Azure compliance documentation

If your organization needs to comply with legal or regulatory standards, start here to learn about compliance in Azure.

Compliance offerings

Global

• CIS benchmark
• CSA STAR Attestation
• CSA STAR Certification
• CSA STAR self-assessment
• SOC 1
• SOC 2
• SOC 3

Global

• ISO 20000-1
• ISO 22301
• ISO 27001
• ISO 27017
• ISO 27018
• ISO 27701
• ISO 9001
• WCAG

US government

• CJIS
• CMMC
• CNSSI 1253
• DFARS
• DoD IL2
• DoD IL4
• DoD IL5
• DoD IL6
• DoE 10 CFR Part 810
• EAR
• FedRAMP
• FIPS 140

US government

• ICD 503
• IRS 1075
• ITAR
• JSIG
• NDAA
• NIST 800-161
• NIST 800-171
• NIST 800-53
• NIST 800-63
• NIST CSF
• Section 508 VPATs
• StateRAMP

Financial services

• 23 NYCRR Part 500 (US)
• AFM and DNB (Netherlands)
• AMF and ACPR (France)
• APRA (Australia)
• CFTC 1.31 (US)
• EBA (EU)
• FCA and PRA (UK)
• FFIEC (US)
• FINMA (Switzerland)

Financial services

• FINRA 4511 (US)
• FISC (Japan)
• FSA (Denmark)
• GLBA (US)
• KNF (Poland)
• MAS and ABS (Singapore)
• NBB and FSMA (Belgium)
• OSFI (Canada)

Financial services

• OSPAR (Singapore)
• PCI 3DS
• PCI DSS
• RBI and IRDAI (India)
• SEC 17a-4 (US)
• SEC Regulation SCI (US)
• SOX (US)
• TruSight

Healthcare and life sciences

• ASIP HDS (France)
• EPCS (US)
• GxP (FDA 21 CFR Part 11)
• HIPAA (US)
• HITRUST
• MARS-E (US)
• NEN 7510 (Netherlands)

Automotive, education, energy, media, and telecommunication

• CDSA
• DPP (UK)
• FACT (UK)
• FERPA (US)
• MPA
• GSMA
• NERC (US)
• TISAX

Regional - Americas

• Argentina PDPA
• Canada privacy laws
• Canada Protected B
• US CCPA

Regional - Asia Pacific

• Australia IRAP
• China GB 18030
• China DJCP (MLPS)
• China TCS
• India MeitY
• Japan CS Gold Mark
• Japan ISMAP
• Japan My Number Act
• Korea K-ISMS
• New Zealand ISPC
• Singapore MTCS

Regional - EMEA

• EU Cloud CoC
• EU EN 301 549
• ENISA IAF
• EU GDPR
• EU Model Clauses
• Germany C5
• Germany IT-Grundschutz workbook
• Netherlands BIR 2012
• Qatar NIA

Regional - EMEA

• Russia personal data law
• Spain ENS High
• Spain LOPD
• UAE DESC
• UK Cyber Essentials Plus
• UK G-Cloud
• UK PASF

Additional compliance resources

To access a resource you may need to be signed into your cloud service

Privacy and GDPR

• Checklists
• Data subject requests
• Breach notification
• Data protection impact assessments
• Data residency in Azure

Azure Policy regulatory compliance built-in initiatives

• Australian Government ISM PROTECTED
• Canada Federal PBMM
• CIS Azure Foundations Benchmark
• FedRAMP High
• HIPAA HITRUST
• IRS 1075
• ISO 27001
• PCI DSS
• NIST SP 800-171
• UK OFFICIAL and UK NHS

Country/Region privacy and compliance guides

• Australian security and privacy requirements
• Singapore security and privacy requirements
• Japan security and privacy requirements
• Malaysian security and privacy requirements
• New Zealand security and privacy requirements
• Navigating your way to the cloud in Europe
• Navigating your way to the cloud in Asia
• Navigating to the cloud in Middle East and Africa
• Cloud compliance guides for financial services

Implementation and mappings

• Azure Policy Regulatory Compliance (preview)
• CIS Azure Foundations Benchmark
• CSA CAIQ
• FERPA implementation guide
• GDPR control mapping
• GxP guidelines
• HITRUST customer responsibility matrix

Implementation and mappings

• ISO 27001 security controls
• IT-Grundschutz workbook (German)
• NERC CIP standards and cloud computing
• NZ GCIO cloud computing considerations
• PCI 3DS attestation documents
• SEC Regulation SCI guidance
• SOX guidance
• UK OFFICIAL cloud security controls

White papers and analyst reports

• Overview of Azure compliance
• Enabling data residency and protection
• Azure for worldwide public sector
• Azure Internet of Things compliance
• IDC - Azure manages regulatory challenges
• Azure risk compliance guide
• Shared responsibilities for cloud computing
• Azure export controls
• Azure enables a world of compliance
• Azure cloud platform for PCI 3DS
• A practical guide to designing secure health solutions