azure-compliance

Files (1)

• SKILL.md

SKILL.md (first lines)

# Azure Compliance

Translate policy and regulatory requirements into implementable Azure controls and audit evidence.
Map frameworks (ISO 27001, SOC2, HIPAA, PCI-DSS) to Azure services and configurations.

## Use This Skill When

- The user needs compliance alignment (ISO, SOC2, HIPAA, PCI-DSS, or custom)
- The user asks for policy enforcement, audit logging, or data protection controls
- The user needs a remediation plan for compliance gaps
- The user is preparing for a security audit or certification

## Context: Compliance Maturity

**Immature**: No compliance framework, ad hoc security, no audit trail  
**Developing**: Framework chosen, basic controls, manual evidence collection  
**Managed**: Controls automated with Azure Policy, audit logging centralized → **Target**  
**Optimized**: Continuous compliance monitoring, real-time dashboards, attestation automated

## Required Inputs

- **Applicable frameworks**: ISO 27001, SOC2 Type II, HIPAA, PCI-DSS, or custom?
- **Data classification**: Public, internal, confidential, secret (PII, PHI, payment data)?
- **Current architecture**: Existing controls, gaps identified?
- **Audit scope**: What resources/processes in scope?
- **Evidence requirements**: Reports, logs, attestations needed for certification?
- **Risk tolerance**: What's acceptable? What's not?

## Decision Tree

```
Which compliance framework applies?
├─ ISO 27001 → Identity (4.6), Access (6.2, 6.6), Encryption (10.2), Audit (12.4)
├─ SOC2 Type II → Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy
├─ HIPAA → Technical safeguards: Access, encryption, audit, integrity
├─ PCI-DSS → Network, access, encryption, logging, incident response (for payment processing)
└─ Custom → Map control names to Azure services

Is data sensitive (PII, PHI, payment)?
├─ Yes → Encryption (at-rest + in-transit), MFA, audit logging, DLP
└─ No → Basic controls sufficient

Do you process across regions/countries?
├─ Yes → Data residency compliance (GDPR, CCPA, regional data localization)
└─ No → Single-region controls

Do you process continuously or in batches?
├─ Continuous → Real-time monitoring, alerts, anomaly detection
└─ Batch → Periodic reviews, manual attestation

Who audits you (internal, external, customer)?
├─ Internal only → Simplified documentation
├─ External audit → Formal evidence packages, reports
└─ Customer audit → On-demand access, dashboards
```

## Workflow

### Phase 1: Map Control Objectives

**ISO 27001 Example Controls:**

```
Control 6.2: User registration and access rights
├─ Objective: Only authorized users access systems
├─ Azure Implementation:
│  ├─ Entra ID for authentication
│  ├─ RBAC for authorization
│  ├─ MFA for privileged access (PIM)
│  └─ Access reviews quarterly
├─ Evidence: Role assignments list, access review reports

Control 10.2: Monitoring and review of access records
├─ Objective: Detect unauthorized access attempts
├─ Azure Implementation:
│  ├─ Activity logs → Log Analytics
│  ├─ Alerts on failed logins (5+ failures = suspicious)
│  ├─ Alerts on privilege escalation
│  └─ Monthly log review
├─ Evidence: Alert configuration, log samples, review sign-offs

Control 10.7: Retention of log information
├─ Objective: Maintain audit trail for investigation
├─ Azure Implementation:
│  ├─ Logs stored for 1+ year (retention policy)
│  ├─ Archive to storage for long-term (7+ years)
│  └─ Access controlled (only security team)
├─ Evidence: Retention policy screenshot, archive storage exists
```

**PCI-DSS Example Controls:**

```
Requirement 2: Default security parameters
├─ Objective: Change default passwords, disable unnecessary services
├─ Azure Implementation:
│  ├─ No default storage account keys in use
│  ├─ Change password on deployment
│  ├─ Disable basic auth (use OAuth/OIDC)
│  └─ Disable unnecessary ports/protocols
├─ Evidence: Configuration review, disabled services list

Requirement 6: Develop and maintain secure applications
├─ Objective: No hardcoded passwords, input validation, error handling
├─ Azure Implementation:
│  ├─ Code scanning (DevSecOps)
│  ├─ Dependency scanning (vulnerabilities)
│  ├─ SAST/DAST testing
│  └─ Security gate in CI/CD
├─ Evidence: Scan reports, remediation history
```

### Phase 2: Implement Azure Governance Controls

1. **Enable Azure Policy** (enforce controls automatically):
   ```bash
   # Require encryption on storage accounts
   az policy assignment create \
     --name "Require-Storage-Encryption" \

From manu14357/zskills, MIT.

More from manu14357/zskills