Azure Security Benchmark ES-1: Use Endpoint Detection and Response (EDR)

What else in your programme already covers this

This control maps to 45 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 4 controls

CIS-10.5 Enable Anti-Exploitation Features
CIS-10.7 Use Behavior-Based Anti-Malware Software
CIS-13.2 Deploy a Host-Based Intrusion Detection Solution
CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

ASD37-12 Antivirus software with heuristics (Very Good)
ASD37-29 Host-based IDS/IPS (Very Good)
ASD37-30 Endpoint detection and response (Very Good)

CMMC 2.0 · 3 controls

SI.L2-3.14.2 Malicious Code Protection
SI.L2-3.14.6 Monitor Communications for Attacks
SI.L2-3.14.7 Identify Unauthorized Use

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-LOG-03 Security Monitoring and Alerting
CCM-UEM-05 Endpoint Management
CCM-UEM-09 Anti-Malware Detection and Prevention

FedRAMP High · 3 controls

SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components]
SI-3 Malicious Code Protection
SI-4(23) System Monitoring | Host-based Devices. Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms]

FedRAMP Moderate · 3 controls

SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components]
SI-3 Malicious Code Protection
SI-4(23) System Monitoring | Host-based Devices. Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms]

ISO 27002:2022 · 2 controls

8.1 User endpoint devices
8.7 Protection against malware

ISO 27701:2019 · 2 controls

6.3.2 Mobile devices and teleworking
6.9.2 Protection from malware

NIST SP 800-171 Rev 3 · 2 controls

03.14.02 Malicious Code Protection
03.14.06 System Monitoring

NIST SP 800-53 Rev 5 · 2 controls

NIST800-SI-3 Malicious code protection
NIST800-SI-4 System monitoring

PCI DSS 4.0 · 2 controls

5.2.2 The deployed anti-malware solution(s): • Detects all known types of malware. • Removes, blocks, or contains all known types of malware
5.3.2 The anti-malware solution(s): • Performs periodic scans and active or real-time scans. OR • Performs continuous behavioral analysis of systems or processes

UK Cyber Essentials · 2 controls

CE-MP.1 Anti-Malware Software Deployed
CE-MP.3 Anti-Malware Scans Files on Access and Web Pages

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-30 Specific proportional safeguards in place

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-5 Limit, prevent, detect and remove malware

C5 (Germany) · 1 control

C5-OPS-05 Protection Against Malware - Implementation

HIPAA Security Rule · 1 control

164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

NIST SP 800-161 Rev 1 · 1 control

161R1-SI-4 System Monitoring

NIST SP 800-172 · 1 control

3.14.2e Monitor Organizational Systems with Specialized Capabilities

NIST SP 800-218 · 1 control

SP800-218-PO.5.2 Harden Development Endpoints

NIST SP 800-53 Rev 5 LOW · 1 control

SI-3 Malicious Code Protection

NIST SP 800-53 Rev 5 MODERATE · 1 control

SI-3 Malicious Code Protection

NIST SP 800-53 Revision 5.1 HIGH · 1 control

SI-3 Malicious Code Protection

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable)

SOC 2 · 1 control

SOC2-CC6.8 Controls to prevent or detect unauthorized or malicious software

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Azure Security Benchmark have you already done?

Azure Security Benchmark ES-1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Azure Security Benchmark your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 71 of 85 Azure Security Benchmark controls already carry evidence.

If you hold NIST SP 800-53 Rev 583.5% covered · 14 gaps If you hold FedRAMP Moderate78.8% covered · 18 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.172.9% covered · 23 gaps If you hold ISO 27002:202269.4% covered · 26 gaps If you hold C5 (Germany)65.9% covered · 29 gaps If you hold ISO 27001:202261.2% covered · 33 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free