How TrustOnCloud Maps to the CIS Microsoft Azure Foundations Benchmark v4.0.0
CIS benchmarks are a useful baseline, but they don't reflect real-world threat models. Here's how TrustOnCloud controls align to CIS Azure v4.0.0, and where we go further.
TrustOnCloud Team
This post maps TrustOnCloud controls to the CIS Microsoft Azure Foundations Benchmark v4.0.0. CIS benchmarks are the most common starting point for auditors and compliance teams, but they focus on configuration baselines, not real-world threat models. The mapping below shows where TrustOnCloud satisfies CIS requirements directly, and where our controls provide more risk-driven alternatives. The full mapping table is available in our official documentation.
Introduction to CIS Benchmarks
The Center for Internet Security (CIS) publishes security benchmarks that outline foundational best practices for securing systems and cloud environments. These benchmarks are widely adopted as a starting point for organizations securing workloads in Microsoft Azure. They focus on basic configurations and technical settings, establishing a baseline that is often opinionated and not tailored for complex, real-world environments.
Auditors, security leaders, and compliance teams frequently reference CIS benchmarks to ensure critical controls are in place.
Why Map CIS to TrustOnCloud?
TrustOnCloud goes beyond prescriptive configuration checks. Our controls are built to address actual threats, not just configuration drift. Still, many customers are asked to demonstrate alignment with CIS benchmarks. That's where this mapping comes in.
By aligning TrustOnCloud controls with the CIS Microsoft Azure Foundations Benchmark, we help customers:
- Satisfy baseline requirements for auditors
- Identify which TrustOnCloud controls correspond to each CIS recommendation
- Understand where we provide more flexible or risk-driven alternatives
CIS-to-TrustOnCloud Mapping
This section shows the control-level alignment for the CIS Microsoft Azure Foundations Benchmark v4.0.0. The table below shows a representative sample. For the complete mapping, visit the documentation link below.
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
2.1.1.1.1 |
— | |
2.1.1.2.1 |
Keyvault.C95 under Keyvault.CO27 |
|
2.2.1.1 |
— | |
2.2.1.2 |
Network.C192 under Network.CO3 |
|
2.2.2 |
Network.C196 under Network.CO21 |
|
3.1.1 |
Databricks.C3 under Databricks.CO2 |
Our control also mentions not using public IPs in addition to using a VNet. |
3.1.2 |
Network.C224 under Network.CO19 |
This control applies to all services, not only Databricks. Our control additionally recommends using Azure Policy to audit NSGs configured for a subnet. |
3.1.3 |
Databricks.C21 under Databricks.CO10 |
|
3.1.4 |
Databricks.C20 under Databricks.CO1 |
Our control asks end users to define which users are synchronized to Entra ID instead of syncing all of them. |
3.1.5 |
Databricks.C28 under Databricks.CO11 |
Conclusion
The CIS Microsoft Azure benchmark is a helpful baseline, but it doesn't reflect the complexity of real-world threat models. TrustOnCloud helps you go further by tailoring controls to your risk appetite, workloads, and business needs.
If you're already a customer, we hope this mapping will be helpful. If not, book a 20-minute call and we'll explain how our controls align and how we help you go beyond checklist compliance. You may also be interested in exploring our Control Catalog.