Azure Policy NIST Alignment

Question

Hi,

We are aiming to align to the NIST SP 800-53 framework, using the Azure Policy built-in defintion set.

Given there are over 700 policies within this defintion set, and its such a big decision, Im wondering could I get some guidance on how best to aproach things here, to ideally have a seamless enablement of the NIST framework into our enviornment.

Two key questions:

• Would most large organisations looking to adopt NIST, be selective on the policies they want, or is it recommended to enable the full list of policies?
• Is audit mode for all policies initially the advised method?

Any other thoughts or best practices very welcome.

Thanks :)

Answer 1

Hello Dave O'Donohoe,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you need more information about Azure Policy aligning with the NIST SP 800-53 framework.

Regarding your questions:

Would most large organisations looking to adopt NIST, be selective on the policies they want, or is it recommended to enable the full list of policies?

Most large organizations typically adopt a selective approach rather than enabling the full list of policies because of how relevance it is to their organization, overwhelming and may lead to unnecessary complexity and all policies might impact system performance and administrative overhead.

Any organizations should consider starting by identifying the most critical controls that align with their risk management and compliance objectives: https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r5

Is audit mode for all policies initially the advised method?

Yes, it is generally recommended to start with audit mode for all policies at initial stage for the purpose of assessment, tuning, and risk mitigation.

Ensure you embrace best practices:

• https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-nist-csf
• https://devblogs.microsoft.com/azuregov/azure-government-supporting-critical-missions-with-the-nist-csf/
• https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-nist-800-53

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.