Continuous compliance on every machine
Mar 7th, 2021 by Jesper Kråkhede
I have spent some time lately looking at how Azure can help with the technical part of compliance, and I´m impressed by where this is heading.
Most of the technical controls in standards like ISO 27001 and NIST are about configuration. Is the disk encrypted? Is the firewall on? Are the right security settings applied? Is logging enabled? Traditionally you check this once a year with a script or a manual review, write a report, and by the time the report is done half of it is out of date.
With Azure Policy, and its guest configuration capability for what happens inside the machines, you can define those controls once and have them evaluated continuously on every machine. Not only Azure VMs but also servers on-premises and in other clouds through Azure Arc. You get a dashboard that shows which machines comply with which control right now, and in many cases you can let the policy fix the configuration automatically.
There are built-in initiatives mapped to well-known standards, so you don´t have to start from scratch. You will still need to adapt them, but it saves a lot of time.
It doesn´t solve compliance. The processes and the people are still yours. But it turns the technical part from a yearly exercise into something you can see every day.
Compliance should be a state you monitor, not an event you prepare for.