What this control covers
Implements technical safeguards per OIS-06 risk analysis to detect and respond to network-based attacks, including DDoS, using SIEM systems. Documents measures per SP-01, ensuring prompt mitigation to protect cloud customer data from network threats.
Why it matters
A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.
How to implement
AWS
Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.
Azure
Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.
GCP
Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Technical safeguards.
Quick checklist
- Risk — Measures / - Configuration
- Security — Measures / - Configuration
- Data — Measures / - Configuration
- Technical — Measures / - Configuration
Related articles on this site
- NIST 800-171 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
- CMMC 2.0 SI.2.216 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
- Microsoft Cloud Security Posture Management (CSPM)
- NIST 800-171 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.