Azure subscriptions should have Microsoft Defender for IoT Hub enabled
Checks that a Microsoft Defender for IoT security solution exists in the subscription. It must report status `Enabled` for monitored IoT Hub resources. Prowler rates the check severity high.
Without Defender for IoT, device activity lacks telemetry and alerting, degrading CIA. This blind spot increases dwell time and blast radius.
What this control checks
Defender for IoT security solution exists and reports status Enabled for monitored IoT Hub.
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_ensure_iot_hub_defender_is_on (prowler azure --checks defender_ensure_iot_hub_defender_is_on).
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
ISO/IEC 27001:2022: Mapped to A.8.7 (Protection Against Malware) and A.8.9 (Configuration Management).
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 9.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- 8.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- 2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- 3.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_defender_ensure_iot_hub_defender_is_on - Prowler Check:
defender_ensure_iot_hub_defender_is_on
Last reviewed: 2026-10-11