: Ensure an organization-wide dependency usage policy is enforced [Added]
  • TA6624: Ensure packages are automatically scanned for known vulnerabilities [Added]
  • TA6625: Ensure packages are automatically scanned for license implications [Added]
  • TA6626: Ensure packages are automatically scanned for ownership change [Added]
• T3911: Ensure distributed artifact security (GitHub) [Added]
  • P1944: Insufficient artifact security and distribution control (GitHub) [Added]
  • TA6670: Ensure all artifacts are signed by the build pipeline itself [Added]
  • TA6671: Ensure artifacts are encrypted before distribution [Added]
  • TA6672: Ensure only authorized platforms have decryption capabilities of artifacts [Added]
• T3912: Enforce artifact certification and uploading rules (GitHub) [Added]
  • P1945: Insufficient control and security of package registry (GitHub) [Added]
  • TA6627: Ensure the authority to certify artifacts is limited [Added]
  • TA6628: Ensure number of permitted users who may upload new artifacts is minimized [Added]
  • TA6629: Ensure user management of the package registry is not local [Added]
  • TA6630: Ensure anonymous access to artifacts is revoked [Added]
  • TA6631: Ensure minimum number of administrators are set for the package registry [Added]
  • TA6673: Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA) [Added]
• T3913: Implement package registry security (GitHub) [Added]
  • P1946: Inadequate package registry validation and security (GitHub) [Added]
  • TA6632: Ensure all signed artifacts are validated upon uploading the package registry [Added]
  • TA6633: Ensure all versions of an existing artifact have their signatures validated [Added]
  • TA6634: Ensure changes in package registry configuration are audited [Added]
  • TA6635: Ensure webhooks of the repository are secured [Added]
• T3914: Implement artifact origin information policy (GitHub) [Added]
  • P1947: Lack of artifact origin information (GitHub) [Added]
  • TA6636: Ensure artifacts contain information about their origin [Added]
• T3915: Enforce separation of deployment configuration files (GitHub) [Added]
  • P1948: Inadequate deployment configuration management and security (GitHub) [Added]
  • TA6637: Ensure changes in deployment configuration are audited [Added]
  • TA6638: Ensure scanners are in place to identify and prevent sensitive data in deployment configuration [Added]
  • TA6639: Limit access to deployment configurations [Added]
  • TA6640: Ensure deployment configuration manifests are verified [Added]
  • TA6641: Ensure deployment configuration manifests are pinned to a specific, verified version [Added]
  • TA6674: Ensure deployment configuration files are separated from source code [Added]
  • TA6675: Scan Infrastructure as Code (IaC) [Added]
• T3916: Ensure automated and secure deployment (GitHub) [Added]
  • P1949: Insecure and uncontrolled deployment practices (GitHub) [Added]
  • TA6642: Ensure deployments are automated [Added]
  • TA6643: Ensure the deployment environment is reproducible [Added]
  • TA6644: Ensure access to production environment is limited [Added]
  • TA6645: Ensure default passwords are not used [Added]
• T3917: Test code change management strategies (GitHub) [Added]
  • P1933: Inadequate code governance and security (GitHub) [Added]
  • TA6676: Test code tracking in a version control platform [Added]
  • TA6677: Test traceability of code changes to their associated tasks [Added]
  • TA6678: Test approval process for code changes by two strongly authenticated users [Added]
  • TA6679: Test dismissal of previous approvals when updates are introduced to a code change proposal [Added]
  • TA6680: Test restrictions on who can dismiss code change reviews [Added]
  • TA6681: Test code owner settings for extra sensitive code or configuration [Added]
  • TA6682: Test requirement of code owner's review when a change affects owned code [Added]
  • TA6683: Test periodic review and removal of inactive branches [Added]
  • TA6684: Test passing of all checks before merging new code [Added]
  • TA6685: Test updating of open Git branches before merging into the code base [Added]
  • TA6686: Test branch protection rules enforcement for administrators [Added]
  • TA6687: Test denial of force push code to branches [Added]
  • TA6688: Test denial of branch deletions [Added]
  • TA6689: Test automatic scanning for risks when merging code [Added]
  • TA6690: Test auditing of changes to branch protection rules [Added]
  • TA6691: Test enforcement of branch protection on the default branch [Added]
  • TA6767: Test resolution of all open comments before allowing code change merging [Added]
  • TA6768: Test verification of signed commits for new changes before merging [Added]
  • TA6769: Test enforcement of linear history [Added]
  • TA6770: Test restriction of pushing or merging new code to specific individuals or teams [Added]
• T3918: Test repository management and security strategies (GitHub) [Added]
  • P1934: Insufficient repository management and security (GitHub) [Added]
  • TA6692: Test presence of SECURITY.md file in all public repositories [Added]
  • TA6693: Test restriction of repository creation to specific members [Added]
  • TA6694: Test restriction of repository deletion to specific users [Added]
  • TA6695: Test restriction of issue deletion to specific users [Added]
  • TA6696: Test tracking and accounting of all copies (forks) of code [Added]
  • TA6697: Test tracking of changes in visibility status for all code projects [Added]
  • TA6698: Test periodic review and archiving of inactive repositories [Added]
• T3919: Test regular review and inactive users removal (GitHub) [Added]
  • P1935: Insufficient organizational and access controls (GitHub) [Added]
  • TA6699: Test restriction of team creation to specific members [Added]
  • TA6700: Test setting of minimum number of administrators for the organization [Added]
  • TA6701: Test enforcement of strict base permissions for repositories [Added]
  • TA6702: Test tracking of anomalous code behavior [Added]
  • TA6771: Test periodic review and removal of inactive users [Added]
  • TA6772: Test requirement of Multi-Factor Authentication (MFA) for contributors of new code [Added]
  • TA6773: Test enforcement of Multi-Factor Authentication (MFA) for organization members [Added]
  • TA6774: Test requirement of company-approved email for inviting new members [Added]
  • TA6775: Test setting of two administrators for each repository [Added]
  • TA6776: Test confirmation of an organization’s identity with a “Verified” badge [Added]
  • TA6777: Test restriction of Source Code Management (SCM) email notifications to verified domains [Added]
  • TA6778: Test provision of SSH certificates by the organization [Added]
  • TA6779: Test limitation of Git access based on IP addresses [Added]
• T3920: Test application and webhook security strategies (GitHub) [Added]
  • P1936: Insufficient application and integration management (GitHub) [Added]
  • TA6703: Test requirement of administrator approval for every installed application [Added]
  • TA6704: Test periodic review and removal of stale applications [Added]
  • TA6705: Test limiting of access granted to each installed application to the least privilege needed [Added]
  • TA6706: Test usage of only secured webhooks [Added]
• T3921: Test scanning and security measures (GitHub) [Added]
  • P1937: Inadequate automated security scanning (GitHub) [Added]
  • TA6780: Test presence of scanners to identify and prevent sensitive data in code [Added]
  • TA6781: Test presence of scanners to secure Continuous Integration (CI) pipeline instructions [Added]
  • TA6782: Test presence of scanners to secure Infrastructure as Code (IaC) instructions [Added]
  • TA6783: Test presence of scanners for code vulnerabilities [Added]
  • TA6784: Test presence of scanners for open-source vulnerabilities in used packages [Added]
  • TA6785: Test presence of scanners for open-source license issues in used packages [Added]
• T3922: Test pipeline efficiency and security (GitHub) [Added]
  • P1938: Insufficient build environment security and management (GitHub) [Added]
  • TA6707: Test immutability of all aspects of the pipeline infrastructure and configuration [Added]
  • TA6708: Test logging of the build environment [Added]
  • TA6709: Test automation of the build environment creation [Added]
  • TA6710: Test limitation of access to build environments [Added]
  • TA6711: Test requirement of user authentication to access the build environment [Added]
  • TA6712: Test automatic scanning of build infrastructure for vulnerabilities [Added]
  • TA6713: Test non-usage of default passwords [Added]
  • TA6714: Test securing of webhooks in the build environment [Added]
  • TA6715: Test setting of minimum number of administrators for the build environment [Added]
  • TA6786: Test ensuring each pipeline has a single responsibility [Added]
  • TA6787: Test limiting of build secrets to the minimal necessary scope [Added]
• T3923: Test secure build worker management (GitHub) [Added]
  • P1939: Insufficient build worker security and management (GitHub) [Added]
  • TA6716: Test single-use policy for build workers [Added]
  • TA6717: Test passing of build worker environments and commands, not pulling [Added]
  • TA6718: Test segregation of duties for each build worker [Added]
  • TA6719: Test minimal network connectivity for build workers [Added]
  • TA6720: Test enforcement of run-time security for build workers [Added]
  • TA6721: Test automatic scanning of build workers for vulnerabilities [Added]
  • TA6722: Test storage of build workers' deployment configuration in a version control platform [Added]
  • TA6723: Test monitoring of resource consumption by build workers [Added]
• T3924: Test pipeline definition and security (GitHub) [Added]
  • P1940: Inadequate pipeline security and configuration management (GitHub) [Added]
  • TA6724: Test defining of all build steps as code [Added]
  • TA6725: Test clearly defined build stage input and output for steps [Added]
  • TA6726: Test writing of output to a separate, secured storage repository [Added]
  • TA6727: Test tracking and reviewing of changes to pipeline files [Added]
  • TA6728: Test minimizing access to build process triggering [Added]
  • TA6729: Test automatic scanning of pipelines for misconfigurations [Added]
  • TA6730: Test automatic scanning of pipelines for vulnerabilities [Added]
  • TA6788: Test presence of scanners to identify and prevent sensitive data in pipeline files [Added]
• T3925: Test artifact signing (GitHub) [Added]
  • P1941: Insufficient artifact and dependency security (GitHub) [Added]
  • TA6731: Test signing of all artifacts on all releases [Added]
  • TA6732: Test locking of all external dependencies used in the build process [Added]
  • TA6733: Test validation of dependencies before use [Added]
  • TA6734: Test creation of reproducible artifacts by the build pipeline [Added]
  • TA6735: Test production of a Software Bill of Materials (SBOM) by pipeline steps [Added]
  • TA6736: Test signing of the Software Bill of Materials (SBOM) produced by pipeline steps [Added]
  • TA6789: Test signing of all artifacts on all releases (level 2) [Added]
• T3926: Test third-party artifact security (GitHub) [Added]
  • P1942: Insufficient third-party and open-source security (GitHub) [Added]
  • TA6737: Test verification of third-party artifacts and open-source libraries [Added]
  • TA6738: Test requirement of a signed Software Bill of Materials (SBOM) from all third-party suppliers [Added]
  • TA6739: Test requirement and verification of signed metadata of the build process [Added]
  • TA6740: Test monitoring of dependencies between open-source components [Added]
  • TA6741: Test defining and prioritizing of trusted package managers and repositories [Added]
  • TA6742: Test supplying of a signed Software Bill of Materials (SBOM) of the code [Added]
  • TA6743: Test pinning of dependencies to a specific, verified version [Added]
  • TA6790: Test ensuring all packages used are more than 60 days old [Added]
• T3927: Test dependency management strategy (GitHub) [Added]
  • P1943: Inadequate dependency management and security (GitHub) [Added]
  • TA6744: Test enforcement of an organization-wide dependency usage policy [Added]
  • TA6745: Test automatic scanning of packages for known vulnerabilities [Added]
  • TA6746: Test automatic scanning of packages for license implications [Added]
  • TA6747: Test automatic scanning of packages for ownership change [Added]
• T3928: Test distributed artifact security (GitHub) [Added]
  • P1944: Insufficient artifact security and distribution control (GitHub) [Added]
  • TA6791: Test signing of all artifacts by the build pipeline itself [Added]
  • TA6792: Test encryption of artifacts before distribution [Added]
  • TA6793: Test ensuring only authorized platforms have decryption capabilities of artifacts [Added]
• T3929: Test artifact certification and uploading rules (GitHub) [Added]
  • P1945: Insufficient control and security of package registry (GitHub) [Added]
  • TA6748: Test limiting of the authority to certify artifacts [Added]
  • TA6749: Test minimizing the number of permitted users who may upload new artifacts [Added]
  • TA6750: Test non-local user management of the package registry [Added]
  • TA6751: Test revocation of anonymous access to artifacts [Added]
  • TA6752: Test setting of minimum number of administrators for the package registry [Added]
  • TA6794: Test requirement of Multi-Factor Authentication (MFA) for user access to the package registry [Added]
• T3930: Test package registry security (GitHub) [Added]
  • P1946: Inadequate package registry validation and security (GitHub) [Added]
  • TA6753: Test validation of all signed artifacts upon uploading to the package registry [Added]
  • TA6754: Test validation of signatures for all versions of an existing artifact [Added]
  • TA6755: Test auditing of changes in package registry configuration [Added]
  • TA6756: Test securing of repository webhooks [Added]
• T3931: Test artifact origin information policy (GitHub) [Added]
  • P1947: Lack of artifact origin information (GitHub) [Added]
  • TA6757: Test ensuring artifacts contain information about their origin [Added]
• T3932: Test separation of deployment configuration files (GitHub) [Added]
  • P1948: Inadequate deployment configuration management and security (GitHub) [Added]
  • TA6758: Test auditing of changes in deployment configuration [Added]
  • TA6759: Test presence of scanners to identify and prevent sensitive data in deployment configuration [Added]
  • TA6760: Test limitation of access to deployment configurations [Added]
  • TA6761: Test verification of deployment configuration manifests [Added]
  • TA6762: Test pinning of deployment configuration manifests to a specific, verified version [Added]
  • TA6795: Test separation of deployment configuration files from source code [Added]
  • TA6796: Test scanning of Infrastructure as Code (IaC) [Added]
• T3933: Test automated and secure deployment (GitHub) [Added]
  • P1949: Insecure and uncontrolled deployment practices (GitHub) [Added]
  • TA6763: Test automation of deployments [Added]
  • TA6764: Test reproducibility of the deployment environment [Added]
  • TA6765: Test limitation of access to the production environment [Added]
  • TA6766: Test non-usage of default passwords [Added]
• T3934: Implement policies for secure handling of business data [Added]
  • P1950: Insecure handling of business data in Amazon business applications [Added]
• T3935: Protect sensitive cost and billing data [Added]
  • P1951: Exposure of sensitive billing data [Added]
• T3936: Isolate application workloads according to security requirements [Added]
  • P1952: Insufficient isolation of application workloads [Added]
• T3937: Ensure compute services have sufficient resources and are fault tolerant [Added]
  • P1953: Denial of service attacks against application workloads [Added]
• T3938: Monitor application workloads and patch vulnerabilities [Added]
  • P1954: Undetected vulnerabilities in application workloads [Added]
• T3939: Deploy and manage application environments through automation [Added]
  • P1955: Manual application management processes [Added]
• T3940: Use trusted container images [Added]
  • P1956: Vulnerable container images [Added]
• T3941: Protect images against supply chain attacks [Added]
  • P1957: Supply chain attacks that target container images [Added]
• T3942: Run containers with a least privilege identity [Added]
  • P1958: Containers with excessive privileges [Added]
• T3943: Use IAM authentication for databases if supported [Added]
  • P1959: Weaknesses in credential management [Added]
• T3944: Create dedicated database user accounts with minimum privileges [Added]
  • P1960: Excessive permissions for database user accounts [Added]
• T3945: Use encryption to protect data at rest [Added]
  • P1961: Unencrypted data at rest [Added]
• T3946: Schedule regular database backups to protect availability [Added]
  • P1962: Failure to safeguard against data loss in cloud database [Added]
• T3947: Monitor database activity and consider audit logging [Added]
  • P1963: Failure to monitor database activity in AWS databases [Added]
• T3948: Use a centralized artifact store to manage dependencies [Added]
  • P1964: Vulnerable or malicious application dependencies [Added]
• T3949: Deploy software using automated processes [Added]
  • P1965: Poor dependency management with manual deployment [Added]
• T3950: Integrate application security testing into the CI/CD pipeline [Added]
  • P1966: Insufficient controls to detect vulnerable code [Added]
• T3951: Give developers least privilege access to the development environment [Added]
  • P1967: Excessive permissions in the development environment [Added]
• T3952: Log activity in the development environment [Added]
  • P1968: Insufficient monitoring of development activity and CI/CD processes [Added]
• T3953: Strengthen authentication and verification for WorkSpaces and AppStream clients [Added]
  • P1969: Weak client authentication for application streaming [Added]
• T3954: Prevent data leakage in WorksSpaces and AppStream environments [Added]
  • P1970: Data exfiltration in application workspaces [Added]
• T3955: Use the AWS Web Application Firewall (WAF) with AWS AppSync and AWS Amplify [Added]
  • P1971: Failure to protect against common web attacks [Added]
• T3956: Identify authentication requirements for web application clients [Added]
  • P1972: Incorrect or insufficient authentication for web APIs or web applications [Added]
• T3957: Add only secure hardware to your system [Added]
  • P1973: Vulnerable device hardware or software [Added]
• T3958: Assign a unique, secure identity to each IoT device using client certificates [Added]
  • P1974: Insecure identity management for IoT devices [Added]
• T3959: Protect sensitive data on the device [Added]
  • P1975: Insecure storage of device data at rest [Added]
• T3960: Use AWS IoT Device Defender as part of your IoT logging strategy [Added]
  • P1976: Failure to monitor device activity [Added]
• T3961: Use network segmentation strategies and a secure method to connect devices to the AWS cloud [Added]
  • P1977: Weak network protections for IoT devices [Added]
• T3962: Use AWS Organizations to manage multi-account setups [Added]
  • P1978: Lack of isolation due to monolithic AWS architecture [Added]
• T3963: Use automated processes to keep people away from data [Added]
  • P1979: Manual management processes with insufficient security controls [Added]
• T3964: Implement an autoscaling infrastructure [Added]
  • P1980: Compromised availability due to lack of resources [Added]
• T3965: Follow best practices for logging and monitoring [Added]
  • P1981: Insecure or insufficient system logging [Added]
• T3966: Implement token-based authentication or signed URLs [Added]
  • P1982: Insufficient protection for high-value media content [Added]
• T3967: Look for logging anomalies and consider watermarking content [Added]
  • P1983: Failure to detect unauthorized media access [Added]
• T3968: Secure communication from the publisher to your AWS account [Added]
  • P1984: Failure to protect the entire content pipeline [Added]
• T3969: Defend media workloads against denial of service attacks [Added]
  • P1985: Denial of service attacks against streaming services [Added]
• T3970: Follow the assess, mobilize, migrate pattern [Added]
  • P1986: Lack of migration planning [Added]
• T3971: Understand how discovery tools use data and ensure it is handled securely. [Added]
  • P1987: Excessive permissions for discovery tools [Added]
• T3972: Begin migrations by establishing a landing zone [Added]
  • P1988: Incomplete or insecure deployment [Added]
• T3973: Protect migration data with validation and a secure connection method [Added]
  • P1989: Failure to safeguard data during migration [Added]
• T3974: Vet data and monitor models according to best practices [Added]
  • P1990: Data poisoning attacks [Added]
• T3975: Vet training data sets for sensitive data and sanitize them [Added]
  • P1991: Exposure of sensitive or confidential data [Added]
• T3976: Isolate ML workloads [Added]
  • P1992: Unecessary exposure of ML environments [Added]
• T3977: Limit access to ML artifacts [Added]
  • P1993: Insufficient protection for ML artifacts [Added]
• T3978: Review the AWS Responsible AI Policy and ensure your application is in compliance [Added]
  • P1994: Failure to meet the AWS Responsible AI Policy requirements [Added]
• T3979: Segment your network and implement security controls between zones [Added]
  • P1995: Insufficient network isolation in an AWS environment [Added]
• T3980: Put public endpoints behind a content delivery network, gateway, or load balancer [Added]
  • P1996: Failure to protect public endpoints [Added]
• T3981: Harden VPCs against denial of service attacks [Added]
  • P1997: Denial of service attacks against networks and public endpoints [Added]
• T3982: Implement best practices for hybrid networks [Added]
  • P1998: Weak security controls for hybrid networks [Added]
• T3983: Follow best practices for key management and monitoring [Added]
  • P1999: Insecure key management in AWS [Added]
• T3984: Ensure security events trigger notifications and responses [Added]
  • P2000: Insufficient monitoring of security events [Added]
• T3985: Conduct regular security audits [Added]
  • P2001: Failing to follow business security policy [Added]
• T3986: Consider attribute-based access control (ABAC) for authorization at scale [Added]
  • P2002: Inflexible IAM policies for large and dynamic systems [Added]
• T3987: Implement access controls based on the sensitivity and criticality of data [Added]
  • P2003: Insufficient data access controls [Added]
• T3988: Use detective controls and data auditing to detect anomalous activity [Added]
  • P2004: Failure to monitor storage access [Added]
• T3989: Use policies to enforce automatic encryption [Added]
  • P2005: Unencrypted data at rest in cloud storage [Added]
• T3990: Schedule regular backups [Added]
  • P2006: Failure to safeguard against data loss [Added]
• T3991: Anonymize sensitive data so it is not visible in the analytics environment [Added]
  • P2007: Insufficient privacy of data in analytics workloads [Added]
• T3992: Ensure all types of data are reviewed and classified [Added]
  • P2008: Insufficient data classification and data controls [Added]
• T3993: Record data classification attributes in your data catalog [Added]
  • P2009: Failure to maintain data classification and data controls in different workloads [Added]
• T3994: Validate messages for sensitive data and implement masking and redaction [Added]
  • P2010: Sensitive data in messaging services [Added]
• T3995: Follow a least privilege approach when granting permissions to a service [Added]
  • P2011: Overly broad permissions for AWS services [Added]
• T3996: Disable public access [Added]
  • P2012: Publicly accessible AWS services [Added]
• T3997: Protect internal service communication with VPC endpoints [Added]
  • P2013: Network eavesdropping or interception attacks in AWS services [Added]
• T3998: Protect data in transit using TLS [Added]
  • P2014: Unencrypted data in transit in AWS services [Added]
• T3999: Protect data at rest with encryption [Added]
  • P2015: Unencrypted data at rest in AWS services [Added]
• T4000: Consider using customer-managed keys (CMKs) [Added]
  • P2016: Lack of control over encryption keys in AWS services [Added]
• T4001: Ensure logging features are enabled and configured appropriately [Added]
  • P2017: Failure to monitor service activity in AWS services [Added]
• T4002: Use conditions to limit policies to specific resources and accounts [Added]
  • P2018: Confused deputy attacks in AWS services [Added]
• T4003: Implement strict key processes for storing, handling, and using blockchain keys [Added]
  • P2019: Insecure key management in AWS blockchain services [Added]
• T4004: Use established patterns to hide private data and link it to blockchain transactions [Added]
  • P2020: Disclosure of private business data [Added]
• T4005: Have a plan for modifying smart contracts or mitigating newly discovered vulnerabilities [Added]
  • P2021: Smart contract vulnerabilities [Added]
• T4006: Follow security best practices when utilizing AI tools for code generation [Added]
  • P2022: Insecure coding and hallucinations [Added]
• T4007: Follow security best practices when utilizing AI tools for code documentation [Added]
  • P2022: Insecure coding and hallucinations [Added]
• T4008: Use a Human-in-the-Loop approach when utilizing AI tools [Added]
  • P2023: Lack of expert oversight on AI-generated code [Added]
• T4009: Do not use AI systems for prohibited practices [Added]
  • P2024: Lack of complience with EU AI Act [Added]
• T4010: Determine the risk level of your AI systems [Added]
  • P2024: Lack of complience with EU AI Act [Added]
• T4011: Implement transparency for end users of General Purpose AI systems [Added]
  • P2025: Lack of transparency and accountability in AI systems [Added]
• T4012: Implement requirments for your low risk AI systems [Added]
  • P2025: Lack of transparency and accountability in AI systems [Added]
• T4013: Establish a risk management system for high-risk AI systems [Added]
• T4014: Ensure data integrity and governance for high-risk AI systems [Added]
• T4015: Provide comprehensive technical documentation for high-risk AI systems [Added]
  • P2025: Lack of transparency and accountability in AI systems [Added]
• T4016: Implement robust record-keeping (logging) for high-risk AI systems [Added]
• T4017: Ensure human oversight for high-risk AI systems [Added]
  • P2026: Insufficient human oversight [Added]
• T4018: Ensure transparency with deployers for high-risk AI systems [Added]
  • P2025: Lack of transparency and accountability in AI systems [Added]
• T4019: Implement transparency with users of high-risk AI systems [Added]
  • P2025: Lack of transparency and accountability in AI systems [Added]
• T4020: Ensure accuracy, robustness, and cybersecurity of high-risk AI systems [Added]
• T4021: Establish a comprehensive quality management system (QMS) for high-risk AI systems [Added]
  • P2027: Inadequate quality management of high-risk AI systems [Added]
• T4022: Acquire a conformity certificate for high-risk AI systems via Comformity Assessment [Added]
  • P2028: Insufficient validation of high-risk AI systems before market placement [Added]
• T4023: Register high-risk AI systems and provide CE markings [Added]
  • P2029: Lack of compliance and traceability for high-risk AI systems [Added]
• T4024: Ensure the responsible and compliant use of high-risk AI systems by deployers [Added]
  • P2030: Inadequate implementation and monitoring of high-risk AI systems by deployers [Added]
• T4025: Provide Fundamental Rights Impact Assessment before deploying a high-risk AI system [Added]
  • P2028: Insufficient validation of high-risk AI systems before market placement [Added]
• T4026: Technical documentation for general-purpose AI models [Added]
  • P2025: Lack of transparency and accountability in AI systems [Added]
• T4027: Implement protocols and ensure compliance for General-Purpose AI models with systemic risk [Added]
  • P2031: Inadequate managment of systemic risks associated with GPAI models [Added]
• T4028: Appoint an authorized EU representative for general-purpose AI models (Non-EU providers) [Added]
  • P2032: Lack of accountability for non-EU providers of AI models in the EU market [Added]
• T4029: Establish post-market monitoring for high-risk AI systems [Added]
  • P2033: Lack of post-market monitoring of AI systems [Added]
• T4030: Adjust reporting policy/incident response plan for serious incidents involving high-risk AI systems [Added]
  • P2034: Insufficient reporting and response to serious incidents [Added]
• T4031: Consider using customer-managed encryption keys (CMKs) (AWS Bedrock) [Added]
  • P2035: Lack of control with service-managed encryption keys (AWS Bedrock) [Added]
• T4032: Prevent App Mesh nodes from forwarding external traffic (AWS App Mesh) [Added]
  • P2036: Exposure to external (public) traffic (AWS App Mesh) [Added]
• T4033: Require TLS for all App Mesh virtual gateways (AWS App Mesh) [Added]
  • P2037: Unencrypted communication to mesh gateways (AWS App Mesh) [Added]
• T4034: Regularly check that you are using the latest Envoy image (AWS App Mesh) [Added]
  • P2038: Using an old version of the Envoy proxy (AWS App Mesh) [Added]
• T4035: Use vault lock policies to prevent archive deletions (AWS S3 Glacier) [Added]
  • P2039: Vault changes could violate compliance requirements (AWS S3 Glacier) [Added]
• T4036: Always use certificate verification during uploads (AWS S3 Glacier) [Added]
  • P2040: Uploading archives without certificate validation (AWS S3 Glacier) [Added]
• T4037: Use CloudTrail to monitor Glacier vaults (AWS S3 Glacier) [Added]
  • P2041: Failure to monitor vault activity (AWS S3 Glacier) [Added]
• T4038: Enable encryption or configure a security policy for ETL jobs (AWS Glue) [Added]
  • P2042: Unencrypted destination and temporary data (AWS Glue) [Added]
• T4039: Enable encryption for the Data Catalog (AWS Glue) [Added]
  • P2043: Unencrypted data in the Data Catalog (AWS Glue) [Added]
• T4040: Create a limited service role for AWS Glue jobs and tasks (AWS Glue) [Added]
  • P2044: Excessive permissions for the AWS Glue service (AWS Glue) [Added]
• T4041: Consider using a customer managed key for encryption (AWS Glue) [Added]
  • P2045: Lack of control over encryption keys (AWS Glue) [Added]
• T4042: Use encrypted data stores with Lake Formation services (AWS Lake Formation) [Added]
  • P2046: Unencrypted data at rest (AWS Lake Formation) [Added]
• T4043: Enforce fine-grained access control (AWS Lake Formation) [Added]
  • P2047: Incorrect configuration of Lake Formation permissions (AWS Lake Formation) [Added]
• T4044: Grant minimum access to tables, columns, and rows (AWS Lake Formation) [Added]
  • P2048: Excessive permissions for Lake Formation data access (AWS Lake Formation) [Added]
• T4045: Use managed identities and follow a least privilege approach to granting permissions [Added]
  • P2049: Overly broad permissions for a service [Added]
• T4046: Disable public access and configure service endpoints [Added]
  • P2050: Publicly accessible services [Added]
• T4047: Protect internal service communication with Private Link [Added]
  • P2051: Network eavesdropping or interception attacks [Added]
• T4048: Protect data in transit using TLS [Added]
  • P2052: Unencrypted data in transit in Azure [Added]
• T4049: Protect data at rest with encryption [Added]
  • P2053: Unencrypted data at rest in Azure [Added]
• T4050: Consider using customer-managed keys (CMKs) [Added]
  • P2054: Lack of control over encryption keys in Azure [Added]
• T4051: Ensure logging features are enabled and configured appropriately [Added]
  • P2055: Failure to monitor service activity in Azure [Added]
• T4052: Follow best practices to harden Azure user accounts [Added]
  • P2056: Insecure user account management practices in Azure [Added]
• T4053: Restrict the use of highly privileged accounts [Added]
  • P2057: Performing adminstrative tasks as the global administrator in Azure [Added]
• T4054: Segregate Azure resources to limit risk [Added]
  • P2058: Insufficient isolation in Azure environments [Added]
• T4055: Disable cross-tenant object replication (Azure Blob Storage) [Added]
  • P2059: Allowing cross-tenant object replication (Azure Blob Storage) [Added]
• T4056: Enable point-in-time restores for containers (Azure Blob Storage) [Added]
  • P2060: Insufficient protection against data loss or corruption (Azure Blob Storage) [Added]
• T4057: Use best practices to limit security risks of SAS (Azure Blob Storage) [Added]
  • P2061: Insecure use of SAS (Shared Access Signatures) (Azure Blob Storage) [Added]
• T4058: Limit network access with an IP firewall (Azure Cosmos DB) [Added]
  • P2062: Insufficient network-level protection (Azure Cosmos DB) [Added]
• T4059: Enforce a minimum TLS version for database communication (Azure Cosmos DB) [Added]
  • P2063: Weak encryption for data in transit (Azure Cosmos DB) [Added]
• T4060: Create dedicated database user accounts with minimum privileges (Azure Cosmos DB) [Added]
  • P2064: Excessive permissions for database access (Azure Cosmos DB) [Added]
• T4061: Consider using customer-managed encryption keys (CMKs) (Azure Cosmos DB) [Added]
  • P2065: Lack of control with service-managed encryption keys (Azure Cosmos DB) [Added]
• T4062: Consider diagnostic settings for audit logging (Azure Cosmos DB) [Added]
  • P2066: Failure to monitor database activity (Azure Cosmos DB) [Added]
• T4063: Limit network access with firewall settings (Azure Data Factory) [Added]
  • P2067: Insufficient network-level protection (Azure Data Factory) [Added]
• T4064: Use outbound rules to limit outgoing traffic (Azure Data Factory) [Added]
  • P2068: Unrestricted outgoing traffic (Azure Data Factory) [Added]
• T4065: Consider using customer-managed encryption keys (CMKs) (Azure Data Factory) [Added]
  • P2069: Lack of control with service-managed encryption keys (Azure Data Factory) [Added]
• T4066: Store data factory secrets in Key Vault (Azure Data Factory) [Added]
  • P2070: Inadequate protection of connection strings and credentials (Azure Data Factory) [Added]
• T4067: Use ACLs and follow least privilege guidelines (Azure Data Lake Storage) [Added]
  • P2071: Excessive file permissions (Azure Data Lake Storage) [Added]
• T4068: Limit network access with firewall settings (Azure Data Lake Storage) [Added]
  • P2072: Insufficient network-level protection (Azure Data Lake Storage) [Added]
• T4069: Enable Microsoft Defender for storage accounts (Azure Data Lake Storage) [Added]
  • P2073: Insufficient protection against exploits that target storage accounts (Azure Data Lake Storage) [Added]
• T4070: Enforce TLS for all connections (Azure Data Lake Storage) [Added]
  • P2074: Lack of protection for data in transit (Azure Data Lake Storage) [Added]
• T4071: Conside using customer-managed encryption keys (CMKs) (Azure Data Lake Storage) [Added]
  • P2075: Lack of control with service-managed encryption keys (Azure Data Lake Storage) [Added]
• T4072: Enable soft delete features (Azure Data Lake Storage) [Added]
  • P2076: Insufficient protection against data deletion (Azure Data Lake Storage) [Added]
• T4073: Set retention policies on immutable data (Azure Data Lake Storage) [Added]
  • P2077: Failing to prevent changes to data that must be retained in its original form (Azure Data Lake Storage) [Added]
• T4074: Enable logging for file storage activity (Azure Data Lake Storage) [Added]
  • P2078: Failure to monitor file storage activity (Azure Data Lake Storage) [Added]
• T4075: Add a Resource Manager lock for every storage account (Azure Data Lake Storage) [Added]
  • P2079: Storage account deletion (Azure Data Lake Storage) [Added]
• T4076: Do not allow shared key authentication (Azure Data Lake Storage) [Added]
  • P2080: Account keys grant excessive permissions with no security controls (Azure Data Lake Storage) [Added]
• T4077: Limit network access with firewall settings (Azure Event Hubs) [Added]
  • P2081: Insufficient network-level protection (Azure Event Hubs) [Added]
• T4078: Prefer Microsoft Entra to shared access policies for authentication (Azure Event Hubs) [Added]
  • P2082: Insecure management of authentication credentials (Azure Event Hubs) [Added]
• T4079: Consider using customer-managed encryption keys (CMKs) (Azure Event Hubs) [Added]
  • P2083: Lack of control with service-managed encryption keys (Azure Event Hubs) [Added]
• T4080: Enforce a minimum TLS version of 1.2 (Azure Event Hubs) [Added]
  • P2084: Weak encryption for data in transit (Azure Event Hubs) [Added]
• T4081: Add only secure hardware to your system (Azure IoT Hub) [Added]
  • P2085: Insecure devices (Azure IoT Hub) [Added]
• T4082: Enable Defender for IoT for agentless threat detection (Azure IoT Hub) [Added]
  • P2086: Insufficient monitoring and failure to detect security events (Azure IoT Hub) [Added]
• T4083: Consider Device Update for IoT Hub (Azure IoT Hub) [Added]
  • P2087: Devices with older software or firmware (Azure IoT Hub) [Added]
• T4084: Limit network access with firewall settings (Azure IoT Hub) [Added]
  • P2088: Insufficient network-level protection (Azure IoT Hub) [Added]
• T4085: Prefer Microsoft Entra to shared access policies for authentication (Azure IoT Hub) [Added]
  • P2089: Insecure management of authentication credentials (Azure IoT Hub) [Added]
• T4086: Give minimum privileges when granting access to IoT Hub (Azure IoT Hub) [Added]
  • P2090: Excessive permissions for IoT users (Azure IoT Hub) [Added]
• T4087: Authenticate devices with X.509 Certificates (Azure IoT Hub) [Added]
  • P2091: Poor credential management for IoT Hub devices (Azure IoT Hub) [Added]
• T4088: Consider enforcing a minimum TLS version of 1.2 (Azure IoT Hub) [Added]
  • P2092: Weak encryption for data in transit (Azure IoT Hub) [Added]
• T4089: Apply for an exemption to abuse monitoring (Azure OpenAI) [Added]
  • P2093: Abuse monitoring has access to highly sensitive information (Azure OpenAI) [Added]
• T4090: Consider using customer-managed encryption keys (CMKs) (Azure OpenAI) [Added]
  • P2094: Lack of control with service-managed encryption keys (Azure OpenAI) [Added]
• T4091: Review the Responsible AI guidance and ensure your application is in compliance (Azure OpenAI) [Added]
  • P2095: Failure to meet the Responsible AI requirements (Azure OpenAI) [Added]
• T4092: Follow best practices for service account identities [Added]
  • P2096: Insecure service identities in Google Cloud Platform (GCP) [Added]
• T4093: Follow a least privilege approach when granting service permissions [Added]
  • P2097: Overly broad permissions for a service in Google Cloud Platform (GCP) [Added]
• T4094: Disable public access and use private connect [Added]
  • P2098: Publicly accessible services in Google Cloud Platform (GCP) [Added]
• T4095: Consider using customer-managed keys (CMEKs) [Added]
  • P2099: Lack of control over encryption keys in Google Cloud Platform (GCP) [Added]
• T4096: Ensure logging features are enabled and configured appropriately [Added]
  • P2100: Failure to monitor service activity in Google Cloud Platform (GCP) [Added]
• T4097: Follow best practices to harden GCP user accounts [Added]
  • P2101: Insecure user account management practices in Google Cloud Platform (GCP) [Added]
• T4098: Restrict the use of highly privileged accounts [Added]
  • P2102: Performing adminstrative tasks as a super administrator in Google Cloud Platform (GCP) [Added]
• T4099: Segregate GCP resources to limit risk [Added]
  • P2103: Insufficient isolation in GCP environments in Google Cloud Platform (GCP) [Added]
• T4100: Limit user permissions that can allow privilege escalation [Added]
  • P2104: Privilege-escalation attacks with service accounts in Google Cloud Platform (GCP) [Added]
• T4101: Use LDAPS or another encrypted protocol [Added]
  • P2105: Unencrypted communication between clients and directory servers [Added]
• T4102: Identify threats with active monitoring and pen testing [Added]
  • P2106: LDAP reconnaissance [Added]
• T4103: Implement secure password policies and MFA [Added]
  • P2107: Weak password policies and authentication practices [Added]
• T4104: Follow a least privilege approach when granting permissions [Added]
  • P2108: Excessive user privileges [Added]
• T4105: Sanitize input or use parameterized LDAP queries [Added]
  • P2109: LDAP injection [Added]
• T4106: Use network and OS controls to isolate directory servers [Added]
  • P2110: Insufficient isolation of directory servers [Added]
• T4107: Harden the backup process and limit human access [Added]
  • P2111: Insecure replication or backup practices [Added]
• T4108: Keep directory servers up to date [Added]
  • P2112: Out-of-date software on the directory server [Added]
• T4109: Use DNSSEC to sign DNS records [Added]
  • P2113: DNS spoofing and cache poisoning [Added]
• T4110: Implement in-transit encryption with DoT or DoH [Added]
  • P2114: Lack of in-transit encryption for DNS queries [Added]
• T4111: Implement DoS protections [Added]
  • P2115: DNS denial of service attacks [Added]
• T4112: Restrict zone transfers to authorized DNS servers [Added]
  • P2116: Information exposure due to unauthorized zone transfers [Added]
• T4113: Use strict access controls for administration in DNS servers [Added]
  • P2117: Insecure management interfaces in DNS [Added]
• T4114: Monitor DNS server activity [Added]
  • P2118: Failure to monitor DNS server activity [Added]
• T4115: Keep DNS servers up to date [Added]
  • P2119: Out-of-date DNS server software [Added]
• T4116: Deploy firewalls at the network perimeter and between zones [Added]
  • P2120: Improper firewall placement [Added]
• T4117: Follow best practices when writing and ordering firewall rules [Added]
  • P2121: Disorganized firewall rules [Added]
• T4118: Implement a logging strategy that satisfies both security and performance requirements [Added]
  • P2122: Excessive or inadequate logging in firewall [Added]
• T4119: Use strict access controls for administration in firewalls [Added]
  • P2123: Insecure management interfaces in firewall [Added]
• T4120: Keep firewall software and firmware up to date [Added]
  • P2124: Out-of-date firewall software or hardware [Added]
• T4121: Back up firewall configuration [Added]
  • P2125: Failure to back up firewall configuration [Added]
• T4122: Configure firewall failover and redundancy [Added]
  • P2126: Failure to design for high availability firewall [Added]
• T4123: Support the FTPS or SFTP protocol [Added]
  • P2127: Unencrypted data in transit in FTP [Added]
• T4124: Isolate the FTP server in a DMZ [Added]
  • P2128: Improper network placement of the FTP server [Added]
• T4125: Prefer client certificates and strong authentication practices [Added]
  • P2129: Weak authentication practices for FTP clients [Added]
• T4126: Enforce user-specific FTP file storage [Added]
  • P2130: Insufficient isolation of FTP file storage [Added]
• T4127: Filter uploads and ensure files are handled safely [Added]
  • P2131: Malicious file uploads [Added]
• T4128: Use strict access controls for administration in FTP servers [Added]
  • P2132: Insecure management interfaces in FTP server [Added]
• T4129: Monitor FTP server activity [Added]
  • P2133: Failure to monitor FTP server activity [Added]
• T4130: Keep FTP servers up to date [Added]
  • P2134: Out-of-date FTP server software [Added]
• T4131: Tune IDS/IPS rules to mitigate false positives [Added]
  • P2135: Excessive IDS/IPS false positives [Added]
• T4132: Tune for efficiency based on risk analysis [Added]
  • P2136: Poor IDS/IPS performance or high resource consumption [Added]
• T4133: Monitor alerts and take manual or automatic actions in response [Added]
  • P2137: Failure to monitor security events [Added]
• T4134: Use strict access controls for administration in IDS/IPS systems [Added]
  • P2138: Insecure management interfaces in IPS/IDS [Added]
• T4135: Keep IDS/IPS up to date [Added]
  • P2139: Out-of-date detection rules or software [Added]
• T4136: Harden the session persistence cookie [Added]
  • P2140: Attacks against the session persistence cookie [Added]
• T4137: Configure end-to-end TLS encryption [Added]
  • P2141: Unencrypted data on internal networks [Added]
• T4138: Use a web application firewall or other network protections [Added]
  • P2142: Denial of service attacks against load balancers [Added]
• T4139: Use strict access controls for administration in load balancers [Added]
  • P2143: Inadequate security for management interfaces [Added]
• T4140: Keep load balancers up to date [Added]
  • P2144: Out-of-date load balancer software or hardware [Added]
• T4141: Configure load balancer failover and redundancy [Added]
  • P2145: Failure to design for high availability load balancer [Added]
• T4142: Protect message traffic with TLS and consider end-to-end message encryption [Added]
  • P2146: Unencrypted message data [Added]
• T4143: Use message signing and integrity checks [Added]
  • P2147: Message tampering in message broker [Added]
• T4144: Use data integrity and privacy controls [Added]
  • P2148: Sensitive or malicious data in messages [Added]
• T4145: Require client authentication and implement least privilege permissions [Added]
  • P2149: Weak authentication or excessive privileges for message clients [Added]
• T4146: Implement defenses against denial of service attacks [Added]
  • P2150: Denial of service attacks against message brokers [Added]
• T4147: Use strict access controls for administration [Added]
  • P2151: Insecure management interfaces in message broker [Added]
• T4148: Monitor message broker activity [Added]
  • P2152: Failure to monitor message broker activity [Added]
• T4149: Back up message brokers [Added]
  • P2153: Failure to back up message brokers [Added]
• T4150: Only connect to FTP servers using FTPS or SFTP [Added]
  • P2154: Connecting over unencrypted FTP [Added]
• T4151: Choose secure FTP client software and install updates promptly [Added]
  • P2155: Insecure FTP client software [Added]
• T4152: Secure the configuration of the client [Added]
  • P2156: Insecure configuration of VPN client software or devices [Added]
• T4153: Use network segmentation to separate proxy servers from other resources [Added]
  • P2157: Incorrect placement of a proxy server [Added]
• T4154: Use strict access controls for administration [Added]
  • P2158: Insecure management interfaces in proxy server [Added]
• T4155: Use content filtering to block malicious sites [Added]
  • P2159: Lack of content filtering [Added]
• T4156: Document any case of proxy server bypass [Added]
  • P2160: Undocumented proxy server bypass rules [Added]
• T4157: Monitor proxy server traffic [Added]
  • P2161: Failure to monitor proxy server activity [Added]
• T4158: Keep proxy servers up to date [Added]
  • P2162: Out-of-date proxy server software [Added]
• T4159: Place routers in a secure location [Added]
  • P2163: Routers in an insecure location device access [Added]
• T4160: Authenticate devices with 802.1X or another secure protocol [Added]
  • P2164: Unauthorized device access [Added]
• T4161: Disable unnecessary services [Added]
  • P2165: Unused router services [Added]
• T4162: Keep router firmware up to date [Added]
  • P2166: Unpatched vulnerabilities in router hardware [Added]
• T4163: Collect and monitor router traffic logs [Added]
  • P2167: Failure to monitor network traffic [Added]
• T4164: Configure port filtering [Added]
  • P2168: Overly permissive port access [Added]
• T4165: Protect message traffic with TLS encryption [Added]
  • P2169: Unencrypted message data in transit in Service Bus [Added]
• T4166: Use validation and integrity checks [Added]
  • P2170: Message tampering in service bus [Added]
• T4167: Apply consistent security policy to all services in a service bus [Added]
  • P2171: Inconsistent application of security measures across different services [Added]
• T4168: Require client authentication and implement least privilege permissions [Added]
  • P2172: Weak authentication for message producers [Added]
• T4169: Implement defenses against denial of service attacks [Added]
  • P2173: Vulnerability to denial of service attacks and failure [Added]
• T4170: Use strict access controls for administration [Added]
  • P2174: Insecure management interfaces in service bus [Added]
• T4171: Monitor service bus activity [Added]
  • P2175: Failure to monitor service bus activity [Added]
• T4172: Choose a secure VPN protocol [Added]
  • P2176: Insecure or noncompliant VPN protocols [Added]
• T4173: Prefer client certificates and MFA for authentication [Added]
  • P2177: Weak authentication for VPN clients [Added]
• T4174: Monitor VPN activity [Added]
  • P2178: Failure to monitor VPN traffic and events [Added]
• T4175: Use strict access controls for administration [Added]
  • P2179: Insecure management interfaces in VPN server [Added]
• T4176: Keep VPN servers up to date [Added]
  • P2180: Out-of-date VPN server software [Added]
• T4177: Use end-to-end encryption in addition to 3G network encryption [Added]
  • P2181: Insufficient encryption over a 3G network [Added]
• T4178: Consider using a private APN [Added]
  • P2182: Insufficient segregation of cell network traffic in 3G network [Added]
• T4179: Restrict the use of legacy protocols and monitor device connections [Added]
  • P2183: Fake base station attacks in 3G network [Added]
• T4180: Harden cell network hardware and monitor performance [Added]
  • P2184: Denial of service attacks against a 3G network [Added]
• T4181: Restrict physical access to devices, and prefer eSIMs [Added]
  • P2185: SIM cloning attacks in 3G network [Added]
• T4182: Use end-to-end encryption in addition to LTE network encryption [Added]
  • P2186: Insufficient encryption over an LTE network [Added]
• T4183: Consider using a private APN [Added]
  • P2187: Insufficient segregation of cell network traffic in LTE network [Added]
• T4184: Restrict the use of legacy protocols and monitor device connections [Added]
  • P2188: Fake base station attacks in LTE network [Added]
• T4185: Harden cell network hardware and monitor performance [Added]
  • P2189: Denial of service attacks against an LTE network [Added]
• T4186: Restrict physical access to devices, and prefer eSIMs [Added]
  • P2190: SIM cloning attacks in LTE network [Added]
• T4187: Use end-to-end encryption in addition to 5G network encryption [Added]
  • P2191: Insufficient encryption over a 5G network [Added]
• T4188: Consider using network slicing or a private APN [Added]
  • P2192: Insufficient segregation of cell network traffic in 5G network [Added]
• T4189: Restrict the use of legacy protocols and monitor device connections [Added]
  • P2193: Fake base station attacks in 5G network [Added]
• T4190: Harden cell network hardware and monitor performance [Added]
  • P2194: Denial of service attacks against a 5G network [Added]
• T4191: Restrict physical access to devices, and prefer eSIMs [Added]
  • P2195: SIM cloning attacks in 5G network [Added]
• T4192: Choose devices and infrastructure that supports LoRaWAN 1.1 [Added]
  • P2196: Old or insecure LoRa versions [Added]
• T4193: Choose EDs with security features and restrict physical access [Added]
  • P2197: Device tampering or key extraction [Added]
• T4194: Monitor traffic from ED devices [Added]
  • P2198: Denial of service attacks using signal jamming [Added]
• T4195: Use encrypted communication between network servers and application servers [Added]
  • P2199: Insecure data transmission to the application server [Added]
• T4196: Separate LoRa devices with network segmentation [Added]
  • P2200: Insufficient network isolation of LoRa devices [Added]
• T4197: Use Modbus/TCP Security for TLS encryption [Added]
  • P2201: Unencrypted data in transit in Modbus [Added]
• T4198: Separate ModBus devices with network segmentation [Added]
  • P2202: Insufficient network isolation of Modbus devices [Added]
• T4199: Use Modbus/TCP Security and monitor with an IDS/IPS [Added]
  • P2203: Modbus flooding and denial of service attacks [Added]
• T4200: Start a TLS security session before transmitting data over AMQP [Added]
  • P2204: Unencrypted data in transit in AMQP [Added]
• T4201: Choose a suitable authentication method in SASL [Added]
  • P2205: Anonymous access in AMQP [Added]
• T4202: Validate messages and install all message broker updates [Added]
  • P2206: Deserialization of malicious objects in AMQP [Added]
• T4203: Distribute certificates to CDN servers and configure TLS [Added]
  • P2207: Unencrypted data in transit in Content Delivery Network (CDN) [Added]
• T4204: Enforce access control for protected content [Added]
  • P2208: Missing access control for protected content in Content Delivery Network (CDN) [Added]
• T4205: Generate consistent cache keys and sanitize all inputs [Added]
  • P2209: CDN cache poisoning [Added]

• T4206: Deploy a WAF at the CDN edge [Added]

  • P2210: Denial of service and other common web attacks in Content Delivery Network (CDN) [Added]

• Changes to Project Properties and Profiles

  • Q207: Application Layer
    • Q186: Application Layer Protocols Used
      • A1573: File Transfer Protocol (FTP) [Added]
      • A1583: Modbus [Added]
      • A1584: Advanced Message Queuing Protocol (AMQP) [Added]
  • Q211: Development Tools
    • Q235: Uses Static or Dynamic Security Code Analysis
      • Q364: Version control platforms [Added]
        • A1390: GitHub [Added]
  • Q243: Internal Hidden Properties
    • Q189: Internal Properties (Use this, for all hidden answers)
      • A1484: AWS Business Applications (hidden) [Added]
      • A1485: AWS Cloud Financial Management (hidden) [Added]
      • A1486: AWS Compute Services (hidden) [Added]
      • A1487: AWS Containers (hidden) [Added]
      • A1488: AWS Database (hidden) [Added]
      • A1489: AWS Developer Tools (hidden) [Added]
      • A1490: AWS End User Computing (hidden) [Added]
      • A1491: AWS Front-end Web and Mobile Services (hidden) [Added]
      • A1492: AWS Internet of Things (IoT) (hidden) [Added]
      • A1493: AWS Management and Governance (hidden) [Added]
      • A1494: AWS Media Services (hidden) [Added]
      • A1495: AWS Migration and Transfer (hidden) [Added]
      • A1496: AWS Machine Learning (ML) and Artificial Intelligence (AI) (hidden) [Added]
      • A1497: AWS Networking and Content Delivery (hidden) [Added]
      • A1498: AWS Security, Identity, and Compliance (hidden) [Added]
      • A1499: AWS Storage (hidden) [Added]
      • A1500: AWS Analytics (hidden) [Added]
      • A1501: AWS Application Integration (hidden) [Added]
      • A1502: AWS All Services (hidden) [Added]
      • A1503: AWS Blockchain (hidden) [Added]
      • A1515: Azure AI + Machine Learning (hidden) [Added]
      • A1516: Azure Analytics (hidden) [Added]
      • A1517: Azure Compute (hidden) [Added]
      • A1518: Azure Containers (hidden) [Added]
      • A1519: Azure Databases (hidden) [Added]
      • A1520: Azure Developer tools (hidden) [Added]
      • A1521: Azure DevOps (hidden) [Added]
      • A1522: Azure Hybrid + multicloud (hidden) [Added]
      • A1523: Azure Identity (hidden) [Added]
      • A1524: Azure Integration (hidden) [Added]
      • A1525: Azure Internet of Things (hidden) [Added]
      • A1526: Azure Management and Governance (hidden) [Added]
      • A1527: Azure Media (hidden) [Added]
      • A1528: Azure Migration (hidden) [Added]
      • A1529: Azure Mixed Reality (hidden) [Added]
      • A1530: Azure Mobile (hidden) [Added]
      • A1531: Azure Networking (hidden) [Added]
      • A1532: Azure Security (hidden) [Added]
      • A1533: Azure Storage (hidden) [Added]
      • A1534: Azure Virtual Desktop Infrastructure (hidden) [Added]
      • A1535: Azure Web (hidden) [Added]
      • A1538: Azure All Services (hidden) [Added]
      • A1539: ANSI/ISA 62443-4-1 [Added]
      • A1540: Google Cloud AI and Machine Learning (hidden) [Added]
      • A1541: Google Cloud AI Infrastructure (hidden) [Added]
      • A1542: Google Cloud AI Solutions (hidden) [Added]
      • A1543: Google Cloud Business Intelligence (hidden) [Added]
      • A1544: Google Cloud Compute (hidden) [Added]
      • A1545: Google Cloud Containers (hidden) [Added]
      • A1546: Google Cloud Data Analytics (hidden) [Added]
      • A1547: Google Cloud Databases (hidden) [Added]
      • A1548: Google Cloud Developer Tools (hidden) [Added]
      • A1549: Google Cloud Distributed Cloud (hidden) [Added]
      • A1550: Google Cloud Hybrid and Multicloud (hidden) [Added]
      • A1551: Google Cloud Industry Specific (hidden) [Added]
      • A1552: Google Cloud Integration Services (hidden) [Added]
      • A1553: Google Cloud Management Tools (hidden) [Added]
      • A1554: Google Cloud Maps and Geospatial (hidden) [Added]
      • A1555: Google Cloud Media Services (hidden) [Added]
      • A1556: Google Cloud Migration (hidden) [Added]
      • A1557: Google Cloud Mixed Reality (hidden) [Added]
      • A1558: Google Cloud Networking (hidden) [Added]
      • A1559: Google Cloud Operations (hidden) [Added]
      • A1560: Google Cloud Productivity and Collaboration (hidden) [Added]
      • A1561: Google Cloud Security and Identity (hidden) [Added]
      • A1562: Google Cloud Serverless (hidden) [Added]
      • A1563: Google Cloud Storage (hidden) [Added]
      • A1564: Google Cloud Web3 (hidden) [Added]
      • A1565: Google Cloud All Services (hidden) [Added]
  • Q249: Industrial Control Systems
    • Q250: In-Scope for ANSI/ISA 62443 or CSA/SSA-311
      • A1374: ANSI/ISA 62443-4-1 or SDLA 312 [Added]
  • Q276: Network Layer
    • Q371: Virtual Private Network (VPN) [Added]
      • A1574: Virtual Private Network (VPN) [Added]
    • Q349: Broadband cellular networks
      • A1344: Long-Term Evolution (LTE) or Fifth-generation (5G) technologies [Removed]
      • A1579: 3G [Added]
      • A1580: 4G/LTE [Added]
      • A1581: 5G [Added]
    • Q339: Wireless Protocols Used
      • A1582: LoRa [Added]
  • Q284: Context and Characteristics
    • Q252: Application's Context and Characteristics
      • Q368: Type of AI system [Added]
        • A1506: High Risk [Added]
        • A1507: Limited/ low risk [Added]
        • A1508: General purpose AI models [Added]
        • A1509: General Purpose AI Models with Systemic Risk [Added]
      • Q357: Artificial Intelligence/Machine Learning
        • A1504: LLM-based Code Generation [Added]
        • A1505: EU AI Act [Added]
  • Q289: Cloud Computing
    • Q290: Cloud Providers
      • A1159: Amazon Web Services (AWS) Content (Not Story-driven) [Updated]
        • INFO: Updated the children.
      • A1190: Microsoft Azure [Updated]
        • INFO: Updated the children.
      • A1212: Google Cloud Content (Not Story-driven) [Updated]
        • INFO: Updated the children.
  • Q299: General
    • Q296: Assurance Level
      • A1161: Include more in-depth controls [Updated]
        • INFO: Updated the description.
  • Q304: Database Technologies
    • Q305: Database Management System (DBMS)
      • A1368: InfluxDB [Added]
      • A1369: Neo4j [Added]
      • A1370: MariaDB [Added]
      • A1371: CockroachDB [Added]
      • A1372: Apache Cassandra [Added]
      • A1373: MarkLogic [Added]
  • Q361: Amazon Web Services (AWS) [Added]
    • Q366: AWS Cloud Configuration [Added]
      • A1392: AWS Cloud Configuration [Added]
    • Q298: AWS Services [Updated]
      • INFO: Updated the parent.
      • A1165: RDS [Updated]
        • INFO: Updated the description.
      • A1166: EBS [Updated]
        • INFO: Updated the description.
      • A1167: AMI [Updated]
        • INFO: Updated the description.
      • A1168: ELB [Updated]
        • INFO: Updated the description.
      • A1170: IAM [Updated]
        • INFO: Updated the description.
      • A1171: EC2 [Updated]
        • INFO: Updated the description.
      • A1173: SNS [Updated]
        • INFO: Updated the description.
      • A1177: VPC [Updated]
        • INFO: Updated the description.
      • A1178: KMS [Updated]
        • INFO: Updated the description.
      • A1227: SQS [Updated]
        • INFO: Updated the description.
      • A1270: ECS [Updated]
        • INFO: Updated the description.
      • A1271: DynamoDB [Updated]
        • INFO: Updated the description.
      • A1331: EKS [Updated]
        • INFO: Updated the description.
      • A1347: Kinesis Data Streams [Updated]
        • INFO: Updated the description.
      • A1366: SageMaker [Updated]
        • INFO: Updated the description.
      • A1375: Certificate Manager [Added]
      • A1376: CloudFormation [Added]
      • A1377: ECR [Added]
      • A1378: EFS [Added]
      • A1379: ElastiCache [Added]
      • A1380: MSK [Added]
      • A1381: MQ [Added]
      • A1382: OpenSearch [Added]
      • A1383: RedShift [Added]
      • A1384: Secrets Manager [Added]
      • A1385: SES [Added]
      • A1386: Step Functions [Added]
      • A1387: Systems Manager [Added]
      • A1388: Transfer Family [Added]
      • A1510: AWS App Mesh [Added]
      • A1511: AWS Bedrock [Added]
      • A1512: AWS S3 Glacier [Added]
      • A1513: AWS Glue [Added]
      • A1514: AWS Lake Formation [Added]
  • Q362: Microsoft Azure [Added]
    • Q365: Azure Cloud Configuration [Added]
      • A1391: Azure Cloud Configuration [Added]
    • Q306: Azure Services [Updated]
      • INFO: Updated the parent.
      • Q370: More Azure Services [Added]
        • A1196: Multi-Factor Authentication [Updated]
          • INFO: Updated the question.
        • A1198: Virtual Machines [Updated]
          • INFO: Updated the question.
        • A1199: Security Center [Updated]
          • INFO: Updated the question.
        • A1200: Storage [Updated]
          • INFO: Updated the question.
        • A1201: SQL Database [Updated]
          • INFO: Updated the question.
        • A1202: Virtual Network [Updated]
          • INFO: Updated the question.
        • A1203: Monitor [Updated]
          • INFO: Updated the question.
        • A1204: Key Vault [Updated]
          • INFO: Updated the question.
        • A1205: Network Watcher [Updated]
          • INFO: Updated the question.
        • A1206: Resource Manager [Updated]
          • INFO: Updated the question.
        • A1396: Azure Machine Learning [Added]
        • A1397: Azure OpenAI Service [Added]
        • A1402: Azure Stream Analytics [Added]
        • A1403: Azure Synapse Analytics [Added]
        • A1406: Azure Linux Virtual Machines [Added]
        • A1407: Azure Spring Apps [Added]
        • A1408: Azure Virtual Desktop [Added]
        • A1409: Azure Virtual Machine Scale Sets [Added]
        • A1410: Azure VMware Solution [Added]
        • A1411: Azure Windows Virtual Machines [Added]
        • A1415: Azure Red Hat OpenShift [Added]
        • A1421: Azure Managed Instance for Apache Cassandra [Added]
        • A1422: Azure SQL [Added]
        • A1426: Azure Stack Edge [Added]
        • A1430: Azure Logic Apps [Added]
        • A1431: Azure Service Bus [Added]
        • A1432: Azure Web PubSub [Added]
        • A1435: Azure Notification Hubs [Added]
        • A1439: Azure Lighthouse [Added]
        • A1440: Azure Managed Applications [Added]
        • A1441: Azure Policy [Added]
        • A1442: Azure Purview [Added]
        • A1443: Azure Resource Manager templates [Added]
        • A1444: Azure Resource Mover [Added]
        • A1445: Azure Media Services [Added]
        • A1447: Azure Migrate [Added]
        • A1448: Azure Site Recovery [Added]
        • A1450: Azure Remote Rendering [Added]
        • A1451: Azure Spatial Anchors [Added]
        • A1461: Azure Load Balancer [Added]
        • A1462: Azure NAT Gateway [Added]
        • A1463: Azure Network Watcher [Added]
        • A1464: Azure Private Link [Added]
        • A1465: Azure Traffic Manager [Added]
        • A1466: Azure Virtual WAN [Added]
        • A1467: Azure VPN Gateway [Added]
        • A1468: Azure Web Application Firewall [Added]
        • A1469: Azure PostgreSQL Database [Added]
        • A1475: Azure Sentinel [Added]
        • A1480: Azure Managed Lustre [Added]
        • A1481: Azure NetApp Files [Added]
        • A1483: Azure SignalR Service [Added]
      • A1394: Azure AI Bot Service [Added]
      • A1395: Azure Databricks [Added]
      • A1398: Azure Analysis Services [Added]
      • A1399: Azure Data Explorer [Added]
      • A1400: Azure Data Lake Analytics [Added]
      • A1401: Azure Event Hubs [Added]
      • A1404: Azure App Service [Added]
      • A1405: Azure Batch [Added]
      • A1412: Azure Container Apps [Added]
      • A1413: Azure Container Instances [Added]
      • A1414: Azure Container Registry [Added]
      • A1416: Azure Cache for Redis [Added]
      • A1417: Azure Cosmos DB [Added]
      • A1418: Azure Data Factory [Added]
      • A1419: Azure Database for MariaDB [Added]
      • A1420: Azure Database for MySQL [Added]
      • A1423: Azure App Configuration [Added]
      • A1424: Azure DevTest Labs [Added]
      • A1425: Azure Arc [Added]
      • A1427: Azure Active Directory External Identities [Added]
      • A1428: Azure API Management [Added]
      • A1429: Azure Event Grid [Added]
      • A1433: Azure IoT Central [Added]
      • A1434: Azure IoT Hub [Added]
      • A1436: Azure Automation [Added]
      • A1437: Azure Cloud Shell [Added]
      • A1438: Azure Cost Management [Added]
      • A1446: Azure Database Migration Service [Added]
      • A1449: Azure Digital Twins [Added]
      • A1452: Azure Application Gateway [Added]
      • A1453: Azure Bastion [Added]
      • A1454: Azure Communications Gateway [Added]
      • A1455: Azure Content Delivery Network [Added]
      • A1456: Azure DDoS Protection [Added]
      • A1457: Azure DNS [Added]
      • A1458: Azure Firewall [Added]
      • A1459: Azure Firewall Manager [Added]
      • A1460: Azure Front Door [Added]
      • A1470: Azure Attestation [Added]
      • A1471: Azure Dedicated HSM [Added]
      • A1472: Azure Defender for Cloud [Added]
      • A1473: Azure Information Protection [Added]
      • A1474: Azure Key Vault Managed HSM [Added]
      • A1476: Azure Backup [Added]
      • A1477: Azure Data Box [Added]
      • A1478: Azure Data Share [Added]
      • A1479: Azure HPC Cache [Added]
      • A1482: Azure Communication Services [Added]
      • A1536: Azure Blob Storage [Added]
      • A1537: Azure Data Lake Storage [Added]
  • Q363: Google Cloud Platform (GCP) [Added]
    • Q367: GCP Cloud Configuration [Added]
      • A1393: GCP Cloud Configuration [Added]
    • Q309: Google Cloud Services [Updated]
      • INFO: Updated the parent.
  • Q369: Network Technologies [Added]
    • Q372: Network Components [Added]
      • A1566: Directory Server [Added]
      • A1567: DNS Server [Added]
      • A1568: Firewall [Added]
      • A1569: FTP Server [Added]
      • A1570: IDS/IPS [Added]
      • A1571: Load Balancer [Added]
      • A1572: Message Broker [Added]
      • A1575: Proxy Server [Added]
      • A1576: Router [Added]
      • A1577: Service Bus [Added]
      • A1578: Virtual Private Network (VPN) Server [Added]
      • A1585: Content Delivery Network (CDN) [Added]

• Added Components

  • SC3: NoSQL Database
  • SC5: MongoDB
  • SC11: SQLite
  • SC102: Azure PostgreSQL Database
  • SC104: Apache Cassandra
  • SC105: InfluxDB
  • SC106: Neo4j
  • SC107: MarkLogic
  • SC109: CockroachDB
  • SC110: MariaDB
  • SC111: Cloud Environment
  • SC112: AWS Environment
  • SC113: Azure Environment
  • SC114: GCP Environment
  • SC115: AWS Athena
  • SC116: AWS Clean Rooms
  • SC117: AWS CloudSearch
  • SC118: AWS Data Exchange
  • SC119: AWS Data Pipeline
  • SC120: AWS DataZone
  • SC121: AWS EMR
  • SC122: AWS Entity Resolution
  • SC123: AWS FinSpace
  • SC124: AWS Glue
  • SC125: AWS Kinesis
  • SC126: AWS Kinesis Video Streams
  • SC127: AWS Lake Formation
  • SC128: AWS Managed Service for Apache Flink
  • SC129: AWS Managed Streaming for Apache Kafka (MSK)
  • SC130: AWS OpenSearch Serverless
  • SC131: AWS OpenSearch Service
  • SC132: AWS QuickSight
  • SC133: AWS Redshift
  • SC134: AWS Redshift Serverless
  • SC135: AWS AppFlow
  • SC136: AWS B2B Data Interchange
  • SC137: AWS EventBridge
  • SC138: AWS Managed Workflows for Apache Airflow (MWAA)
  • SC139: AWS MQ
  • SC140: AWS Simple Workflow Service
  • SC141: AWS Step Functions
  • SC142: AWS Managed Blockchain
  • SC143: AWS Alexa for Business
  • SC144: AWS AppFabric
  • SC145: AWS Chime
  • SC146: AWS Chime SDK
  • SC147: AWS Connect
  • SC148: AWS Honeycode
  • SC149: AWS Pinpoint
  • SC150: AWS Simple Email Service (SES)
  • SC151: AWS WorkDocs
  • SC152: AWS WorkMail
  • SC153: AWS Application Cost Profiler
  • SC154: AWS Billing Conductor
  • SC155: AWS Budgets
  • SC156: AWS Cost and Usage Report
  • SC157: AWS Cost Explorer
  • SC158: AWS Reserved Instance (RI) reporting
  • SC159: AWS Savings Plans
  • SC160: AWS App Runner
  • SC161: AWS Batch
  • SC162: AWS Compare AWS compute services
  • SC163: AWS EC2 Image Builder
  • SC164: AWS Elastic Beanstalk
  • SC165: AWS Fargate
  • SC166: AWS Lightsail
  • SC167: AWS Linux 2023
  • SC168: AWS Outposts
  • SC169: AWS Serverless Application Repository
  • SC170: AWS VMware Cloud on AWS
  • SC171: AWS Wavelength
  • SC172: AWS App2Container
  • SC173: AWS Elastic Container Registry
  • SC174: AWS Red Hat OpenShift Service on AWS
  • SC175: AWS Managed Services
  • SC176: AWS rePost Private
  • SC177: AWS DocumentDB (with MongoDB compatibility)
  • SC178: AWS ElastiCache
  • SC179: AWS Keyspaces (for Apache Cassandra)
  • SC180: AWS Lightsail managed databases
  • SC181: AWS MemoryDB for Redis
  • SC182: AWS Neptune
  • SC183: AWS Quantum Ledger Database (Amazon QLDB)
  • SC184: AWS RDS for Db2
  • SC185: AWS RDS on VMware
  • SC186: AWS Timestream
  • SC187: AWS Application Composer
  • SC188: AWS Cloud9
  • SC189: AWS CloudShell
  • SC190: AWS CodeArtifact
  • SC191: AWS CodeBuild
  • SC192: AWS CodeCatalyst
  • SC193: AWS CodeCommit
  • SC194: AWS CodeDeploy
  • SC195: AWS CodePipeline
  • SC196: AWS CodeStar
  • SC197: AWS Corretto
  • SC198: AWS Fault Injection Service
  • SC199: AWS X-Ray
  • SC200: AWS AppStream 2.0
  • SC201: AWS WorkSpaces
  • SC202: AWS WorkSpaces Core
  • SC203: AWS WorkSpaces Thin Client
  • SC204: AWS Workspaces Web
  • SC205: AWS Amplify
  • SC206: AWS AppSync
  • SC207: AWS Device Farm
  • SC208: AWS Location Service
  • SC209: AWS GameLift
  • SC210: AWS FreeRTOS
  • SC211: AWS IoT 1-Click
  • SC212: AWS IoT Analytics
  • SC213: AWS IoT Button
  • SC214: AWS IoT Core
  • SC215: AWS IoT Device Defender
  • SC216: AWS IoT Device Management
  • SC217: AWS IoT Events
  • SC218: AWS IoT ExpressLink
  • SC219: AWS IoT FleetWise
  • SC220: AWS IoT Greengrass
  • SC221: AWS IoT SiteWise
  • SC222: AWS IoT TwinMaker
  • SC223: AWS Partner Device Catalog
  • SC224: AWS Augmented AI
  • SC225: AWS Bedrock
  • SC226: AWS CodeGuru
  • SC227: AWS CodeWhisperer
  • SC228: AWS Comprehend
  • SC229: AWS Comprehend Medical
  • SC230: AWS DeepComposer
  • SC231: AWS DeepLens
  • SC232: AWS DeepRacer
  • SC233: AWS DevOps Guru
  • SC234: AWS Forecast
  • SC235: AWS Fraud Detector
  • SC236: AWS HealthLake
  • SC237: AWS HealthScribe
  • SC238: AWS Kendra
  • SC239: AWS Lex
  • SC240: AWS Lookout for Equipment
  • SC241: AWS Lookout for Metrics
  • SC242: AWS Lookout for Vision
  • SC243: AWS Monitron
  • SC244: AWS Panorama
  • SC245: AWS PartyRock
  • SC246: AWS Personalize
  • SC247: AWS Polly
  • SC248: AWS Rekognition
  • SC249: AWS Textract
  • SC250: AWS Transcribe
  • SC251: AWS Translate
  • SC252: AWS Auto Scaling
  • SC253: AWS Chatbot
  • SC254: AWS CloudFormation
  • SC255: AWS Compute Optimizer
  • SC256: AWS Console Mobile Application
  • SC257: AWS Control Tower
  • SC258: AWS Health Dashboard
  • SC259: AWS Launch Wizard
  • SC260: AWS License Manager
  • SC261: AWS Managed Grafana
  • SC262: AWS Managed Service for Prometheus
  • SC263: AWS OpsWorks
  • SC264: AWS Organizations
  • SC265: AWS Proton
  • SC266: AWS Service Catalog
  • SC267: AWS Systems Manager
  • SC268: AWS Trusted Advisor
  • SC269: AWS Well-Architected Tool
  • SC270: AWS Elastic Transcoder
  • SC271: AWS Elemental Appliances and Software
  • SC272: AWS Elemental MediaConnect
  • SC273: AWS Elemental MediaConvert
  • SC274: AWS Elemental MediaLive
  • SC275: AWS Elemental MediaPackage
  • SC276: AWS Elemental MediaStore
  • SC277: AWS Elemental MediaTailor
  • SC278: AWS Interactive Video Service
  • SC279: AWS Nimble Studio
  • SC280: AWS Application Discovery Service
  • SC281: AWS Application Migration Service
  • SC282: AWS Database Migration Service
  • SC283: AWS DataSync
  • SC284: AWS Mainframe Modernization Service
  • SC285: AWS Migration Hub
  • SC286: AWS Snow Family
  • SC287: AWS Transfer Family
  • SC288: AWS App Mesh
  • SC289: AWS Cloud Map
  • SC290: AWS Direct Connect
  • SC291: AWS Global Accelerator
  • SC292: AWS Integrated Private Wireless on AWS
  • SC293: AWS Private 5G
  • SC294: AWS PrivateLink
  • SC295: AWS Transit Gateway
  • SC296: AWS Verified Access
  • SC297: AWS VPC Lattice
  • SC298: AWS VPN
  • SC299: AWS Braket
  • SC300: AWS RoboMaker
  • SC301: AWS Ground Station
  • SC302: AWS Artifact
  • SC303: AWS Audit Manager
  • SC304: AWS Certificate Manager
  • SC305: AWS CloudHSM
  • SC306: AWS Detective
  • SC307: AWS Directory Service
  • SC308: AWS Firewall Manager
  • SC309: AWS GuardDuty
  • SC310: AWS IAM Identity Center
  • SC311: AWS Inspector
  • SC312: AWS Macie
  • SC313: AWS Network Firewall
  • SC314: AWS Resource Access Manager
  • SC315: AWS Secrets Manager
  • SC316: AWS Security Hub
  • SC317: AWS Security Lake
  • SC318: AWS Shield
  • SC319: AWS Verified Permissions
  • SC320: AWS WAF Captcha
  • SC321: AWS S3 Glacier
  • SC322: AWS Backup
  • SC323: AWS Elastic Disaster Recovery
  • SC324: AWS Elastic File System
  • SC325: AWS File Cache
  • SC326: AWS FSx for Lustre
  • SC327: AWS FSx for NetApp ONTAP
  • SC328: AWS FSx for OpenZFS
  • SC329: AWS FSx for Windows File Server
  • SC330: AWS Storage GatewayAWS
  • SC331: Azure AI Anomaly Detector
  • SC332: Azure AI Bot Service
  • SC333: Azure AI Content Safety
  • SC334: Azure AI Custom Vision
  • SC335: Azure AI Document Intelligence
  • SC336: Azure AI Immersive Reader
  • SC337: Azure AI Language
  • SC338: Azure AI Metrics Advisor
  • SC339: Azure AI Personalizer
  • SC340: Azure AI Search
  • SC341: Azure AI Services
  • SC342: Azure AI Studio
  • SC343: Azure AI Translator
  • SC344: Azure AI Video Indexer
  • SC345: Azure Data Science Virtual Machines
  • SC346: Azure Databricks
  • SC347: Azure Genomics
  • SC348: Azure Health Bot
  • SC349: Azure Language Understanding (LUIS)
  • SC350: Azure Machine Learning
  • SC351: Azure Open Datasets
  • SC352: Azure OpenAI Service
  • SC353: Azure Operator Call Protection
  • SC354: Azure QnA Maker
  • SC355: Azure Speaker recognition
  • SC356: Azure Speech to text
  • SC357: Azure Speech translation
  • SC358: Azure Text to speech
  • SC359: Azure Analysis Services
  • SC360: Azure Chaos Studio
  • SC361: Azure Data Catalog
  • SC362: Azure Data Explorer
  • SC363: Azure Data Lake Analytics
  • SC364: Azure Event Hubs
  • SC365: Azure Fabric
  • SC366: Azure Graph Data Connect
  • SC367: Azure HDInsight
  • SC368: Azure HDInsight on Azure Kubernetes Service (AKS)
  • SC369: Azure Operator Insights
  • SC370: Azure Power BI Embedded
  • SC371: Azure Stream Analytics
  • SC372: Azure Synapse Analytics
  • SC373: Azure Batch
  • SC374: Azure Cloud Services
  • SC375: Azure CycleCloud
  • SC376: Azure Dedicated Host
  • SC377: Azure Linux Virtual Machines
  • SC378: Azure Quantum
  • SC379: Azure Service Fabric
  • SC380: Azure Spot Virtual Machines
  • SC381: Azure Spring Apps
  • SC382: Azure Virtual Desktop
  • SC383: Azure Virtual Machine Scale Sets
  • SC384: Azure VM Image Builder
  • SC385: Azure VMware Solution
  • SC386: Azure Windows Virtual Machines
  • SC387: Azure Container Apps
  • SC388: Azure Container Instances
  • SC389: Azure Container Registry
  • SC390: Azure Container Storage
  • SC391: Azure Kubernetes Fleet Manager
  • SC392: Azure Red Hat OpenShift
  • SC393: Azure Web App for Containers
  • SC394: Azure Cache for Redis
  • SC395: Azure Cosmos DB
  • SC396: Azure Data Factory
  • SC397: Azure Database for MariaDB
  • SC398: Azure Database for MySQL
  • SC399: Azure Managed Instance for Apache Cassandra
  • SC400: Azure SQL
  • SC401: Azure SQL Edge
  • SC402: Azure SQL Managed Instance
  • SC403: Azure SQL Server on Azure Virtual Machines
  • SC404: Azure Table Storage
  • SC405: Azure App Configuration
  • SC406: Azure Dev Box
  • SC407: Azure DevOps
  • SC408: Azure Managed Confidential Consortium Framework (CCF)
  • SC409: Azure Playwright Testing
  • SC410: Azure SDKs
  • SC411: Azure Visual Studio
  • SC412: Azure Visual Studio Code
  • SC413: Azure Artifacts
  • SC414: Azure Boards
  • SC415: Azure Deployment Environments
  • SC416: Azure DevOps tool integrations
  • SC417: Azure DevTest Labs
  • SC418: Azure GitHub Advanced Security for Azure DevOps
  • SC419: Azure Load Testing
  • SC420: Azure Managed Grafana
  • SC421: Azure Pipelines
  • SC422: Azure Repos
  • SC423: Azure Test Plans
  • SC424: Azure Arc
  • SC425: Azure Kubernetes Service Edge Essentials
  • SC426: Azure Modular Datacenter
  • SC427: Azure Operator Nexus
  • SC428: Azure Operator Service Manager
  • SC429: Azure Stack
  • SC430: Azure Stack Edge
  • SC431: Azure Stack HCI
  • SC432: Azure Stack Hub
  • SC433: Azure Active Directory External Identities
  • SC434: Azure API Management
  • SC435: Azure Data Manager for Agriculture
  • SC436: Azure Energy Data Services
  • SC437: Azure Event Grid
  • SC438: Azure Health Data Services
  • SC439: Azure Logic Apps
  • SC440: Azure Service Bus
  • SC441: Azure Web PubSub
  • SC442: Azure Defender for IoT
  • SC443: Azure IoT Central
  • SC444: Azure IoT Edge
  • SC445: Azure IoT Hub
  • SC446: Azure IoT Operations
  • SC447: Azure Notification Hubs
  • SC448: Azure RTOS
  • SC449: Azure Sphere
  • SC450: Azure Time Series Insights
  • SC451: Azure Windows 10 IoT Core Services
  • SC452: Azure Windows for IoT
  • SC453: Azure Advisor
  • SC454: Azure Automanage
  • SC455: Azure Automation
  • SC456: Azure Blueprints
  • SC457: Azure Cloud Shell
  • SC458: Azure Copilot for Azure
  • SC459: Azure Cost Management
  • SC460: Azure Lighthouse
  • SC461: Azure Managed Applications
  • SC462: Azure mobile app
  • SC463: Azure Policy
  • SC464: Azure portal
  • SC465: Azure Purview
  • SC466: Azure Resource Manager templates
  • SC467: Azure Resource Mover
  • SC468: Azure Service Health
  • SC469: Azure Update management center
  • SC470: Azure Content Protection
  • SC471: Azure Encoding
  • SC472: Azure Live and On-Demand Streaming
  • SC473: Azure Media Player
  • SC474: Azure Media Services
  • SC475: Azure Database Migration Service
  • SC476: Azure Migrate
  • SC477: Azure Site Recovery
  • SC478: Azure Digital Twins
  • SC479: Azure Kinect DK
  • SC480: Azure Object Anchors
  • SC481: Azure Remote Rendering
  • SC482: Azure Spatial Anchors
  • SC483: Azure App Center
  • SC484: Azure Application Gateway
  • SC485: Azure Bastion
  • SC486: Azure Communications Gateway
  • SC487: Azure Content Delivery Network
  • SC488: Azure DDoS Protection
  • SC489: Azure DNS
  • SC490: Azure ExpressRoute
  • SC491: Azure Firewall
  • SC492: Azure Firewall Manager
  • SC493: Azure Front Door
  • SC494: Azure Internet Analyzer
  • SC495: Azure Load Balancer
  • SC496: Azure NAT Gateway
  • SC497: Azure Network Function Manager
  • SC498: Azure Network Watcher
  • SC499: Azure Operator 5G Core
  • SC500: Azure Orbital Ground Station
  • SC501: Azure Private 5G Core
  • SC502: Azure Private Link
  • SC503: Azure Programmable Connectivity
  • SC504: Azure Route Server
  • SC505: Azure Traffic Manager
  • SC506: Azure Virtual Network Manager
  • SC507: Azure Virtual WAN
  • SC508: Azure VPN Gateway
  • SC509: Azure Web Application Firewall
  • SC510: Azure Attestation
  • SC511: Azure Dedicated HSM
  • SC512: Azure Defender External Attack Surface Management
  • SC513: Azure Defender for Cloud
  • SC514: Azure Entra Domain Services
  • SC515: Azure Information Protection
  • SC516: Azure Key Vault Managed HSM
  • SC517: Azure Sentinel
  • SC518: Azure Trusted Hardware Identity Management
  • SC519: Azure Archive Storage
  • SC520: Azure Avere vFXT for Azure
  • SC521: Azure Backup
  • SC522: Azure Blob Storage
  • SC523: Azure confidential ledger
  • SC524: Azure Data Box
  • SC525: Azure Data Lake Storage
  • SC526: Azure Data Lake Storage Gen1
  • SC527: Azure Data Share
  • SC528: Azure Disk Storage
  • SC529: Azure Elastic SAN
  • SC530: Azure Files
  • SC531: Azure HPC Cache
  • SC532: Azure Managed Lustre
  • SC533: Azure NetApp Files
  • SC534: Azure Queue Storage
  • SC535: Azure Storage Accounts
  • SC536: Azure Storage Actions
  • SC537: Azure Storage Explorer
  • SC538: Azure Lab Services
  • SC539: Azure Communication Services
  • SC540: Azure Fluid Relay
  • SC541: Azure Maps
  • SC542: Azure SignalR Service
  • SC543: Azure Static Web AppsAzure
  • SC544: GCP AutoML
  • SC545: GCP Dialogflow
  • SC546: GCP Generative AI on Vertex AI
  • SC547: GCP Media Translation
  • SC548: GCP Natural Language AI
  • SC549: GCP Recommendations AI
  • SC550: GCP Speech-to-Text
  • SC551: GCP Text-to-Speech
  • SC552: GCP Translation AI
  • SC553: GCP Vertex AI Notebooks
  • SC554: GCP Vertex AI Platform
  • SC555: GCP Vertex AI Search and Conversation
  • SC556: GCP Vertex Explainable AI
  • SC557: GCP Video AI
  • SC558: GCP Vision AI
  • SC559: GCP Cloud GPUs
  • SC560: GCP Cloud TPUs
  • SC561: GCP Deep Learning Containers
  • SC562: GCP Deep Learning VM Image
  • SC563: GCP TensorFlow Enterprise
  • SC564: GCP Contact Center AI
  • SC565: GCP Document AI
  • SC566: GCP Intelligent products (Preview)
  • SC567: GCP Product Discovery
  • SC568: GCP Looker Studio
  • SC569: GCP App Engine
  • SC570: GCP Bare Metal Solution
  • SC571: GCP Batch
  • SC572: GCP Recommender
  • SC573: GCP Sole-tenant Nodes
  • SC574: GCP Spot VMs
  • SC575: GCP SQL Server on Google Cloud
  • SC576: GCP Tau VM
  • SC577: GCP VMware Engine
  • SC578: GCP Cloud Run
  • SC579: GCP Knative
  • SC580: GCP Kubernetes applications on Google Cloud Marketplace
  • SC581: GCP Analytics Hub
  • SC582: GCP BigLake
  • SC583: GCP Data Catalog
  • SC584: GCP Dataflow
  • SC585: GCP Dataform
  • SC586: GCP Dataplex
  • SC587: GCP Dataprep
  • SC588: GCP Looker
  • SC589: GCP Marketing Platform
  • SC590: GCP AlloyDB for PostgreSQL
  • SC591: GCP Cloud Bigtable
  • SC592: GCP Cloud Spanner
  • SC593: GCP Datastream
  • SC594: GCP Firebase Realtime Database
  • SC595: GCP Firestore
  • SC596: GCP Memorystore
  • SC597: GCP Artifact Registry
  • SC598: GCP Assured Open Source Software
  • SC599: GCP Cloud Build
  • SC600: GCP Cloud Code
  • SC601: GCP Cloud Deploy
  • SC602: GCP Cloud Deployment Manager
  • SC603: GCP Cloud Functions for Firebase
  • SC604: GCP Cloud SDK
  • SC605: GCP Cloud Source Repositories
  • SC606: GCP Cloud Tasks
  • SC607: GCP Cloud Workstations
  • SC608: GCP Duet AI in Google Cloud (Preview)
  • SC609: GCP Firebase Authentication
  • SC610: GCP Firebase Crashlytics
  • SC611: GCP Firebase Test Lab
  • SC612: GCP Gradle App Engine Plugin
  • SC613: GCP Infrastructure Manager
  • SC614: GCP Maven App Engine Plugin
  • SC615: GCP Skaffold
  • SC616: GCP Tekton
  • SC617: GCP Tools for Eclipse
  • SC618: GCP Tools for PowerShell
  • SC619: GCP Distributed Cloud Edge
  • SC620: GCP Distributed Cloud Hosted
  • SC621: GCP Anthos
  • SC622: GCP Distributed Cloud Service
  • SC623: GCP Anti Money Laundering AI
  • SC624: GCP Cloud Healthcare API
  • SC625: GCP Device Connect for Fitbit
  • SC626: GCP Payment Gateway
  • SC627: GCP Spectrum Access System (SAS)
  • SC628: GCP Telecom Data Fabric
  • SC629: GCP Telecom Network Automation
  • SC630: GCP Telecom Subscriber Insights
  • SC631: GCP Apigee API Management
  • SC632: GCP Application Integration
  • SC633: GCP Cloud Composer
  • SC634: GCP Cloud Data Fusion
  • SC635: GCP Cloud Scheduler
  • SC636: GCP Dataproc
  • SC637: GCP Eventarc
  • SC638: GCP Pub/Sub
  • SC639: GCP Workflows
  • SC640: GCP Active Assist
  • SC641: GCP Carbon Footprint
  • SC642: GCP Cloud APIs
  • SC643: GCP Cloud Console
  • SC644: GCP Cloud Endpoints
  • SC645: GCP Cloud Mobile App
  • SC646: GCP Cloud Shell
  • SC647: GCP Config Connector
  • SC648: GCP Config Management
  • SC649: GCP Cost Management
  • SC650: GCP Deployment Manager
  • SC651: GCP Identity and Access Management (IAM)
  • SC652: GCP Managed Service for Prometheus
  • SC653: GCP Personalized Service Health
  • SC654: GCP Service Catalog
  • SC655: GCP Service Mesh
  • SC656: GCP Terraform on Google Cloud
  • SC657: GCP Earth Engine
  • SC658: GCP Maps Platform
  • SC659: GCP Live Stream API
  • SC660: GCP OpenCue
  • SC661: GCP Transcoder API
  • SC662: GCP Video Stitcher API
  • SC663: GCP Application migration
  • SC664: GCP BigQuery Data Transfer Service
  • SC665: GCP Cloud Foundation Toolkit
  • SC666: GCP Database Migration Service
  • SC667: GCP Migrate to Containers
  • SC668: GCP Migrate to Virtual Machines
  • SC669: GCP Migration Center
  • SC670: GCP Rapid Assessment & Migration Program (RAMP)
  • SC671: GCP Storage Transfer Service
  • SC672: GCP Transfer Appliance
  • SC673: GCP Immersive Stream for XR
  • SC674: GCP Cloud Armor
  • SC675: GCP Cloud CDN
  • SC676: GCP Cloud Connectivity
  • SC677: GCP Cloud Domains
  • SC678: GCP Cloud Firewall
  • SC679: GCP Cloud IDS
  • SC680: GCP Cloud Load Balancing
  • SC681: GCP Cloud NAT
  • SC682: GCP Network Connectivity Center
  • SC683: GCP Network Intelligence Center
  • SC684: GCP Network Service Tiers
  • SC685: GCP Private Service Connect
  • SC686: GCP Service Directory
  • SC687: GCP VPC Service Controls
  • SC688: GCP Cloud Debugger
  • SC689: GCP Cloud Monitoring
  • SC690: GCP Cloud Profiler
  • SC691: GCP Cloud Trace
  • SC692: GCP Error Reporting
  • SC693: GCP AppSheet
  • SC694: GCP AppSheet Automation
  • SC695: GCP Chrome Enterprise
  • SC696: GCP Duet AI for Google Workspace
  • SC697: GCP Workspace
  • SC698: GCP Workspace Essentials
  • SC699: GCP Access Transparency
  • SC700: GCP Assured Workloads
  • SC701: GCP BeyondCorp Enterprise
  • SC702: GCP Certificate Authority Service
  • SC703: GCP Chronicle SIEM
  • SC704: GCP Chronicle SOAR
  • SC705: GCP Cloud Asset Inventory
  • SC706: GCP Cloud Identity
  • SC707: GCP Confidential Computing
  • SC708: GCP Identity Platform
  • SC709: GCP Identity-Aware Proxy
  • SC710: GCP Managed Service for Microsoft Active Directory
  • SC711: GCP Mandiant Academy
  • SC712: GCP Mandiant Attack Surface Management
  • SC713: GCP Mandiant Consulting Services
  • SC714: GCP Mandiant Digital Threat Monitoring
  • SC715: GCP Mandiant Incident Response Services
  • SC716: GCP Mandiant Managed Detection and Response
  • SC717: GCP Mandiant Security Validation
  • SC718: GCP Mandiant Threat Intelligence
  • SC719: GCP Policy Intelligence
  • SC720: GCP reCAPTCHA Enterprise
  • SC721: GCP Secret Manager
  • SC722: GCP Security Command Center
  • SC723: GCP Sensitive Data Protection
  • SC724: GCP Shielded VMs
  • SC725: GCP Software Delivery Shield
  • SC726: GCP Titan Security Key
  • SC727: GCP Virus Total
  • SC728: GCP Web Risk
  • SC729: GCP API Gateway
  • SC730: GCP Cloud Functions
  • SC731: GCP Block storage
  • SC732: GCP Cloud Backup and DR
  • SC733: GCP Cloud Storage for Firebase
  • SC734: GCP Filestore
  • SC735: GCP Local SSD
  • SC736: GCP NetApp Volumes
  • SC737: GCP Parallelstore
  • SC738: GCP Persistent Disk
  • SC739: GCP Blockchain Node Engine
  • SC740: GitHub
  • SC741: Azure Service
  • SC742: Google Cloud Platform
  • SC743: Content Delivery Network
  • SC744: Directory Server
  • SC745: DNS Server
  • SC746: Firewall
  • SC747: FTP Server
  • SC748: IDS/IPS
  • SC749: Load Balancer
  • SC750: Message Broker
  • SC751: Proxy Server
  • SC752: Router
  • SC753: Service Bus
  • SC754: VPN Server

• Updated Components

  • SC13: PostgreSQL
    • INFO: Updated the title and implied attributes.
  • SC76: Azure App Service
    • INFO: Updated the answer mapping and implied attributes.

2024.1

April 13, 2024

New features and enhancements

• Library Profile Page

  • Added the following Library Profile Page UI enhancements:
    • Ability to view built-in Profiles
    • Ability to deactivate custom profiles
    • Ability to select a profile as a default for the project survey
    • Ability to save copy a profile
      • Added the API capability to GET/POST/PATCH and Delete for profiles

• Advanced Reports

  • Users can now choose Library Countermeasure Tags or App Space Project Tag name as dimension or filters in Library based context.

Content improvements summary

• OWASP API Top 10 2023

  • Added a new compliance regulations for OWASP API Top 10 2023
  • Added new Additional Requirements for OWASP API Top 10 2023
  • Added text improvements for OWASP API Top 10 2023

• SageMaker content

  • Added 11 Countermeasures and their corresponding test tasks
  • Added 9 new Weaknesses

• Machine learning security content

  • Added 7 Countermeasures and their corresponding test tasks
  • Added 4 new Weaknesses
  • Added 3 new Threats

• SDE update based on Defending Database course

  • Added 9 Countermeasures and their corresponding test tasks
  • Added 8 new Weaknesses

• SDE update based on Node.js course

  • Added 4 new Additional Requirements
  • Added 3 new How-to's

Content additions and updates (as of March 26, 2024):

• Compliance Regulations and Mappings

  • Added OWASP API Top 10
  • Added ENISA - Securing Machine Learning Algorithms

• Content Packs

  • Added Machine Learning
  • Added Enisa Securing Machine Learning Algorithms

• T21: Ensure all data in transit is encrypted using a secure TLS channel

  • I1888: Use TLS in Node.js [Added]
• T22: Set secure flags on session cookies
  • I1889: Node.js [Added]
• T36: Escape untrusted data in HTML, HTML attributes, CSS, and JavaScript
  • I1890: Node.js: Escape and sanitize [Added]
• T50: Use indirect object reference maps if accessing files [Updated]
  • INFO: Updated the text.
• T159: Follow best practices for secure error and exception handling
  • TA6548: Prevent information exposure using error messages in Web APIs [Added]
• T285: Restrict use of access tokens (API tokens)
  • TA6546: Use API Keys Safely in Your Web APIs [Added]
• T330: Monitor and manage Node.js workload
  • TA6553: Prevent Denial of Service attacks [Added]
• T331: Enforce policies through content security policy (CSP) or XSS protection headers
  • TA6552: Protection directives for Node.js [Added]
• T335: Sanitize user input before passing to NoSQL operators
  • P747: Improper Neutralization of Special Elements used in a NoSQL Command (NoSQL Injection) [Updated]
    • INFO: Updated the text.
• T378: Authorize every request for data objects [Updated]
  • INFO: Updated the text.
• T1362: Perform message throttling in Web APIs [Updated]
  • INFO: Updated the text.
  • TA6543: Secure API Resource Consumption Guidelines [Added]
• T1365: Mitigate Server Side Request Forgery [Updated]
  • INFO: Updated the text.
• T1368: Perform security testing using SAST tools
  • TA6550: Use ESLint to identify problematic patterns [Added]
• T1383: Separate development, test, and operational environments
  • TA6549: Implement a formal version management strategy for web APIs [Added]
• T1919: Use JSON Web Token (JWT) securely
  • TA6547: Use Token-Based Authentication (With JWTs) Safely in Your Web APIs [Added]
• T2139: Prevent information exposure through APIs [Updated]
  • INFO: Updated the text.
• T2211: Include a firmware update mechanism/feature (Hardware/Firmware)
  • TA3497: Patch and upgrade software and firmware regularly (Bluetooth) [Updated]
    • INFO: Updated the match conditions.
• T2348: Perform code reviews
  • TA6551: Ensure using promises for code clarity [Added]
• T2498: Provide clear definitions for each component
  • TA6544: Secure API Documentation Guidelines [Added]
• T2560: Launch notebook instances in custom VPC and disable internet access (SageMaker) [Added]
  • P898: Using the default VPC (AWS) [Updated]
    • INFO: Updated the match conditions.
• T2561: Protect ML model against input manipulation attacks [Added]
  • P1749: Lack of data integrity and robustness against poisoning in ML data [Added]
• T2562: Test ML model protection against input manipulation attacks [Added]
  • P1749: Lack of data integrity and robustness against poisoning in ML data [Added]
• T2563: Protect ML model against data poisoning and skewing attacks [Added]
  • P1749: Lack of data integrity and robustness against poisoning in ML data [Added]
• T2564: Test ML model protection against data poisoning and skewing attacks [Added]
  • P1749: Lack of data integrity and robustness against poisoning in ML data [Added]
• T2565: Protect ML model against inversion attacks [Added]
  • P1750: Lack of model confidentiality and privacy protection in ML [Added]
• T2566: Verify notebook instances are launched in custom VPC and internet access is disabled (SageMaker) [Added]
  • P898: Using the default VPC (AWS) [Updated]
    • INFO: Updated the match conditions.
• T2567: Test ML model protection against inversion attacks [Added]
  • P1750: Lack of model confidentiality and privacy protection in ML [Added]
• T2568: Disable user root access to notebook instances (SageMaker) [Added]
  • P1748: Enabled user root access (SageMaker) [Added]
• T2569: Verify user root access to notebook instances is disabled (SageMaker) [Added]
  • P1748: Enabled user root access (SageMaker) [Added]
• T2570: Isolate resources using domains (SageMaker) [Added]
  • P1751: Lack of proper isolation of resources (SageMaker) [Added]
• T2571: Verify that resources are associated with domains (SageMaker) [Added]
  • P1751: Lack of proper isolation of resources (SageMaker) [Added]
• T2572: Avoid confidential or sensitive information in tags or free-form text fields (SageMaker) [Added]
  • P1754: Confidential or sensitive information in visible fields (SageMaker) [Added]
• T2573: Verify no confidential or sensitive information in tags or free-form text fields (SageMaker) [Added]
  • P1754: Confidential or sensitive information in visible fields (SageMaker) [Added]
• T2574: Ensure identity-based policy best practices are followed (SageMaker) [Added]
  • P1755: Implementation of poor access control policies (SageMaker) [Added]
• T2575: Verify that identity-based policy best practices are followed (SageMaker) [Added]
  • P1755: Implementation of poor access control policies (SageMaker) [Added]
• T2576: Prevent Cross-service Confused Deputy (SageMaker) [Added]
  • P1756: Cross-service Confused Deputy Vulnerability (SageMaker) [Added]
• T2577: Verify that Cross-service Confused Deputy is prevented (SageMaker) [Added]
  • P1756: Cross-service Confused Deputy Vulnerability (SageMaker) [Added]
• T2578: Protect communications between compute instances in distributed training jobs (SageMaker) [Added]
  • P1757: Lack of encrypted communication between training nodes (SageMaker) [Added]
• T2579: Verify that communications between compute instances in distributed training jobs are encrypted (SageMaker) [Added]
  • P1757: Lack of encrypted communication between training nodes (SageMaker) [Added]
• T2580: Run training and inference containers in internet-free mode (SageMaker) [Added]
  • P1758: Lack of Proper Internet Isolation in Training and Inference Containers (SageMaker) [Added]
• T2581: Verify that training and inference containers run in internet-free mode (SageMaker) [Added]
  • P1758: Lack of Proper Internet Isolation in Training and Inference Containers (SageMaker) [Added]
• T2582: Implement security best practices for data protection (SageMaker) [Added]
  • P1759: Lack of Security Best Practice Implementation (SageMaker) [Added]
• T2583: Verify that data protection security best practices are implemented (SageMaker) [Added]
  • P1759: Lack of Security Best Practice Implementation (SageMaker) [Added]
• T2584: Ensure legal and regulatory compliance (SageMaker) [Added]
  • P1770: Lack of compliance with applicable regulation [Added]
• T2585: Verify adherence to legal and regulatory compliance (SageMaker) [Added]
  • P1770: Lack of compliance with applicable regulation [Added]
• T2586: Use shadow testing for model updates (SageMaker) [Added]
  • P1760: Lack of Shadow Testing (SageMaker) [Added]
• T2587: Verify that shadow testing is set up for model updates (SageMaker) [Added]
  • P1760: Lack of Shadow Testing (SageMaker) [Added]
• T2588: Prevent sensitive data exposure in ML models [Added]
  • P1750: Lack of model confidentiality and privacy protection in ML [Added]
• T2589: Test ML model prevention of sensitive data exposure [Added]
  • P1750: Lack of model confidentiality and privacy protection in ML [Added]
• T2590: Protect ML model against theft [Added]
  • P1752: Lack of access control and model theft protection in ML [Added]
• T2591: Test ML model protection against theft [Added]
  • P1752: Lack of access control and model theft protection in ML [Added]
• T2592: Protect ML model against supply chain attacks [Added]
  • P1752: Lack of access control and model theft protection in ML [Added]
• T2593: Test ML model protection against supply chain attacks [Added]
  • P1752: Lack of access control and model theft protection in ML [Added]
• T2594: Protect ML model against poisoning attacks [Added]
  • P1753: Lack of model behavior integrity and manipulation protection in ML [Added]
• T2595: Test ML model protection against poisoning attacks [Added]
  • P1753: Lack of model behavior integrity and manipulation protection in ML [Added]
• T2596: Prevent HTTP Request Smuggling [Added]
  • P1747: HTTP Request Smuggling [Added]
• T2597: Implement RBAC instead of individual accounts [Added]
  • P1761: Lack of Role Based access control [Added]
• T2598: Implement query-level access control [Added]
  • P1762: Lack of granularity of Database access permissions [Added]
• T2599: Protect against connection string parameter pollution [Added]
  • P1763: Accessible database connection strings [Added]
• T2600: Control the result set size returned by a query [Added]
  • P1764: Lack of control over the size of result sets returned by queries [Added]
• T2601: Use Transparent Data Encryption with Enterprise Databases [Added]
  • P1765: Lack of Transparent Data Encryption in Databases [Added]
• T2602: Log typical database and server activities and related metadata [Added]
  • P1766: Lack of logging typical database and server activities [Added]
• T2603: Protect backup archive bits [Added]
  • P1767: Lack of protection for backup archive bits [Added]
• T2604: Follow best practices for data restoring operations [Added]
  • P1768: Lack of proper data restoring operations [Added]
• T2605: Validate database traffic [Added]
  • P1769: Lack of database traffic validation [Added]
• T2606: Verify RBAC implemented instead of individual accounts [Added]
  • P1761: Lack of Role Based access control [Added]
• T2607: Verify query-level access control is implemented [Added]
  • P1762: Lack of granularity of Database access permissions [Added]
• T2608: Verify that the connection string is protected against connection string parameter pollution [Added]
  • P1763: Accessible database connection strings [Added]
• T2609: Verify that the result set size returned by queries are controlled [Added]
  • P1764: Lack of control over the size of result sets returned by queries [Added]
• T2610: Verify that Transparent Data Encryption is utilized with Enterprise Databases. [Added]
  • P1765: Lack of Transparent Data Encryption in Databases [Added]
• T2611: Verify that typical database and server activities, along with related metadata, are logged [Added]
  • P1766: Lack of logging typical database and server activities [Added]
• T2612: Verify backup archive bits are protected [Added]
  • P1767: Lack of protection for backup archive bits [Added]
• T2613: Verify best practices for data-restoring operations are followed [Added]
  • P1768: Lack of proper data restoring operations [Added]

• T2614: Verify database traffic is validated [Added]

  • P1769: Lack of database traffic validation [Added]

• P938: Non-preemptive Goroutines [Deactivated]

• Components

  • Amazon AMI [Added]
  • Amazon API Gateway [Added]
  • Amazon Aurora [Updated]
  • Amazon CloudFront [Added]
  • Amazon CloudWatch [Added]
  • Amazon Cognito [Added]
  • Amazon DynamoDB [Updated]
  • Amazon EC2 [Added]
  • Amazon ECS [Added]
  • Amazon EKS [Added]
  • AWS IAM [Updated]
  • Amazon Kinesis Data Firehose [Added]
  • Amazon Kinesis Data Streams [Added]
  • AWS Lambda [Updated]
  • Amazon RDS [Added]
  • Amazon Route53 [Updated]
  • Amazon S3 [Updated]
  • Amazon SageMaker [Added]
  • Amazon SNS [Added]
  • Amazon SQS [Added]
  • Amazon VPC [Added]
  • Android App [Updated]
  • Apache [Updated]
  • Apache Tomcat [Updated]
  • ASG [Added]
  • Automotive Application [Added]
  • AWS CloudTrail [Added]
  • AWS Config [Added]
  • AWS KMS [Added]
  • AWS Service [Added]
  • AWS WAF [Added]
  • Azure Active Directory (Entra ID) [Updated]
  • Azure App Service [Added]
  • Azure Functions [Updated]
  • Azure Key Vault [Added]
  • Azure Kubernetes Service [Added]
  • Azure Monitor [Added]
  • Azure PostgreSQL Database [Added]
  • Azure Resource Manager [Added]
  • Azure Security Center [Added]
  • Azure SQL Database [Updated]
  • Azure Storage [Added]
  • Azure Virtual Machines [Added]
  • Azure Virtual Network [Added]
  • Containerization Platform [Added]
  • Docker [Added]
  • EBS [Added]
  • ELB [Added]
  • Firmware [Added]
  • Generic Component [Added]
  • Database Server [Updated]
  • Google BigQuery [Added]
  • Google Cloud DNS [Updated]
  • Google Cloud IAM [Updated]
  • Google Cloud Key Management [Added]
  • Google Cloud Logging [Added]
  • Google Cloud SQL [Added]
  • Google Cloud Storage [Updated]
  • Google Compute Engine [Added]
  • Google Kubernetes Engine [Added]
  • Google Virtual Private Cloud [Added]
  • Hardware [Added]
  • Ansible [Added]
  • Terraform [Added]
  • WebSphere [Updated]
  • In-house Application [Added]
  • iOS App [Updated]
  • LDAP [Disabled]
  • Mainframe Application [Added]
  • Managed Kubernetes [Added]
  • Microsoft Active Directory [Disabled]
  • Microsoft IIS [Updated]
  • Microsoft SQL Server [Updated]
  • Mobile App [Updated]
  • MongoDB database [Disabled]
  • MySQL Database [Updated]
  • NGINX [Updated]
  • NoSQL database [Disabled]
  • On-premise [Added]
  • Openshift [Added]
  • Oracle Database [Updated]
  • WebLogic [Updated]
  • PayPal [Disabled]
  • PostgreSQL [Disabled]
  • SMTP server [Disabled]
  • Software [Added]
  • SQL Database [Updated]
  • SQLite database [Disabled]
  • SSO Provider [Disabled]
  • System Level Security Requirements [Added]
  • Unmanaged Kubernetes [Added]
  • User [Disabled]
  • Web Application - Backend [Updated]
  • Web Application - Frontend [Added]
  • Web Server [Added]
  • Windows Application [Added]

• Changes to Project Properties and Profiles

  • Q262: External Dependencies
    • Q263: Software Updates [Updated]
      • INFO: Updated the description.
      • A1104: Has software/firmware update functionality [Updated]
        • INFO: Updated the description.
    • Q288: Service Chaining
      • A1141: Receives user requests through remote services [Updated]
        • INFO: Updated the description.
  • Q284: Context and Characteristics
    • Q252: Application's Context and Characteristics
      • Q357: Artificial Intelligence/Machine Learning
        • A1367: Builds and deploys machine learning (ML) models [Added]
  • Q289: Cloud Computing
    • Q290: Cloud Providers
      • Q298: AWS Services
        • A1366: SageMaker [Added]

2023.4

January 6, 2024

New features and enhancements

• Diagrammatic Threat Modeling

  • Threat Model Diagrams can now generate Threats, Weaknesses, and Countermeasures. This is a beta for the 2023.4 release and must be enabled via API or through your Customer Success Manager.
  • Imported diagrams are only accepted in draw.io/diagrams.net, TM7 (Microsoft Threat Modeling Tool), JSON, and XML format.

• Trend Reports

  • Added an advanced reporting feature called "Trend Reports" that captures changes across the application, Countermeasures, and project objects. This feature is enabled by default with its corresponding feature flag.
    • Users can represent changes in compliance counts and mean times to compliance, among many other metrics.
    • Changes are captured nightly and data can be realized as far back from July 8th, 2023.
    • Added the ability to include Trend Reports in Dashboards.
    • Added granular permissions for users interacting with Trend Reports.
    • Added the ability to export the data in CSV or JSON format.

• Verification Tools Update

  • Added the ability for integrations to customize the project connection names for verification tools. Any existing and future project connections for verification tools can add or edit a connection name.

• Checkmarx Integration

  • Added CheckmarxOne into the Integration Ecosystems. Users can connect their CheckmarxOne instance in SD Elements and map SAST scan results to project Countermeasures.
    • Requires Tenant ID and API Key for server connection.
    • Requires a project_id for project connection.

Other Product Improvements

• Added pre-aggregations to Library and Application contexts for Advanced Reports.
• Fixed a bug where importing how-to files in JSON or YAML format would not work.

Content improvements summary

• CWE

  • Updated to version 4.13

• 2023 CWE Top 25 Most Dangerous Software Weaknesses

  • Added a new regulation

• Compliance Regulations and Mappings

  • ANSI/ISA 62443-4-2 & ISASecure CSA 311
    • Updated the ISASecure CSA 311 regulation to combine the requirements of ANSI/ISA 62443-4-2 and ISASecure CSA/SSA and deactivated the ANSI/ISA 62443-4-2 regulation.
  • ANSI/ISA 62443-3-3 & ISASecure SSA 311
    • Updated the ISASecure SSA 311 regulation to combine the requirements of ANSI/ISA 62443-3-3 and ISASecure CSA/SSA and deactivated the ANSI/ISA 62443-3-3 regulation

• Updated the following code scanner mappings

  • Fortify
  • Qualys
  • SonarQube
  • WebInspect

Content additions and updates (as of December 5, 2023):

• Compliance Regulations and Mappings

  • Added 2023 CWE Top 25 Most Dangerous Software Weaknesses
  • Removed ANSI/ISA 62443-3-3
  • Removed ANSI/ISA 62443-4-2
  • Updated ANSI/ISA 62443-4-2 (ISASecure CSA 311) [INFO: Updated the description].
  • Updated ANSI/ISA 62443-3-3 (ISASecure SSA 311) [INFO: Updated the description].
  • Updated CIS Azure Kubernetes Service (AKS) 1.2.0 [INFO: Updated the description].
  • Updated ISO/SAE 21434 [INFO: Updated the description].
  • Updated ISO 27001 [INFO: Updated the description].

• T1: Use multi-factor authentication for remote access to high risk systems or administrative access to services

  • TA5412: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5414: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T5: Use minimum standards for passwords
  • TA5432: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5434: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5436: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T8: Use Consistent Error Handling for All Authentication Failures
  • TA5440: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T21: Ensure all data in transit is encrypted using a secure TLS channel
  • TA5495: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5497: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T60: Use correct and approved cryptographic algorithms, parameters, and key lengths
  • TA5501: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T61: Disable default accounts or change all default passwords
  • TA5422: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T70: Implement account lockout or authentication throttling for system accounts
  • TA5442: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T77: Test for single-factor authentication
  • TA5411: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5413: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T80: Test password requirements
  • TA5431: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5433: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5435: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T82: Test authentication error consistency
  • TA5439: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T87: Verify that all data in transit is encrypted using a secure TLS channel
  • TA5494: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5496: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T107: Test that application forbids uploading or transferring malware [Updated]
  • INFO: Updated the text.
• T114: Test system-to-system authentication lockout or throttling
  • TA5441: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T156: Validate certificate and its chain of trust properly
  • TA5438: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
• T175: Test that the client validates digital certificates
  • TA5437: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
• T244: Securely delete any unprotected sensitive data before a resource is released or shared
  • TA5539: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5541: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T245: Verify that sensitive unprotected data is securely deleted
  • TA5538: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5540: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T248: Protect secret keys and passwords in the application
  • TA5424: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5426: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5428: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
• T249: Verify that keys and passwords are protected in the application
  • TA5423: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5425: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5427: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
• T295: Avoid storing unencrypted confidential data without access control mechanisms
  • TA5537: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T296: Test that unencrypted confidential data is not stored without access control mechanisms
  • TA5536: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T323: Test that default accounts are disabled or default passwords are changed
  • TA5421: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T337: Include a 'break glass' feature that enables emergency functions
  • TA5452: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T338: Control access to resources through user authentication and authorization
  • TA5406: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5408: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5410: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T340: Use an account and identity management system
  • TA5416: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5418: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5420: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
• T342: Inform and warn users about using critical system services
  • TA5444: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T343: Test that proper system use notification is displayed or sent for critical features
  • TA5443: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T344: Enforce different rules for access to the system based on the origin, type, and medium of request
  • TA5446: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5448: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5450: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T381: Test break-glass procedures
  • TA5451: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T445: Verify that only approved cryptographic algorithms and key lengths are used
  • TA5500: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T567: Enable network access control for local area network communications
  • TA5455: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T591: Verify that network access control is enabled for local area network communications
  • TA5454: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5456: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T682: Make S3 bucket CloudTrail logs publicly inaccessible (AWS) [Updated]
  • INFO: Updated the text.
• T1380: Enforce secure user registration and access control
  • TA5453: ISASecure SSA 311 requirements: Levels (4) [Updated]
    • INFO: Updated the text.
• T2254: Use the most robust Security Operation Mode (WiFi)
  • TA5430: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T2275: Test to confirm that the most robust Security Operation Mode is applied (WiFi)
  • TA5429: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
• T2276: Test to confirm that authorization and authentication controls are in place for access to resources
  • TA5405: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5407: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5409: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T2277: Test to confirm the use of an account and identity management system
  • TA5415: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5417: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
  • TA5419: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
• T2278: Test to confirm that different rules for access to the system are enforced based on the origin, type, and medium of the request
  • TA5445: ISASecure SSA 311 requirements: Levels (1, 2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5447: ISASecure SSA 311 requirements: Levels (2, 3, 4) [Updated]
    • INFO: Updated the text.
  • TA5449: ISASecure SSA 311 requirements: Levels (3, 4) [Updated]
    • INFO: Updated the text.
• T2359: Configure a secure user authentication (Cloud) (2/2) [Updated]
  • INFO: Updated the priority from 7 to 10.
• T2360: Configure a secure user authorization (Cloud) (2/2) [Updated]
  • INFO: Updated the priority from 5 to 10.
• T2361: Design a secure application architecture for the cloud environment (Cloud) (2/2) [Updated]
  • INFO: Updated the priority from 9 to 10.
• T2368: Enable logging and protect log files in your cloud environment (Cloud) (2/4) [Updated]
  • INFO: Updated the priority from 7 to 9.
• T2369: Enable logging and protect log files in your cloud environment (Cloud) (3/4) [Updated]
  • INFO: Updated the priority from 7 to 9.
• T2370: Enable logging and protect log files in your cloud environment (Cloud) (4/4) [Updated]
  • INFO: Updated the priority from 7 to 9.
• T2371: Enable logs and configuration monitoring in your cloud environment (Cloud) (2/4) [Updated]
  • INFO: Updated the priority from 7 to 8.
• T2372: Enable logs and configuration monitoring in your cloud environment (Cloud) (3/4) [Updated]
  • INFO: Updated the priority from 7 to 8.
• T2373: Enable logs and configuration monitoring in your cloud environment (Cloud) (4/4) [Updated]
  • INFO: Updated the priority from 7 to 8.
• T2374: Verify that logging is enabled and log files are protected (Cloud) (2/2) [Updated]
  • INFO: Updated the priority from 7 to 9.
• T2375: Verify that log monitoring and configuration monitoring are enabled (Cloud) (2/3) [Updated]
  • INFO: Updated the priority from 7 to 8.

• T2376: Verify that log monitoring and configuration monitoring are enabled (Cloud) (3/3) [Updated]

  • INFO: Updated the priority from 7 to 8.

• Changes to Project Properties and Profiles

  • Q193: Components
    • Q101: Components In Development
      • A1077: Firmware, embedded, or hardware solution [Updated]
        • INFO: Updated the children.
  • Q199: Authentication
    • Q120: Authentication Features
      • Q121: Authentication Method
        • A19: Uses passwords [Updated]
          • INFO: Updated the children.
  • Q243: Internal Hidden Properties
    • Q189: Internal Properties (Use this, for all hidden answers)
      • A768: This is a software project [Updated]
        • INFO: Updated the children.

• New Just-in-Time Training

  • Defending Web APIs (18)

2023.3

For the latest SD Elements Release Notes, see our User Guide: https://docs.sdelements.com/release/latest/guide/docs/releasenotes.html

New features and enhancements

• New content updates functionality

  • Any Countermeasures removed or added to a project through the content update button will appear in global, project, and Countermeasure activity logs along with the user who took the action, and the date and time it was taken.
    • For more information, see https://docs.sdelements.com/release/latest/guide/docs/projects/project_new_content_updates_available.html

• Import / Export Enhancements

  • With feature flag: Import/Export Enhanced Capability turned on (off by default):
    • Added the ability to have deactivated content to be present in the export job.
    • Added the ability to mark specific content as active or deactivated via import job
    • Added the ability to set custom content as delete to remove the content completely via import job
  • Enabling Import/Export of Regulations and Enabling Async API (Beta) have been migrated to feature flags so users can now toggle features on and off via the UI.

• Automation Event/Action

  • With Feature Flag: User Login Activity (on by default)
  • Added the ability to track user login events
  • Added a new action to deactivate users that have not logged in after a predefined number of days

• Reactivation Function (only for SSO Users)

  • With Feature Flag: Auto-Reactivate Users via SSO (off by default)
  • Added the ability to auto-reactivate users using single sign-on.

• Survey UX

  • Added a feature flag to make survey change reviews optional before publishing. The flag is disabled by default. When enabled, users answering the survey will have a choice to publish directly or review and then publish.

Content improvements summary

• AI Security

  • Added new Weaknesses, Countermeasures, and Additional Requirements based on NIST AI Risk Management Framework (RMF) and OWASP Top 10 for Large Language Model Applications.

• Consumer IoT: ETSI EN 303 645

  • Added new Regulation and Additional Requirements based on the EN 303 645 Standard.

• ISO 27001 (2022)

  • Added a new Regulation.

• Rust

  • Added new Howtos for the Rust programming language.

• Updated the following code scanner mappings:

  • Appscan, Fortify, Qualys, SonarQube, WebInspect, and Nessus.

Content additions and updates (as of September 26, 2023):

• Compliance Regulations and Mappings

  • Added NIST AI RMF v1.0
  • Added EN 303 645
  • Added OWASP Top 10 for Large Language Model Applications v1.0.0
  • Added ISO 27001

• Content Packs

  • Added NIST AI RMF
  • Added AI Security
  • Added EN 303 645
  • Added OWASP LLM Top 10
  • Added ISO 27001 (2022)
  • Added Rust

• T2: Secure the password reset mechanism

  • TA6527: EN 303 645 requirements [Added]
• T60: Use correct and approved cryptographic algorithms, parameters, and key lengths
  • TA6535: EN 303 645 requirements [Added]
• T72: Use safe arithmetic to avoid integer overflow
  • I1880: Rust: Check calculations for integer overflows [Added]
• T151: Use cryptographically secure random numbers [Updated]
  • INFO: Updated the text.
• T153: Scrub buffers holding sensitive information when releasing/deleting
  • I1878: Rust: Clear sensitive memory after use [Added]
• T159: Follow best practices for secure error and exception handling
  • I1881: Rust: Return errors using the Result type and don’t panic [Added]
• T176: Apply principles of privacy when handling personal information
  • TA6539: EN 303 645 requirements [Added]
• T189: Minimize the use of unmanaged (native) code
  • I1883: Rust: Follow best practices when calling external C/C++ functions [Added]
  • P730: Direct Use of Unsafe Unmanaged Code [Updated]
    • INFO: Updated the match conditions.
• T196: Avoid unsafe functions
  • I1882: Rust: Avoid unsafe code [Added]
• T197: Validate the signature of all remote code/updates to verify their origin and integrity (client side)
  • TA6532: EN 303 645 requirements [Added]
• T248: Protect secret keys and passwords in the application
  • TA6534: EN 303 645 requirements [Added]
• T301: Verify that buffers holding sensitive information are scrubbed
  • I1884: Rust: Clear sensitive memory after use. [Added]
• T338: Control access to resources through user authentication and authorization
  • TA6536: EN 303 645 requirements [Added]
• T370: Follow best practices for using third-party software libraries/modules and open source/COTS components
  • I1879: Use secure libraries and open source components in Rust [Added]
• T375: Release resources when no longer needed
  • I1877: Rust: Avoid memory leaks [Added]
  • P293: Uncontrolled Resource Consumption (Resource Exhaustion) [Updated]
    • INFO: Updated the match conditions.
• T403: Verify that errors and exceptions are securely handled
  • I1886: Rust: Securely handle errors and exception. [Added]
• T433: Design a fallback mechanism or a degraded mode for the system
  • TA6540: EN 303 645 requirements [Added]
• T456: Change default security settings to the most stringent ones and disable unnecessary services and modules
  • TA6537: EN 303 645 requirements [Added]
• T584: Implement update capabilities for your application
  • TA6530: EN 303 645 requirements [Added]
• T586: Implement Secure Boot if possible
  • TA6538: EN 303 645 requirements [Added]
• T897: Test if the unmanaged code is used securely
  • I1887: Rust: Securely use external functions in Rust. [Added]
  • P730: Direct Use of Unsafe Unmanaged Code [Updated]
    • INFO: Updated the match conditions.
• T991: Configure connectionTimeout (Apache Tomcat) [Updated]
  • INFO: Updated the text.
  • I834: Apache Tomcat: Configuring connectionTimeout [Updated]
    • INFO: Updated the text.
• T1061: Enable SQL auditing (Microsoft Azure)
  • P1024: No SQL auditing (Microsoft Azure) [Updated]
    • INFO: Updated the text.
• T1234: Only allow trusted users to control the Docker daemon (Docker) [Updated]
  • INFO: Updated the text.
• T1250: Configure admission control policy securely (Kubernetes) [Updated]
  • INFO: Updated the text.
• T1278: Ensure that the --protect-kernel-defaults argument is set to true (Kubernetes) [Updated]
  • INFO: Updated the text.
• T1352: Restrict remote access (Google Cloud) [Updated]
  • INFO: Updated the text.
• T1376: Provide and maintain guidance on secure installation, maintenance, and configuration of all software components
  • TA6542: EN 303 645 requirements [Added]
• T1380: Enforce secure user registration and access control [Updated]
  • INFO: Updated the match conditions.
• T1385: Institute secure logging and event monitoring
  • TA6541: EN 303 645 requirements [Added]
• T1388: Triage and fix vulnerabilities discovered during automated and manual security tests
  • TA6528: EN 303 645 requirements [Added]
• T1403: Disable CLR (Microsoft SQL Server)
  • P1195: Enabled CLR (Microsoft SQL Server) [Updated]
    • INFO: Updated the text.
• T1461: Leave 'SQL Server Browser' service disabled if it is not required (Microsoft SQL Server) [Updated]
  • INFO: Updated the text.
• T1915: Perform network vulnerability assessment
  • P1438: Lack of network vulnerability assessment [Updated]
    • INFO: Updated the match conditions.
• T1920: Conduct security architecture and design reviews before starting code development
  • I1874: Evaluate if Rust is suitable for your requirements [Added]
• T1921: Track and manage usage of third-party and commercial off the shelf (COTS) hardware or software
  • TA6529: EN 303 645 requirements [Added]
• T1961: Ensure that the admission control plugin NodeRestriction is enabled (OpenShift) [Updated]
  • INFO: Updated the text.
• T2115: Enable image vulnerability scanning (Docker) [Updated]
  • INFO: Updated the text.
• T2186: Enforce valid Finite State Machines (FSMs) in hardware logic (Hardware/Firmware) [Updated]
  • INFO: Updated the text.
• T2211: Include a firmware update mechanism/feature (Hardware/Firmware)
  • TA6531: EN 303 645 requirements [Added]
• T2296: Securely install and configure all software components
  • P1669: Lack of a process for securely installing and configuring all software components [Updated]
    • INFO: Updated the match conditions.
• T2344: Implement and augment supporting toolchains by automating SDLC security activities [Updated]
  • INFO: Updated the content pack and match conditions.
  • P1681: Lack of automation and implementation of supporting toolchains [Updated]
    • INFO: Updated the content pack.
• T2347: Configure the Integrated Development Environment, Compilation, Interpreter, and Build Processes
  • I1875: Prepare a secure Rust development environment [Added]
• T2348: Perform code reviews
  • P1685: Lack of proper code reviews [Updated]
    • INFO: Updated the match conditions.
• T2349: Configure software to have secure settings by default
  • P1686: Lack of secure default settings [Updated]
    • INFO: Updated the match conditions.
• T2350: Create a Product Security Incident Response Team (PSIRT) [Updated]
  • INFO: Updated the match conditions.
• T2352: Verify that supporting toolchains are properly implemented [Updated]
  • INFO: Updated the content pack and match conditions.
  • P1681: Lack of automation and implementation of supporting toolchains [Updated]
    • INFO: Updated the content pack.
• T2354: Verify that an organization-wide software and code repository is established and used [Updated]
  • INFO: Updated the content pack and match conditions.
• T2355: Verify that the IDE, compiler, interpreter, and build processes are configured securely [Updated]
  • INFO: Updated the content pack and match conditions.
  • I1876: Verify a secure Rust development environment [Added]
• T2358: Verify that the organization has a Product Security Incident Response Team (PSIRT) [Updated]
  • INFO: Updated the match conditions.
• T2388: Enforce the principle of separation of duties [Updated]
  • INFO: Updated the text.
• T2473: Verify the presence of security constraints in all user stories and features [Updated]
  • INFO: Updated the match conditions.
• T2474: Include security constraints in all user stories and features [Updated]
  • INFO: Updated the match conditions.
• T2481: Define and apply configuration standards for Network Security Controls [Updated]
  • INFO: Updated the match conditions.
• T2482: Verify implementing configuration standards [Updated]
  • INFO: Updated the match conditions.
• T2483: Follow a control change management process [Updated]
  • INFO: Updated the text.
• T2498: Provide clear definitions for each component [Updated]
  • INFO: Updated the match conditions.
• T2499: Verify that clear definitions for each component exist [Updated]
  • INFO: Updated the match conditions.
• T2510: Define cybersecurity goals and requirements for a component [Updated]
  • INFO: Updated the match conditions.
• T2511: Define procedures for decommissioning and terminating cybersecurity support
  • TA6533: EN 303 645 requirements [Added]
• T2513: Verify whether cybersecurity goals and requirements are clearly defined for a component [Updated]
  • INFO: Updated the match conditions.
• T2514: Establish coding and testing guidelines [Updated]
  • INFO: Updated the match conditions.
• T2515: Verify coding and testing guidelines [Updated]
  • INFO: Updated the match conditions.
• T2517: Define cybersecurity specifications and post-development procedures [Updated]
  • INFO: Updated the match conditions.
• T2518: Verify cybersecurity specifications and post-development procedures [Updated]
  • INFO: Updated the match conditions.
• T2519: Prevent prompt injection in Large Language Models [Added]
  • P1733: Lack of protection against prompt injection in Large Language Models [Added]
• T2520: Test the prevention of prompt injection in Large Language Models [Added]
  • P1733: Lack of protection against prompt injection in Large Language Models [Added]
• T2521: Handle insecure output in Large Language Models [Added]
  • P1733: Lack of protection against prompt injection in Large Language Models [Added]
• T2522: Test insecure output handling in Large Language Models [Added]
  • P1733: Lack of protection against prompt injection in Large Language Models [Added]
• T2523: Prevent training data poisoning in Large Language Models [Added]
  • P1735: Lack of protection against training data poisoning in Large Language Models [Added]
• T2524: Test the prevention of training data poisoning in Large Language Models [Added]
  • P1735: Lack of protection against training data poisoning in Large Language Models [Added]
• T2525: Prevent Large Language Model Denial of Service [Added]
  • P1736: Lack of protection against Large Language Model denial of service [Added]
• T2526: Test the prevention Large Language Model Denial of Service [Added]
  • P1736: Lack of protection against Large Language Model denial of service [Added]
• T2527: Protect Large Language Models against supply chain vulnerabilities [Added]
  • P1737: Presence of supply chain vulnerabilities in Large Language Models [Added]
• T2528: Test the protection of Large Language Models against supply chain vulnerabilities [Added]
  • P1737: Presence of supply chain vulnerabilities in Large Language Models [Added]
• T2529: Prevent sensitive information disclosure in Large Language Models [Added]
  • P1738: Sensitive information disclosure in Large Language Models [Added]
• T2530: Test the prevention of sensitive information disclosure in Large Language Models [Added]
  • P1738: Sensitive information disclosure in Large Language Models [Added]
• T2531: Design secure plugins for Large Language Models [Added]
  • P1739: Insecure plugin design in Large Language Models [Added]
• T2532: Test plugin design security for Large Language Models [Added]
  • P1739: Insecure plugin design in Large Language Models [Added]
• T2533: Mitigate excessive agency in Large Language Models [Added]
  • P1740: Excessive agency in Large Language Models [Added]
• T2534: Test excessive agency mitigation in Large Language Models [Added]
  • P1740: Excessive agency in Large Language Models [Added]
• T2535: Mitigate overreliance in Large Language Models [Added]
  • P1741: Overreliance on Large Language Models [Added]
• T2536: Test overreliance in Large Language Models [Added]
  • P1741: Overreliance on Large Language Models [Added]
• T2537: Prevent model theft in Large Language Models [Added]
  • P1742: Model theft in Large Language Models [Added]
• T2538: Test model theft prevention in Large Language Models [Added]
  • P1742: Model theft in Large Language Models [Added]
• T2539: Provide organizational policies, processes, and procedures to ensure trustworthy and risk-aware AI integration [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6455: NIST AI RMF - Govern 1.1: Legal and regulatory requirements [Added]
  • TA6456: NIST AI RMF - Govern 1.2: Organizational AI risk management policies [Added]
  • TA6457: NIST AI RMF - Govern 1.3: Policies for AI impact measurement and risk assessment [Added]
  • TA6458: NIST AI RMF - Govern 1.4: Documentation and policy standardization for AI systems [Added]
  • TA6459: NIST AI RMF - Govern 1.7: Decommissioning AI systems policies [Added]
• T2540: Plan mechanisms for monitoring, reviewing, and inventorying AI systems [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6460: NIST AI RMF - Govern 1.5: AI systems monitoring and incident response [Added]
  • TA6461: NIST AI RMF - Govern 1.6: Inventory AI systems [Added]
• T2541: Establish clear roles, responsibilities, accountability, and training for AI risk management [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6462: NIST AI RMF - Govern 2.1: AI risk roles and responsibilities [Added]
  • TA6463: NIST AI RMF - Govern 2.2: Training on AI risk management [Added]
  • TA6464: NIST AI RMF - Govern 2.3: Management roles and responsibilities [Added]
• T2542: Address necessary human-AI configurations and oversight of AI systems [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6465: NIST AI RMF - Govern 3.1: Forming a diverse team [Added]
  • TA6466: NIST AI RMF - Govern 3.2: Human-AI policies [Added]
• T2543: Encourage critical thinking and a safety-first mindset in the lifecycle of AI systems [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6467: NIST AI RMF - Govern 4.1: Risk culture [Added]
  • TA6468: NIST AI RMF - Govern 4.2: Impact assessments [Added]
  • TA6469: NIST AI RMF - Govern 4.3: Information sharing about impacts or incidents [Added]
• T2544: Collect and integrate feedback from external AI system developers [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6470: NIST AI RMF - Govern 5.1: Manage external stakeholder feedback [Added]
  • TA6471: NIST AI RMF - Govern 5.2: Integrate feedback into system design and implementation [Added]
• T2545: Address AI risks associated with third-party entities [Added]
  • P1743: Lack of organizational policies and procedures for internal and third-party entities [Added]
  • TA6472: NIST AI RMF - Govern 6.1: Address AI risks arising from third-party entities [Added]
  • TA6473: NIST AI RMF - Govern 6.2: Handle failures or incidents in third-party data [Added]
• T2546: Identify business value and business use context of AI systems [Added]
  • P1744: Lack of recognizing context and failure to identify context-related risks for AI systems [Added]
  • TA6474: NIST AI RMF - Map 1.1: Identify AI system's intended and potential beneficial applications [Added]
  • TA6475: NIST AI RMF - Map 1.2: AI actor participation in establishing AI system context [Added]
  • TA6476: NIST AI RMF - Map 1.3: Organization's mission and relevant goals for AI technology [Added]
  • TA6477: NIST AI RMF - Map 1.4: Identify AI system's business value [Added]
  • TA6478: NIST AI RMF - Map 1.5: Organizational risk tolerances [Added]
  • TA6479: NIST AI RMF - Map 1.6: Socio-technical implications incorporation into design decisions [Added]
• T2547: Define AI system tasks and knowledge limits, and TEVV considerations [Added]
  • P1744: Lack of recognizing context and failure to identify context-related risks for AI systems [Added]
  • TA6480: NIST AI RMF - Map 2.1: AI system's support [Added]
  • TA6481: NIST AI RMF - Map 2.2: Identify AI system's knowledge limits [Added]
  • TA6482: NIST AI RMF - Map 2.3: Identify TEVV considerations [Added]
• T2548: Examine potential benefits, costs, and necessary human oversight of using AI systems [Added]
  • P1744: Lack of recognizing context and failure to identify context-related risks for AI systems [Added]
  • TA6483: NIST AI RMF - Map 3.1: Identify benefits of the intended AI system [Added]
  • TA6484: NIST AI RMF - Map 3.2: Identify AI system's potential costs [Added]
  • TA6485: NIST AI RMF - Map 3.3: Identify AI system's application scope [Added]
  • TA6486: NIST AI RMF - Map 3.4: Define operator and practitioner proficiency [Added]
  • TA6487: NIST AI RMF - Map 3.5: Human oversight on AI system [Added]
• T2549: Establish approaches for mapping AI technology and controlling risks [Added]
  • P1744: Lack of recognizing context and failure to identify context-related risks for AI systems [Added]
  • TA6488: NIST AI RMF - Map 4.1: Identify legal risks associated with AI technology components [Added]
  • TA6489: NIST AI RMF - Map 4.2: Identify and control internal risk of AI system's components [Added]
• T2550: Assess the likelihood of each beneficial and harmful identified impact [Added]
  • P1744: Lack of recognizing context and failure to identify context-related risks for AI systems [Added]
  • TA6490: NIST AI RMF - Map 5.1: Calculate likelihood of AI system's identified impact [Added]
  • TA6491: NIST AI RMF - Map 5.2: Collect and integrate AI actor feedback [Added]
• T2551: Create trustworthy AI systems [Added]
  • P1745: Lack of proper framework for measuring trustworthiness of AI systems [Added]
  • TA6492: NIST AI RMF - Measure 1.1: Metrics framework [Added]
  • TA6493: NIST AI RMF - Measure 1.2: Metrics assessment and utilization [Added]
  • TA6494: NIST AI RMF - Measure 1.3: TEVV and stakeholder feedback processes [Added]
• T2552: Document and monitor trustworthiness of AI systems [Added]
  • P1745: Lack of proper framework for measuring trustworthiness of AI systems [Added]
  • TA6495: NIST AI RMF - Measure 2.1: Documentation [Added]
  • TA6496: NIST AI RMF - Measure 2.2: Dataset privacy [Added]
  • TA6497: NIST AI RMF - Measure 2.3: Population Context [Added]
  • TA6498: NIST AI RMF - Measure 2.4: Regular monitoring [Added]
  • TA6499: NIST AI RMF - Measure 2.5: Accuracy and Reliability [Added]
  • TA6500: NIST AI RMF - Measure 2.6: Measuring safety [Added]
• T2553: Consider resiliency, transparency, and privacy in designing AI systems [Added]
  • P1745: Lack of proper framework for measuring trustworthiness of AI systems [Added]
  • TA6501: NIST AI RMF - Measure 2.7: Resilience [Added]
  • TA6502: NIST AI RMF - Measure 2.8: Transparency [Added]
  • TA6503: NIST AI RMF - Measure 2.9: Transparency, explainability, and interpretability [Added]
  • TA6504: NIST AI RMF - Measure 2.10: Privacy [Added]
  • TA6505: NIST AI RMF - Measure 2.11: Mitigate bias [Added]
  • TA6506: NIST AI RMF - Measure 2.12: Environmental Impacts [Added]
  • TA6507: NIST AI RMF - Measure 2.13: Metrics improvements [Added]
• T2554: Establish effective monitoring and risk management processes for AI systems [Added]
  • P1745: Lack of proper framework for measuring trustworthiness of AI systems [Added]
  • TA6508: NIST AI RMF - Measure 3.1: System monitoring [Added]
  • TA6509: NIST AI RMF - Measure 3.2: Risk tracking [Added]
  • TA6510: NIST AI RMF - Measure 3.3: Impact assessment [Added]
• T2555: Enhance the trustworthiness of AI systems [Added]
  • P1745: Lack of proper framework for measuring trustworthiness of AI systems [Added]
  • TA6511: NIST AI RMF - Measure 4.1: Engagement Processes [Added]
  • TA6512: NIST AI RMF - Measure 4.2: Analyze feedback [Added]
  • TA6513: NIST AI RMF - Measure 4.3: TEVV-Based Decisions [Added]
• T2556: Perform risk assessment and management for AI Systems [Added]
  • P1746: Lack of proper risk management for AI systems [Added]
  • TA6514: NIST AI RMF - Manage 1.1: Suitability analysis [Added]
  • TA6515: NIST AI RMF - Manage 1.2: Risk tolerance analysis [Added]
  • TA6516: NIST AI RMF - Manage 1.3: Risk response plans [Added]
  • TA6517: NIST AI RMF - Manage 1.4: Monitor and manage residual risks for AI systems [Added]
• T2557: Analyze, monitor, and manage risks associated with AI systems [Added]
  • P1746: Lack of proper risk management for AI systems [Added]
  • TA6518: NIST AI RMF - Manage 2.1: Risk management and planning [Added]
  • TA6519: NIST AI RMF - Manage 2.2: Establish risk control [Added]
  • TA6520: NIST AI RMF - Manage 2.3: Treatment procedures [Added]
  • TA6521: NIST AI RMF - Manage 2.4: Procedures for AI system bypass and reactivation [Added]
• T2558: Manage risks associated with external dependencies and third-party resources in AI system [Added]
  • P1746: Lack of proper risk management for AI systems [Added]
  • TA6522: NIST AI RMF - Manage 3.1: Third-Party AI Systems [Added]
  • TA6523: NIST AI RMF - Manage 3.2: Pre-trained AI Models and Components [Added]

• T2559: Regularly monitor and document AI system performance and processes [Added]

  • P1746: Lack of proper risk management for AI systems [Added]
  • TA6524: NIST AI RMF - Manage 4.1: Performance and trustworthiness [Added]
  • TA6525: NIST AI RMF - Manage 4.2: Incorporate feedback [Added]
  • TA6526: NIST AI RMF - Manage 4.3: Traceability and transparency [Added]

• Changes to Project Properties and Profiles

  • Q195: Language and Framework
    • Q109: Programming Language
      • A1365: Rust [Added]
  • Q237: Compliance Scope: Other
    • Q360: In scope for EN 303 645 [Added]
      • A1364: Yes [Added]
    • Q325: In-Scope for ISO 27001 Compliance
      • A1267: Yes [Updated]
        • INFO: Updated the description.
  • Q284: Context and Characteristics
    • Q252: Application's Context and Characteristics
      • Q357: Artificial Intelligence/Machine Learning [Added]
        • A1362: Uses Large Language Models (LLMs) [Added]
        • A1363: AI governance tasks are in scope (based on NIST AI RMF) [Added]

• New Just-in-Time Training

  • Defending Databases (22)
  • Defending Java (26)

2023.2

July 8, 2023

For the latest SD Elements Release Notes, see our User Guide: https://docs.sdelements.com/release/latest/guide/docs/releasenotes.html

New features and enhancements

• Authentication

  • Added SAML Group and Role Mapping via the SD Elements UI
  • Introduced validation on certificate and key uploading

• Reporting

  • Dashboards
    • Links found in a widget on a dashboard now function as expected

• Survey UX

  • Added a ‘last draft’/’published’ label with a timestamp on the project Survey page
  • Updated the buttons on the project Survey page
  • Added an option for users to see the Survey history within the project Survey page
  • All Survey answer changes are now highlighted within the Survey (until they are published)
  • Users will now see a new confirmation page when they try to publish the Survey

Content improvements summary

• ISO/SAE 21434

  • Added new Weaknesses, Countermeasures, Additional Requirements, and a Regulation based on the standard.

• OWASP IoT Top 10

  • Updated the existing compliance report to the latest (2018) version of the OWASP IoT Top 10 list.

• OWASP Top 10 Privacy Risks v2.0

  • Updated, mapped, and added Countermeasures to reflect the OWASP Top 10 Privacy Risks v2.0 list.

• General Content improvement

  • Added new Countermeasures and one Amendment to enrich hardware/firmware content.
  • Enhanced the language and actionability of some high-priority Countermeasures.
  • Fixed and validated the match conditions of some Weaknesses and Countermeasures.

Content additions and updates (as of June 20, 2023):

• Compliance Regulations and Mappings

  • Added OWASP IoT Top 10 (2018)
  • Added OWASP Top 10 Privacy Risks v2.0
  • Added ISO/SAE 21434
  • Removed OWASP IoT Top 10 (2014)
  • Updated DIACAP [Archived, Use 800-53 report] [INFO: Updated the description].
  • Updated OWASP IoT Attack Surface Areas [Retired] [INFO: Updated the description].

• Content Packs

  • Added OWASP Privacy Top 10

• T25: Enforce absolute session timeouts [Updated]

  • INFO: Updated the text.
• T26: Expire sessions on logout [Updated]
  • INFO: Updated the text.
• T74: Avoid HTTP parameter pollution
  • P689: HTTP Parameter Pollution [Updated]
    • INFO: Updated the match conditions.
• T86: Test session ID uniqueness and rotation after authentication [Updated]
  • INFO: Updated the priority.
• T118: Test for default accounts and credentials [Deactivated]
• T157: Temporary files must be cleaned up after the resource is used
  • P348: Incomplete Cleanup [Updated]
    • INFO: Updated the text and match conditions.
• T163: Handle health data securely [Updated]
  • INFO: Updated the priority.
• T176: Apply principles of privacy when handling personal information [Updated]
  • INFO: Updated the text.
• T178: Obtain consent from users prior to collecting personal information [Updated]
  • INFO: Updated the text and priority.
• T186: Use recommended settings and the latest patches for third party libraries and software
  • P728: Insufficient patching or use of insecure third party software/libraries [Updated]
    • INFO: Updated the match conditions.
• T193: Review non-categorized/miscellaneous findings from automated analysis
  • P733: Potential security defects reported by automated scanners are missed or overlooked [Updated]
    • INFO: Updated the match conditions.
• T235: Verify that application does not store protected health information insecurely [Updated]
  • INFO: Updated the priority.
• T236: Test that the application encrypts protected health information on the Internet [Updated]
  • INFO: Updated the priority.
• T238: Test that users can review and update their personal information [Updated]
  • INFO: Updated the inclusion weakness.
• T239: Test that users provide consent prior to the collection of personal information [Updated]
  • INFO: Updated the priority.
• T247: Verify logical access to encrypted volumes are managed independently of native operating system [Updated]
  • INFO: Updated the inclusion weakness.
• T275: Avoid sending sensitive data using implicit Intents or Broadcasts
  • P738: Insufficient Restriction of Intent Receivers in Android [Updated]
    • INFO: Updated the match conditions.
• T370: Follow best practices for using third-party software libraries/modules and open source/COTS components
  • TA6437: Perform a reuse analysis and asses out-of-context components (ISO 21434) [Added]
• T371: Provide unified and manageable interfaces for security settings and configuration parameters [Updated]
  • INFO: Updated the text.
• T545: Verify that personal information is anonymized before being reused for secondary purposes [Updated]
  • INFO: Updated the priority.
• T574: Prevent information exposure in HyperCat
  • P96: Information Exposure [Updated]
    • INFO: Updated the match conditions.
• T586: Implement Secure Boot if possible [Updated]
  • INFO: Updated the text.
• T605: Verify if consent is obtained prior to personal information collection (where applicable) [Updated]
  • INFO: Updated the priority.
• T666: Rotate access keys every 90 days or less (AWS)
  • P161: Password Aging with Long Expiration [Updated]
    • INFO: Updated the match conditions.
• T739: Verify if transferring personal information is legitimate and in compliance with applicable privacy regulations [Updated]
  • INFO: Updated the priority.
• T743: Verify accuracy of personal information [Updated]
  • INFO: Updated the priority.
• T745: Verify if pseudonymized personal information is protected [Updated]
  • INFO: Updated the priority.
• T750: Limit personal information collection and processing to the specified purpose [Updated]
  • INFO: Updated the text.
• T753: Verify whether personal information is collected only for specified purposes [Updated]
  • INFO: Updated the priority.
• T756: Verify if personal data processing activities are recorded and maintained [Updated]
  • INFO: Updated the priority.
• T757: Verify if personal information processing stops when user objects to it [Updated]
  • INFO: Updated the priority.
• T838: Test if your application adheres to HTTP DNT header [Updated]
  • INFO: Updated the priority.
• T1202: Set container CPU priority appropriately (Docker)
  • P1090: Container CPU priority is not set appropriately (Docker) [Updated]
    • INFO: Updated the text.
• T1364: Verify that third party software libraries/modules and open source/COTS components are used securely
  • TA6450: Verify the reuse analysis and the analysis of out-of-context and off-the-shelf components (ISO 21434) [Added]
• T1366: Identify applicable compliance regulations
  • P1171: Lack of a process for identifying applicable compliance regulation [Updated]
    • INFO: Updated the match conditions.
• T1367: Identify and classify critical assets
  • P1172: Lack of a process for identifying critical assets [Updated]
    • INFO: Updated the match conditions.
• T1368: Perform security testing using SAST tools [Updated]
  • INFO: Updated the text.
  • P1186: Lack of a process for static application security testing (SAST) [Updated]
    • INFO: Updated the match conditions.
• T1369: Perform security testing using DAST tools [Updated]
  • INFO: Updated the text.
  • P1173: Lack of a process for dynamic application testing [Updated]
    • INFO: Updated the match conditions.
• T1370: Identify and track common software weaknesses and threats
  • TA6433: Define continual cybersecurity activities (ISO 21434) [Added]
  • P1187: Lack of a process for identifying and assessing threats [Updated]
    • INFO: Updated the title and match conditions.
• T1371: Use a software security management solution to select and track security controls
  • P1188: Lack of software security management solution to track security controls [Updated]
    • INFO: Updated the match conditions.
• T1372: Follow software change management process
  • P1174: Lack of software change management process [Updated]
    • INFO: Updated the match conditions.
• T1373: Maintain the integrity of all software code [Updated]
  • INFO: Updated the priority.
  • P1175: Insufficient software code control [Updated]
    • INFO: Updated the match conditions.
• T1374: Ensure the integrity of software release and update delivery
  • P1178: Lack of a process for ensuring the integrity of software release and update [Updated]
    • INFO: Updated the match conditions.
• T1376: Provide and maintain guidance on secure installation, maintenance, and configuration of all software components
  • P1181: Lack of guidance on secure installation, maintenance and configuration of all software components [Updated]
    • INFO: Updated the match conditions.
• T1377: Establish and maintain a bi-directional communication channel for receiving security reports and sending security notifications [Updated]
  • INFO: Updated the priority.
  • P1182: Lack of a communication channel for reporting security issues [Updated]
    • INFO: Updated the match conditions.
• T1378: Release a change summary for each software update
  • P1177: Lack of a process for creating summary of changes upon each software update [Updated]
    • INFO: Updated the match conditions.
• T1380: Enforce secure user registration and access control
  • P1185: Lack of process for user registration and enforcement of access control [Updated]
    • INFO: Updated the match conditions.
• T1381: Establish secure processes for key management
  • P1434: Lack of secure key management process [Updated]
    • INFO: Updated the match conditions.
• T1382: Manage performance and capacity
  • P1190: Lack of process for performance and capacity management [Updated]
    • INFO: Updated the match conditions.
• T1383: Separate development, test, and operational environments
  • TA6440: Create a production control plan (ISO 21434) [Added]
  • P1191: Deploying software in production on the same environment as development and testing [Updated]
    • INFO: Updated the match conditions.
• T1384: Back up and restore securely [Updated]
  • INFO: Updated the priority.
  • P1179: A secure backup and restore processes are missing or lacking [Updated]
    • INFO: Updated the match conditions.
• T1385: Institute secure logging and event monitoring
  • P1183: No secure processes for logging and monitoring events [Updated]
    • INFO: Updated the match conditions.
• T1386: Regulate the use of electronic messaging [Updated]
  • INFO: Updated the priority.
• T1387: Ensure the security of products acquired through the supply chain and contractors
  • P1170: Lack of a secure process for outsourcing [Updated]
    • INFO: Updated the match conditions.
• T1388: Triage and fix vulnerabilities discovered during automated and manual security tests
  • P1225: Unmanaged test result findings [Updated]
    • INFO: Updated the match conditions.
• T1389: Perform penetration testing [Updated]
  • INFO: Updated the priority.
  • P1184: Lack of a secure process for penetration testing [Updated]
    • INFO: Updated the match conditions.
• T1892: Perform a Threat and Risk Assessment (TRA)
  • TA6434: Perform risk analysis and treatments for a component (ISO 21434) [Added]
  • TA6446: Identify assets and their damage scenarios (ISO 21434) [Added]
  • TA6451: Identify threat scenarios and attack paths for assets (ISO 21434) [Added]
  • TA6453: Determine an attack feasibility rating and risk value for each attack scenario (ISO 21434) [Added]
  • P1187: Lack of a process for identifying and assessing threats [Updated]
    • INFO: Updated the title and match conditions.
• T1893: Perform a cloud solution security posture assessment
  • P1436: Lack of cloud solution security posture assessment [Updated]
    • INFO: Updated the match conditions.
• T1894: Perform a vendor security assessment
  • TA6435: Ensure the proper distribution of cybersecurity activities with other organizations (ISO 21434) [Added]
  • P1437: Lack of vendor security assessment [Updated]
    • INFO: Updated the match conditions.
• T1895: Protect applications with Intrusion Detection / Protection System (IDS/IPS) [Updated]
  • INFO: Updated the priority.
  • P1429: Applications not protected with Intrusion Detection / Protection System (IDS/IPS) [Updated]
    • INFO: Updated the match conditions.
• T1915: Perform network vulnerability assessment [Updated]
  • INFO: Updated the priority.
  • P1438: Lack of network vulnerability assessment [Updated]
    • INFO: Updated the match conditions.
• T1917: Perform container security assessment [Updated]
  • INFO: Updated the priority.
• T1920: Conduct security architecture and design reviews before starting code development [Updated]
  • INFO: Updated the priority.
  • P1432: Lack of security architecture and design activities [Updated]
    • INFO: Updated the match conditions.
• T1921: Track and manage usage of third-party and commercial off the shelf (COTS) hardware or software [Updated]
  • INFO: Updated the priority.
  • P1433: Lack of third-party software code or dependencies management [Updated]
    • INFO: Updated the match conditions.
• T1925: Maintain the default behavior for anonymous access (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1926: Verify that the default behavior for anonymous access is maintained (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1927: Disable basic-auth-file method (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1928: Verify that the basic-auth-file option has not been configured (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1929: Secure communication between API server and master nodes (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1930: Verify that the connection between API server and master node is secure (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1931: Prevent insecure bindings and insecure port access (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1932: Verify that insecure-bind-address and insecure-port are disabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1933: Do not disable secure-port for API server traffic (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1934: Verify that 'secure-port' is not disabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1943: Use Security Context Constraints instead of SecurityContextDeny admission controllers (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1944: Verify that the list of admission controllers does not include SecurityContextDeny (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1945: Do not disable NamespaceLifecycle admission controller (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1946: Verify that the NamespaceLifecycle plugin is not disabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1947: Configure auditing properly on the API server (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1948: Verify that API server auditing is configured properly (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1949: Do not set authorization-mode flag (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1950: Verify that the authorization-mode argument is not set to AlwaysAllow and Node authorizer is enabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1951: Do not use static token files for authentication (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1952: Verify that static token files are not used (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1953: Ensure that the service-account-lookup and service-account-key-file arguments are properly set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1954: Verify that the service-account-lookup and service-account-key-file arguments are properly set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1955: Do not enable PodSecurityPolicy admission control plugin (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1956: Verify that the admission control plugin SecurityContextConstraint is set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1957: Ensure that etcd arguments are properly set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1958: Verify that etcd arguments are properly set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1959: Do not disable ServiceAccount admission controller (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1960: Verify that the admission control plugin ServiceAccount is set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1961: Ensure that the admission control plugin NodeRestriction is enabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1962: Verify that the admission control plugin NodeRestriction is set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1963: Encrypt data at rest in etcd datastore with aescbc encryption (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1964: Verify data at rest on etcd datastore is encrypted with aescbc encryption provider (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1965: Enable the APIPriorityAndFairness feature gate (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1966: Verify that the APIPriorityAndFairness feature gate is enabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1967: Adjust the request timeout value (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1968: Verify that request timeout is set to an appropriate value (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1969: Do not expose profiling to the web (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1970: Verify that profiling is not exposed to the web (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1973: Do not disable use-service-account-credentials argument (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1974: Verify that use-service-account-credentials is not disabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1975: Do not change the default setting for service-account-private-key-file (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1976: Verify that the service-account-private-key-file argument is properly set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1977: Ensure that root-ca-file is properly set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1978: Verify that the root-ca-file argument is not set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1979: Never give pods more privileges than required (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1980: Verify that Security Context Constraints get applied (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1983: Set permissions for sensitive files properly (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1984: Verify the permissions for the configuration files (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1985: Secure etcd communication (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1986: Verify that etcd communication is secure (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1989: Run pods with the most restrictive Security Context Constraints possible (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1990: Verify Security Context Constraints as in use (OpenShift) [Updated]
  • INFO: Updated the priority.
• T1999: Implement strong network policies (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2000: Verify network policies (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2001: Limit the use of privileged containers (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2002: Verify the usage of privileged containers (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2003: Do not disable the 'allow-privileged' flag (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2004: Verify that the 'allow-privileged' flag is not disabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2005: Disable anonymous requests (OpenShift) [Updated]
  • INFO: Updated the title and text.
• T2007: Keep the default value for the authorization mode argument (OpenShift) [Updated]
  • INFO: Updated the title, text, and priority.
• T2008: Verify that the authorization-mode argument is not set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2011: Do not set the read-only-port argument (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2012: Verify that the read-only port is not enabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2013: Adjust the value of streaming-connection-idle-timeout argument (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2014: Verify the value of streaming-connection-idle-timeout argument (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2017: Ensure that the make-iptables-util-chains is set to true (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2018: Verify that make-iptables-util-chains is set to true for each machinepool (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2019: Do not enable the 'keep-terminated-pod-volumes' flag (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2020: Verify that the 'keep-terminated-pod-volumes' is not enabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2021: Ensure that the hostname-override is not set (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2022: Verify that hostname-override does not exist (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2023: Set the kubeAPIQPS event-qps argument to 0 (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2024: Verify that the value of event-qps is set to 0 (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2027: Do not enable cAdvisor endpoint (OpenShift) [Updated]
  • INFO: Updated the priority.
  • P1491: Enabling cAdvisor endpoint (OpenShift) [Updated]
    • INFO: Updated the text.
• T2028: Verify that cAdvisor endpoint is not enabled (OpenShift) [Updated]
  • INFO: Updated the priority.
  • P1491: Enabling cAdvisor endpoint (OpenShift) [Updated]
    • INFO: Updated the text.
• T2029: Do not disable rotate-certificates (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2030: Verify that rotate-certificates settings are not disabled (OpenShift) [Updated]
  • INFO: Updated the priority.
• T2128: Notify users and regulators of breaches of personal information [Updated]
  • INFO: Updated the title and text.
• T2137: Ensure that sensitive data is not recorded (iOS)
  • P1545: Information Disclosure in iOS via ReplayKit Framework [Updated]
    • INFO: Updated the match conditions.
• T2144: Implement CAN bus protocol properly (Connected Cars)
  • P1548: Poor implementation of CAN bus protocol (Connected Cars) [Updated]
    • INFO: Updated the match conditions.
• T2145: Enable gRPC Server-Client Certificate Authentication (.NET Core 3)
  • P1549: Unauthenticated gRPC client-server communication [Updated]
    • INFO: Updated the match conditions.
• T2164: N/A - Not Applicable [Updated]
  • INFO: Updated the inclusion weakness.
• T2170: Ensure that personal information processed by the application meets data localization requirements [Updated]
  • INFO: Updated the priority.
• T2172: Enforce the principle of least privilege (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2174: Avoid unintended proxy or intermediary (Confused Deputy) (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2176: Avoid mixing agents of varying trust levels (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2177: Generate unique and immutable identifiers in SoC (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2178: Ensure fabric access controls enablement before 3rd party hardware IPs (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2179: Block write operations to reserve bits (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2180: Review Access Control Policy (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2181: Evaluate write-once registers for proper configuration (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2182: Check lock bit protections for design consistency (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2183: Avoid using chicken bits (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2184: Disable access to security-sensitive information stored in fuses (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2186: Enforce valid Finite State Machines (FSMs) in hardware logic (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2187: Enforce proper implementation of wear leveling operations (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2188: Enforce proper protection against voltage and clock glitches (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2189: Prevent Semiconductor Defects in Hardware Logic with Security-Sensitive Implications (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2190: Prevent mirroring regions with different values (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2191: Ensure using configured CPU hardware to support exclusivity of write and execute operations (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2192: Prevent incorrect selection of fuse values (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2193: Prevent incorrect comparison logic granularity (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2195: Ensure access control applied properly to Mirrored or Aliased Memory Regions (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2196: Prevent exposure of sensitive system information due to uncleared debug information (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2197: Prevent Improper Restriction of Security Token Assignment (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2198: Prevent improper handling of overlap between protected memory ranges (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2199: Prevent improper handling of single-event upsets (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2200: Ensure register interface does not allow software access to sensitive data (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2201: Enforce physical access control (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2239: Tag traces to indicate owner and debugging privilege level (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2240: Designate an immutable Root of Trust for storage (Hardware/Firmware)
  • TA6432: Validate device firmware/software at the time of manufacturing (Hardware/Firmware) [Added]
• T2241: Ensure security version data is protected from tampering (Hardware/Firmware) [Updated]
  • INFO: Updated the text and priority.
• T2242: Implement priority-based arbitration inside the Network on Chips (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2243: Protect against fault injection attacks (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2244: Protect against error injection errors in redundant blocks (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2245: Protect against abnormal thermal range (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2256: Authenticate and log all access to registries containing sensitive or proprietary images
  • P1650: Insufficient authentication for container registries [Updated]
    • INFO: Updated the match conditions.
• T2257: Keep host OS components up-to-date
  • P1651: Insufficient updates of host OS components [Updated]
    • INFO: Updated the match conditions.
• T2258: Minimize host OS attack surface
  • P1652: Large host OS attack surface [Updated]
    • INFO: Updated the match conditions.
• T2262: Verify client certificate authentication is not used for users (Kubernetes) [Updated]
  • INFO: Updated the priority.
• T2264: Verify network policies and CNI selection are appropriate (Kubernetes) [Updated]
  • INFO: Updated the priority.
• T2271: Test to confirm that unauthorized access to sensitive data through debug or test interfaces is properly restricted (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2272: Test immutability of Root of Trust for storage (Hardware/Firmware) [Updated]
  • INFO: Updated the priority.
• T2296: Securely install and configure all software components [Updated]
  • INFO: Updated the priority.
• T2324: Verify whether privacy principles are applied for handling personal data [Updated]
  • INFO: Updated the priority.
• T2327: Verify if a Privacy Impact Assessment is performed [Updated]
  • INFO: Updated the priority.
  • P1435: Lack of Privacy Impact Assessment (PIA) [Updated]
    • INFO: Updated the match conditions.
• T2328: Verify if proper policies exist for processing sensitive personal data [Updated]
  • INFO: Updated the priority.
  • P1180: Lack of process for collecting and protecting sensitive data [Updated]
    • INFO: Updated the match conditions.
• T2329: Verify if health data is handled securely [Updated]
  • INFO: Updated the priority.
• T2330: Verify if children's personal information is handled securely [Updated]
  • INFO: Updated the priority.
• T2331: Verify whether any plan exists for data privacy incident response [Updated]
  • INFO: Updated the priority.
• T2337: Keep your infrastructure state secure (Terraform) [Updated]
  • INFO: Updated the text.
• T2343: Define security-related roles and provide role-base training [Updated]
  • INFO: Updated the match conditions.
  • P1680: Lack of defining proper security roles and responsibilities [Updated]
    • INFO: Updated the match conditions.
• T2344: Implement and augment supporting toolchains by automating SDLC security activities [Updated]
  • INFO: Updated the match conditions.
  • P1681: Lack of automation and implementation of supporting toolchains [Updated]
    • INFO: Updated the match conditions.
• T2345: Define and implement criteria for software security checks [Updated]
  • INFO: Updated the match conditions.
  • TA6438: Enforce product cybersecurity validation (ISO 21434) [Added]
  • P1682: Lack of proper criteria for software security checks [Updated]
    • INFO: Updated the match conditions.
• T2346: Establish an organization-wide software and code repository
  • P1683: Lack of organization-wide software and code repository [Updated]
    • INFO: Updated the match conditions.
• T2347: Configure the Integrated Development Environment, Compilation, Interpreter, and Build Processes
  • P1684: Lack of proper integration of the development environment and tools [Updated]
    • INFO: Updated the cwe set and match conditions.
• T2348: Perform code reviews
  • P1685: Lack of proper code reviews [Updated]
    • INFO: Updated the match conditions.
• T2349: Configure software to have secure settings by default
  • P1686: Lack of secure default settings [Updated]
    • INFO: Updated the cwe set and match conditions.
• T2350: Create a Product Security Incident Response Team (PSIRT) [Updated]
  • INFO: Updated the priority and match conditions.
  • P1687: Lack of a Product Security Incident Response [Updated]
    • INFO: Updated the match conditions.
• T2351: Verify that security-related roles and responsibilities are properly defined and assigned [Updated]
  • INFO: Updated the match conditions.
  • P1680: Lack of defining proper security roles and responsibilities [Updated]
    • INFO: Updated the match conditions.
• T2352: Verify that supporting toolchains are properly implemented [Updated]
  • INFO: Updated the match conditions.
  • P1681: Lack of automation and implementation of supporting toolchains [Updated]
    • INFO: Updated the match conditions.
• T2353: Verify that proper criteria for software security checks are defined and implemented [Updated]
  • INFO: Updated the match conditions.
  • TA6439: Verify product cybersecuriy validation (ISO 21434) [Added]
  • P1682: Lack of proper criteria for software security checks [Updated]
    • INFO: Updated the match conditions.
• T2358: Verify that the organization has a Product Security Incident Response Team (PSIRT) [Updated]
  • INFO: Updated the priority and match conditions.
  • P1687: Lack of a Product Security Incident Response [Updated]
    • INFO: Updated the match conditions.
• T2359: Configure a secure user authentication (Cloud) (2/2) [Updated]
  • INFO: Updated the priority.
• T2360: Configure a secure user authorization (Cloud) (2/2) [Updated]
  • INFO: Updated the priority.
• T2361: Design a secure application architecture for the cloud environment (Cloud) (2/2) [Updated]
  • INFO: Updated the priority.
• T2368: Enable logging and protect log files in your cloud environment (Cloud) (2/4) [Updated]
  • INFO: Updated the priority.
• T2369: Enable logging and protect log files in your cloud environment (Cloud) (3/4) [Updated]
  • INFO: Updated the priority.
• T2370: Enable logging and protect log files in your cloud environment (Cloud) (4/4) [Updated]
  • INFO: Updated the priority.
• T2371: Enable logs and configuration monitoring in your cloud environment (Cloud) (2/4) [Updated]
  • INFO: Updated the priority.
• T2372: Enable logs and configuration monitoring in your cloud environment (Cloud) (3/4) [Updated]
  • INFO: Updated the priority.
• T2373: Enable logs and configuration monitoring in your cloud environment (Cloud) (4/4) [Updated]
  • INFO: Updated the priority.
• T2374: Verify that logging is enabled and log files are protected (Cloud) (2/2) [Updated]
  • INFO: Updated the priority.
• T2375: Verify that log monitoring and configuration monitoring are enabled (Cloud) (2/3) [Updated]
  • INFO: Updated the priority.
• T2376: Verify that log monitoring and configuration monitoring are enabled (Cloud) (3/3) [Updated]
  • INFO: Updated the priority.
• T2379: Ensure compliance with ISO/SAE 21434 [Updated]
  • INFO: Updated the match conditions.
  • P1688: Lack of processes for the approval of vehicles with regards to cyber security and cyber security management system [Updated]
    • INFO: Updated the match conditions.
• T2389: Prevent co-channel and adjacent channel interference
  • P1693: Poor WiFi Settings Configuration [Updated]
    • INFO: Updated the text and match conditions.
• T2392: Create an Incident Response Plan [Updated]
  • INFO: Updated the text.
  • TA6444: Create incident response plans (ISO 21434) [Added]
  • P1687: Lack of a Product Security Incident Response [Updated]
    • INFO: Updated the match conditions.
• T2396: Verify that the organization has a Product Security Incident Plan
  • TA6445: Verify incident response plans (ISO 21434) [Added]
  • P1687: Lack of a Product Security Incident Response [Updated]
    • INFO: Updated the match conditions.
• T2419: Verify Cognito uses strong authentication requirements (Amazon Cognito) [Updated]
  • INFO: Updated the match conditions.
• T2423: Verify the S3 backup for Kinesis Firehose delivery failures are checked regularly (Amazon Kinesis Data Firehose) [Updated]
  • INFO: Updated the match conditions.
• T2428: Implement least privilege access to Kinesis streams (Amazon Kinesis Data Streams) [Updated]
  • INFO: Updated the match conditions.
• T2429: Verify least privilege access to Kinesis streams is implemented (Amazon Kinesis Data Streams) [Updated]
  • INFO: Updated the match conditions.
• T2433: Verify Kinesis events are logged (Amazon Kinesis Data Streams) [Updated]
  • INFO: Updated the priority.
• T2443: Verify proper permissions for files on worker nodes (Containerization) [Updated]
  • INFO: Updated the priority.
• T2445: Verify secure authentication to and from worker nodes (Containerization) [Updated]
  • INFO: Updated the priority.
• T2447: Verify the collection and protection of sensitive information on worker nodes (Containerization) [Updated]
  • INFO: Updated the priority.
• T2449: Verify the availability of worker nodes (Containerization) [Updated]
  • INFO: Updated the priority.
• T2451: Verify that worker nodes are protected with proper flags and arguments (Containerization) [Updated]
  • INFO: Updated the priority.
• T2456: Assign roles properly (Containerization) [Updated]
  • INFO: Updated the text.
• T2470: Verify CloudWatch is used to monitor Kinesis Firehose decryption failures (Amazon Kinesis Data Firehose) [Updated]
  • INFO: Updated the match conditions.
• T2480: Include Content-Disposition headers in API responses [Updated]
  • INFO: Updated the text.
• T2490: Provision device with private/public key pair securely (Hardware/Firmware) [Added]
  • P1721: Insecure storage of credentials (Hardware/Firmware) [Added]
• T2491: Verify that the device is securely provisioned with a private/public key pair (Hardware/Firmware) [Added]
  • P1721: Insecure storage of credentials (Hardware/Firmware) [Added]
• T2492: Use device-generated opaque keys to encrypt OS files and data on the device (Hardware/Firmware) [Added]
  • P1722: Unsecure key generation (Hardware/Firmware) [Added]
• T2493: Verify that the device can generate opaque keys to encrypt OS files and data on the device (Hardware/Firmware) [Added]
  • P1722: Unsecure key generation (Hardware/Firmware) [Added]
• T2494: Encrypt the bootloader (Hardware/Firmware) [Added]
  • P1723: Unencrypted bootloader (Hardware/Firmware) [Added]
• T2495: Verify that the bootloader is encrypted (Hardware/Firmware) [Added]
  • P1723: Unencrypted bootloader (Hardware/Firmware) [Added]
• T2496: Generate and forward audit logs (Hardware/Firmware) [Added]
  • P1724: Lack of device-generated audit logs (Hardware/Firmware) [Added]
• T2497: Verify that the device generates and forwards audit logs (Hardware/Firmware) [Added]
  • P1724: Lack of device-generated audit logs (Hardware/Firmware) [Added]
• T2498: Provide clear definitions for each component [Added]
  • P1716: Lack of Technical Documentation [Updated]
    • INFO: Updated the text.
• T2499: Verify that clear definitions for each component exist [Added]
  • P1716: Lack of Technical Documentation [Updated]
    • INFO: Updated the text.
• T2500: Verify that a Threat and Risk Assessment (TRA) is performed [Added]
  • TA6447: Verify a proper risk analysis and treatments are performed (ISO 21434) [Added]
  • TA6448: Verify the procedures for identifying assets and their damage scenarios (ISO 21434) [Added]
  • TA6452: Verify that threat scenarios and attack paths are identified for each valuable asset (ISO 21434) [Added]
  • TA6454: Verify the procedures for evaluating attack feasibility and risk rating (ISO 21434) [Added]
  • P1187: Lack of a process for identifying and assessing threats [Updated]
    • INFO: Updated the title and match conditions.
• T2501: Perform cybersecurity planning [Added]
  • P1727: Lack of cybersecurity planning [Added]
• T2502: Define a cybersecurity policy for your organization [Added]
  • P1726: Lack of an organizational cybersecurity policy [Added]
• T2503: Verify the cybersecurity policy of your organization [Added]
  • P1726: Lack of an organizational cybersecurity policy [Added]
• T2504: Verify the cybersecurity plan [Added]
  • P1727: Lack of cybersecurity planning [Added]
• T2505: Conduct cybersecurity assessments for components [Added]
  • P1729: Lack of a cybersecurity assessment [Added]
• T2506: Verify the cybersecurity assessment report [Added]
  • P1729: Lack of a cybersecurity assessment [Added]
• T2507: Verify vendor security assessment [Added]
  • TA6436: Verify the proper distribution of cybersecurity activities with other organizations (ISO 21434) [Added]
  • P1437: Lack of vendor security assessment [Updated]
    • INFO: Updated the match conditions.
• T2509: Verify the separation of development, test, and operational environments [Added]
  • TA6441: Verify your production control plan (ISO 21434) [Added]
  • P1191: Deploying software in production on the same environment as development and testing [Updated]
    • INFO: Updated the match conditions.
• T2510: Define cybersecurity goals and requirements for a component [Added]
  • P1716: Lack of Technical Documentation [Updated]
    • INFO: Updated the text.
• T2511: Define procedures for decommissioning and terminating cybersecurity support [Added]
  • P1730: Lack of procedures for decommissioning and terminating cybersecurity support [Added]
• T2512: Verify implemented procedures for decommissioning and terminating cybersecurity support [Added]
  • P1730: Lack of procedures for decommissioning and terminating cybersecurity support [Added]
• T2513: Verify whether cybersecurity goals and requirements are clearly defined for a component [Added]
  • P1716: Lack of Technical Documentation [Updated]
    • INFO: Updated the text.
• T2514: Establish coding and testing guidelines [Added]
  • P1731: Lack of coding and testing guidelines [Added]
• T2515: Verify coding and testing guidelines [Added]
  • P1731: Lack of coding and testing guidelines [Added]
• T2516: Verify that common software weaknesses and threats are identified and tracked. [Added]
  • TA6449: Verify the continuous monitoring, evaluation and management of security vulnerabilities (ISO 21434) [Added]
  • P1187: Lack of a process for identifying and assessing threats [Updated]
    • INFO: Updated the title and match conditions.
• T2517: Define cybersecurity specifications and post-development procedures [Added]
  • P1732: Lack of cybersecurity specifications and post-development procedures [Added]
• T2518: Verify cybersecurity specifications and post-development procedures [Added]
  • P1732: Lack of cybersecurity specifications and post-development procedures [Added]

• P1564: N/A - Not Applicable [Deactivated]

• Changes to Project Properties and Profiles

  • Q284: Context and Characteristics
    • Q252: Application's Context and Characteristics
      • A1350: Include general countermeasures in the Activity phase (process engineering tasks) in this project [Updated]
        • INFO: Updated the text and description.
  • Q352: Automotive [Added]
    • Q353: In-scope for Automotive Cybersecurity Regulations [Added]
      • A1358: ISO/SAE 21434 [Added]
      • A1359: WP.29 R155 [Added]

• New Just-in-Time Training

  • PCI DSS (16)
  • Defending Node (17)