What is the CIS Azure Foundations Benchmark?

More context

The identity section addresses account and authentication hygiene for the tenant; storage covers encryption, access restrictions, and public-exposure settings on storage accounts; networking restricts inbound access paths; and logging and monitoring ensures activity logging and alerting are configured so changes are recorded. Together these sections close the most common Azure misconfiguration classes.

Because Azure configuration changes continuously as teams deploy resources, a one-time assessment goes stale quickly. Continuous agentless scanning with drift detection keeps the subscription verified between audits, and CISGuard maps each result to NIST 800-53, ISO 27001, and SOC 2 so the same scan feeds every framework in scope.