Azure subscriptions should have Network Watcher enabled

Network Watcher is a regional service to monitor and diagnose conditions at a network scenario level in, to, and from Azure. A network watcher resource group is required in every region where a virtual network is present.

Absent Network Watcher in a region creates blind spots in network telemetry and diagnostics, hindering detection of anomalies. Attackers can exploit unnoticed NSG or routing issues for lateral movement or data exfiltration, degrading confidentiality and availability and slowing incident triage.

What this control checks

Azure subscriptions must have Network Watcher enabled

Audit evidence

Evidence that deployed resources meet this control: Prowler check network_watcher_enabled (prowler azure --checks network_watcher_enabled); PowerPipe control azure_compliance.control.network_watcher_enabled.

Framework-specific interpretation

ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security), A.8.21 (Security of Network Services) and A.8.22 (Segregation of Networks).

NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 2.3.1 (The relevant entities shall review independently their approach to managing network and information system security and...), 6.7.2.b (determine and apply controls to protect the relevant entities internal network domains from unauthorised access;) and 2 more clauses.

NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6 (Audit Record Review, Analysis, and Reporting) and 3 more clauses.

NIST Cybersecurity Framework v2.0: Mapped to ID.AM-03 (Representations of the organization's authorized network communication and internal and external network data flows are...), ID.RA-03 (Internal and external threats to the organization are identified and recorded.), ID.RA-05 (Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response...) and 1 more clause.

Framework mappings

The clauses this control is mapped to in each framework.

ISO/IEC 27001:2022

A.8.20 Network security
A.8.21 Security of network services
A.8.22 Segregation of networks

NIS2 Directive (EU 2022/2555)

2 Risk management policy
6 Security in network and information systems acquisition, development and maintenance
11 Access control

NIST SP 800-53 Rev 5

AU-6 Audit Record Review, Analysis, and Reporting
AU-6(4) Central Review And Analysis
AU-6(5) Central Review And Analysis
AU-12 Audit Record Generation
AU-12(1) System-Wide And Time-Correlated Audit Trial

1 more clause

SI-4: System Monitoring

NIST Cybersecurity Framework v2.0

ID.AM-03
ID.RA-03: Internal and external threats to the organization are identified and recorded.
ID.RA-05
PR.IR-01

NIST SP 800-171 Rev 2

3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
3.14.7: Identify unauthorized use of organizational systems.

CIS Azure Benchmark v4.0.0