Merge pull request #269 from turbot/release/v0.45

Release/v0.45

CHANGELOG.md

@@ -1,3 +1,10 @@
+## v0.45 [2024-05-31]
+
+_What's new?_
+
+- Added Reserve Bank of India - IT Framework for NBFC Regulatory Compliance
+benchmark (`powerpipe benchmark run azure_compliance.benchmark.rbi_itf_nbfc_v2017`). ([#267](https://github.com/turbot/steampipe-mod-azure-compliance/pull/267))
+
 ## v0.44 [2024-05-16]
 
 _What's new?_

all_controls/monitor.sp

@@ -8,6 +8,8 @@ benchmark "all_controls_monitor" {
   title       = "Monitor"
   description = "This section contains recommendations for configuring Monitor resources."
   children = [
+    control.application_insights_linked_to_log_analytics_workspace,
+    control.log_profile_enabled_for_all_subscription,
     control.monitor_diagnostic_settings_captures_proper_categories,
     control.monitor_log_alert_create_policy_assignment,
     control.monitor_log_alert_create_update_nsg,

all_controls/network.sp

@@ -42,9 +42,12 @@ benchmark "all_controls_network" {
     control.network_security_group_ssh_access_restricted,
     control.network_security_group_subnet_associated,
     control.network_security_group_udp_service_restricted,
+    control.network_sg_flowlog_enabled,
     control.network_sg_flowlog_retention_period_greater_than_90,
     control.network_virtual_network_gateway_no_basic_sku,
     control.network_watcher_enabled,
+    control.network_watcher_flow_log_enabled,
+    control.network_watcher_flow_log_traffic_analytics_enabled,
     control.network_watcher_in_regions_with_virtual_network
   ]
 

all_controls/postgres.sp

@@ -15,6 +15,7 @@ benchmark "all_controls_postgres" {
     control.postgres_db_server_log_checkpoints_on,
     control.postgres_db_server_log_connections_on,
     control.postgres_db_server_log_disconnections_on,
+    control.postgres_db_server_log_duration_on,
     control.postgres_db_server_log_retention_days_3,
     control.postgres_server_private_link_used,
     control.postgres_sql_server_encrypted_at_rest_using_cmk,

all_controls/recoveryservice.sp

@@ -8,7 +8,9 @@ benchmark "all_controls_recoveryservice" {
   title       = "Recovery Service"
   description = "This section contains recommendations for configuring Recovery Service resources."
   children = [
-    control.recovery_service_vault_uses_managed_identity
+    control.recovery_service_vault_uses_managed_identity,
+    control.recovery_service_vault_uses_private_link,
+    control.recovery_service_vault_uses_private_link_for_backup
   ]
 
   tags = merge(local.all_controls_recoveryservice_common_tags, {

rbi_itf_nbfc_v2017/docs/rbi_itf_nbfc_v2017_overview.md

@@ -0,0 +1,42 @@
+## Overview
+
+# Overview of RBI ITF NBFC
+
+The Reserve Bank of India (RBI) introduced the Information Technology Framework (ITF) for Non-Banking Financial Companies (NBFCs) to enhance the IT governance and risk management practices in the NBFC sector. This framework aims to ensure that NBFCs adopt robust IT systems and controls to mitigate risks and safeguard sensitive financial information.
+
+## Key Components of the RBI ITF for NBFCs
+
+### Governance and Strategy
+
+- **IT Governance:** NBFCs must establish a formal IT governance framework that aligns with their overall corporate governance structure. This includes defining the roles and responsibilities of the board of directors, senior management, and IT function.
+- **IT Strategy:** NBFCs should develop a comprehensive IT strategy that supports their business objectives and ensures the effective use of technology in delivering financial services.
+
+### Risk Management
+
+- **IT Risk Management:** NBFCs must implement a robust IT risk management framework to identify, assess, and mitigate IT-related risks. This includes conducting regular risk assessments, implementing appropriate controls, and monitoring the effectiveness of these controls.
+- **Business Continuity Planning (BCP):** NBFCs should have a well-defined BCP to ensure the continuity of critical operations in the event of a disruption. This includes developing disaster recovery plans and conducting regular testing of these plans.
+
+### Information Security
+
+- **Data Protection:** NBFCs must implement strong data protection measures to safeguard sensitive customer information. This includes encryption, access controls, and regular security audits.
+- **Incident Management:** NBFCs should have an incident management framework to detect, respond to, and recover from security incidents. This includes establishing an incident response team and maintaining an incident log.
+
+### IT Operations
+
+- **IT Infrastructure:** NBFCs must maintain a reliable and scalable IT infrastructure to support their operations. This includes ensuring the availability, performance, and security of IT systems.
+- **Change Management:** NBFCs should have a formal change management process to manage changes to IT systems and applications. This includes documenting changes, conducting impact assessments, and obtaining necessary approvals.
+
+### Compliance and Reporting
+
+- **Regulatory Compliance:** NBFCs must ensure compliance with relevant regulations and guidelines issued by the RBI and other regulatory bodies. This includes maintaining up-to-date records and submitting required reports to the RBI.
+- **Audit and Assurance:** NBFCs should conduct regular IT audits to assess the effectiveness of their IT controls and identify areas for improvement. This includes engaging external auditors to provide an independent assessment of IT systems and processes.
+
+## Benefits of Implementing RBI ITF for NBFCs
+
+- **Enhanced Security:** Implementing the ITF helps NBFCs strengthen their information security practices and protect sensitive customer data.
+- **Improved Risk Management:** A robust IT risk management framework enables NBFCs to proactively identify and mitigate IT-related risks.
+- **Operational Resilience:** Business continuity planning and disaster recovery measures ensure that NBFCs can maintain critical operations during disruptions.
+- **Regulatory Compliance:** Adhering to the ITF ensures that NBFCs comply with RBI regulations and guidelines, reducing the risk of regulatory penalties.
+- **Increased Customer Trust:** Implementing strong IT governance and risk management practices enhances customer confidence in the NBFC's ability to safeguard their financial information.
+
+By adhering to the RBI ITF, NBFCs can build a secure and resilient IT environment that supports their business objectives and ensures the protection of sensitive financial information.

rbi_itf_nbfc_v2017/rbi_itf_nbfc.sp

@@ -0,0 +1,21 @@
+locals {
+  rbi_itf_nbfc_v2017_common_tags = merge(local.azure_compliance_common_tags, {
+    rbi_itf_nbfc_v2017 = "true"
+    type               = "Benchmark"
+  })
+}
+
+benchmark "rbi_itf_nbfc_v2017" {
+  title         = "Reserve Bank of India - IT Framework for NBFC Regulatory Compliance"
+  documentation = file("./rbi_itf_nbfc_v2017/docs/rbi_itf_nbfc_v2017_overview.md")
+
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_business_continuity_planning,
+    benchmark.rbi_itf_nbfc_v2017_is_audit,
+    benchmark.rbi_itf_nbfc_v2017_it_governance,
+    benchmark.rbi_itf_nbfc_v2017_it_information_and_cyber_security,
+    benchmark.rbi_itf_nbfc_v2017_it_operations
+  ]
+
+  tags = local.rbi_itf_nbfc_v2017_common_tags
+}

rbi_itf_nbfc_v2017/rbi_itf_nbfc_business_continuity_planning.sp

@@ -0,0 +1,56 @@
+benchmark "rbi_itf_nbfc_v2017_business_continuity_planning" {
+  title = "Business Continuity Planning"
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_business_continuity_planning_6
+  ]
+
+  tags = local.rbi_itf_nbfc_v2017_common_tags
+}
+
+benchmark "rbi_itf_nbfc_v2017_business_continuity_planning_6" {
+  title = "Business Continuity Planning (BCP) and Disaster Recovery-6"
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_business_continuity_planning_6_2,
+    benchmark.rbi_itf_nbfc_v2017_business_continuity_planning_6_3,
+    benchmark.rbi_itf_nbfc_v2017_business_continuity_planning_6_4,
+    control.compute_vm_disaster_recovery_enabled,
+    control.mariadb_server_geo_redundant_backup_enabled,
+    control.mysql_db_server_geo_redundant_backup_enabled,
+    control.postgres_db_server_geo_redundant_backup_enabled,
+    control.recovery_service_vault_uses_private_link,
+    control.recovery_service_vault_uses_private_link_for_backup,
+    control.sql_database_long_term_geo_redundant_backup_enabled
+  ]
+}
+
+benchmark "rbi_itf_nbfc_v2017_business_continuity_planning_6_2" {
+  title = "Recovery strategy / Contingency Plan-6.2"
+  children = [
+    control.compute_vm_disaster_recovery_enabled,
+    control.mariadb_server_geo_redundant_backup_enabled,
+    control.mysql_db_server_geo_redundant_backup_enabled,
+    control.postgres_db_server_geo_redundant_backup_enabled,
+    control.recovery_service_vault_uses_private_link_for_backup,
+    control.sql_database_long_term_geo_redundant_backup_enabled
+  ]
+}
+
+benchmark "rbi_itf_nbfc_v2017_business_continuity_planning_6_3" {
+  title = "Recovery strategy / Contingency Plan-6.3"
+  children = [
+    control.mariadb_server_geo_redundant_backup_enabled,
+    control.mysql_db_server_geo_redundant_backup_enabled,
+    control.postgres_db_server_geo_redundant_backup_enabled,
+    control.recovery_service_vault_uses_private_link_for_backup,
+    control.sql_database_long_term_geo_redundant_backup_enabled
+  ]
+}
+
+benchmark "rbi_itf_nbfc_v2017_business_continuity_planning_6_4" {
+  title = "Recovery strategy / Contingency Plan-6.4"
+  children = [
+    control.compute_vm_disaster_recovery_enabled,
+    control.recovery_service_vault_uses_private_link,
+    control.recovery_service_vault_uses_private_link_for_backup
+  ]
+}

rbi_itf_nbfc_v2017/rbi_itf_nbfc_is_audit.sp

@@ -0,0 +1,33 @@
+benchmark "rbi_itf_nbfc_v2017_is_audit" {
+  title = "IS Audit"
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_is_audit_5
+  ]
+
+  tags = local.rbi_itf_nbfc_v2017_common_tags
+}
+
+benchmark "rbi_itf_nbfc_v2017_is_audit_5" {
+  title = "Policy for Information System Audit (IS Audit)-5"
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_is_audit_5_2,
+    control.application_gateway_waf_enabled,
+    control.compute_vm_remote_access_restricted_all_ports,
+    control.compute_vm_tcp_udp_access_restricted_internet,
+    control.cosmosdb_account_with_firewall_rules,
+    control.frontdoor_waf_enabled,
+    control.network_interface_ip_forwarding_disabled,
+    control.network_security_group_subnet_associated,
+    control.network_sg_flowlog_enabled,
+    control.network_watcher_flow_log_enabled
+  ]
+}
+
+benchmark "rbi_itf_nbfc_v2017_is_audit_5_2" {
+  title = "Policy for Information System Audit (IS Audit)-5.2"
+  children = [
+    control.mariadb_server_geo_redundant_backup_enabled,
+    control.mysql_db_server_geo_redundant_backup_enabled,
+    control.postgres_db_server_geo_redundant_backup_enabled
+  ]
+}

rbi_itf_nbfc_v2017/rbi_itf_nbfc_it_governance.sp

@@ -0,0 +1,33 @@
+benchmark "rbi_itf_nbfc_v2017_it_governance" {
+  title = "IT Governance"
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_it_governance_1
+  ]
+
+  tags = local.rbi_itf_nbfc_v2017_common_tags
+}
+
+benchmark "rbi_itf_nbfc_v2017_it_governance_1" {
+  title = "IT Governance-1"
+  children = [
+    benchmark.rbi_itf_nbfc_v2017_it_governance_1_1,
+    control.compute_vm_system_updates_installed,
+    control.compute_vm_vulnerability_assessment_solution_enabled,
+    control.kubernetes_cluster_upgraded_with_non_vulnerable_version,
+    control.mssql_managed_instance_vulnerability_assessment_enabled,
+    control.securitycenter_email_configured,
+    control.securitycenter_notify_alerts_configured,
+    control.securitycenter_security_alerts_to_owner_enabled,
+    control.sql_database_vulnerability_findings_resolved,
+    control.sql_server_and_databases_va_enabled
+  ]
+}
+
+benchmark "rbi_itf_nbfc_v2017_it_governance_1_1" {
+  title = "IT Governance-1.1"
+  children = [
+    control.compute_vm_jit_access_protected,
+    control.network_interface_ip_forwarding_disabled,
+    control.network_security_group_remote_access_restricted
+  ]
+}