Easing compliance for UK public and health sectors with new Azure Blueprints

Earlier this month we released our latest Azure Blueprint for a key compliance standard with the availability of the UK OFFICIAL blueprint for the Government-Cloud (G-Cloud) standard, and National Health Service (NHS) Information Governance of the United Kingdom. The new blueprints map a set of Azure policies to appropriate UK OFFICIAL and UK NHS controls for any Azure deployed architecture. This allows UK government agencies and partners, and UK health organizations to more easily create Azure environments that might store and process UK OFFICIAL government data and health data.

. Every year, Microsoft submits evidence to attest that its in-scope cloud services comply with these principles, giving potential G-Cloud customers an overview of its risk environment. 

The UK OFFICIAL blueprint includes mappings to 8 of the 14 Cloud Security Principals:

1.  Data in transit protection. Assigns Azure Policy definitions to audit insecure connections to storage accounts and Redis cache.

2.  Data at rest protection (asset protection and resilience.) Assigns Azure Policy definitions that enforce specific cryptograph controls and audit the use of weak cryptographic settings. Also includes policies to restrict deployment of resources to UK location.

5.  Operational security. Assigns Azure Policy definitions that monitor missing endpoint protection, missing system updates, various vulnerabilities, unrestricted storage account, and whitelist activity.

9.  Secure user management and 10. Identity and authentication. Assigns several Azure Policy definitions to audit external accounts, accounts that do not have multi-factor authentication (MFA) enabled, virtual machines (VMs) without passwords, and other issues.

11. External interface protection. Assigns Azure Policy definitions that monitor unrestricted storage accounts. Also assigns a policy that enables adaptive application controls on VMs.

12.  Secure Service Administration. Assigns Azure Policy definitions related to privileged access rights for external accounts, Azure Active Directory authentication, MFA enablement, etc.

13.  Audit Information for Users. Assigns Azure Policy definitions that audit or enable various log settings on Azure resources.

Microsoft has prepared a guide to explain how Azure can help customers comply with the 14 Cloud Security Principals including 3, 4, 6, 7, 8, and 14. It can be found in our document , or if you have a suggestion for a compliance blueprint please share it via the .