tools-only Compliance Matrix: static-webapp-test
Generated: December 17, 2025 Environment: Development Compliance Framework: Azure Security Baseline (internal tool - no regulatory requirements)
Executive Summary
This compliance matrix maps the static-webapp-test security controls to Azure Security Baseline requirements.
| Compliance Area | Coverage | Status |
|---|---|---|
| Network Security | 50% | Partial |
| Data Protection | 80% | Implemented |
| Access Control | 100% | Implemented |
| Monitoring & Audit | 85% | Implemented |
| Incident Response | 70% | Partial |
| Overall | 69% | Partial |
1. Control Mapping
Framework Summary
| Framework | Required | Status | Notes |
|---|---|---|---|
| HIPAA | ❌ | N/A | Not handling PHI |
| PCI-DSS | ❌ | N/A | No payment data |
| GDPR | ❌ | N/A | Internal tool, no PII |
| SOC 2 | ❌ | N/A | Not required |
| Azure Security Baseline | ✅ | Implemented | Best practices applied |
Identity Management
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| IM-1 | Use centralized identity | ✅ | Azure AD authentication |
| IM-2 | Protect identity and auth | ✅ | Azure AD with HTTPS |
| IM-3 | Manage app identities securely | ✅ | Managed identity for SQL access |
| IM-4 | Authenticate servers | ✅ | Azure AD-only SQL authentication |
Privileged Access
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| PA-1 | Protect privileged users | ✅ | RBAC on resource group |
| PA-2 | Avoid standing access | ⚠️ | Not implemented (dev env) |
| PA-7 | Follow just enough admin | ✅ | Scoped to resource group |
Data Protection
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| DP-1 | Discover and classify data | ⚠️ | Manual (low data volume) |
| DP-2 | Protect sensitive data | ✅ | No sensitive data stored |
| DP-3 | Encrypt sensitive data transit | ✅ | TLS 1.2 enforced |
| DP-4 | Encrypt sensitive data at rest | ✅ | Azure-managed encryption |
| DP-5 | Use customer-managed keys | ❌ | Not required (internal tool) |
Asset Management
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| AM-1 | Track asset inventory | ✅ | Azure Resource Graph |
| AM-2 | Use approved services only | ✅ | PaaS services only |
| AM-3 | Ensure security of lifecycle | ✅ | IaC (Bicep) managed |
Logging and Monitoring
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| LT-1 | Enable threat detection | ⚠️ | Basic (no Defender for Cloud) |
| LT-2 | Enable identity audit logging | ✅ | Azure AD sign-in logs |
| LT-3 | Enable logging for security | ✅ | Application Insights |
| LT-4 | Enable network logging | ⚠️ | Limited (no VNet) |
| LT-5 | Centralize security log mgmt | ✅ | Log Analytics workspace |
| LT-6 | Configure log storage retention | ✅ | 30-day retention |
Backup and Recovery
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| BR-1 | Ensure regular automated backup | ✅ | SQL automated backup (7 days) |
| BR-2 | Protect backup and recovery | ✅ | Azure-managed, role-protected |
| BR-3 | Monitor backups | ✅ | Azure Monitor |
Network Security
| Control ID | Control | Status | Implementation |
|---|---|---|---|
| NS-1 | Implement network segmentation | ❌ | PaaS-only, no VNet |
| NS-2 | Connect networks with VPN | N/A | Not applicable |
| NS-3 | Deploy firewall | ⚠️ | SQL firewall only |
| NS-4 | Deploy intrusion detection | ❌ | Not implemented (budget) |
| NS-5 | Deploy DDoS protection | ⚠️ | Basic DDoS (Azure default) |
Security Controls Summary
| Category | Implemented | Partial | Not Implemented | N/A |
|---|---|---|---|---|
| Identity | 4 | 0 | 0 | 0 |
| Privileged Access | 2 | 1 | 0 | 0 |
| Data Protection | 4 | 1 | 0 | 0 |
| Asset Management | 3 | 0 | 0 | 0 |
| Logging | 4 | 2 | 0 | 0 |
| Backup | 3 | 0 | 0 | 0 |
| Network | 0 | 3 | 1 | 1 |
| Total | 20 | 7 | 1 | 1 |
Overall Compliance: 69% Fully Implemented, 24% Partial, 3% Not Implemented
2. Gap Analysis
The following controls are intentionally not implemented due to cost/complexity trade-offs for this internal development tool:
| Control | Risk | Mitigation |
|---|---|---|
| Private endpoints | Public SQL endpoint | Firewall, Azure AD auth |
| WAF | No WAF | SWA built-in protections |
| DDoS Protection | Basic DDoS only | Acceptable for internal |
| Network segment | No VNet isolation | Service firewalls |
Risk Owner: DevOps Team Review Date: Quarterly or upon scope change
3. Evidence Collection
| Control | Evidence Type | Location | Last Collected |
|---|---|---|---|
| IM-1 | Configuration | Azure AD tenant | Automated |
| DP-3 | Configuration | TLS settings | Automated |
| LT-5 | Logs | Log Analytics workspace | Continuous |
| BR-1 | Backup status | SQL automated backup | Daily |
4. Audit Trail
| Date | Auditor | Finding | Status |
|---|---|---|---|
| 2025-12-17 | Copilot Agent | Initial assessment completed | Documented |
5. Remediation Tracker
| Finding | Owner | Due Date | Status |
|---|---|---|---|
| Private endpoints | DevOps Team | Production | Deferred |
| WAF protection | DevOps Team | Production | Deferred |
| DDoS Protection | DevOps Team | Production | Deferred |
6. Appendix
A. Recommendations for Production
If this workload moves to production or handles sensitive data:
- ✅ Upgrade SQL to private endpoint
- ✅ Enable Microsoft Defender for Cloud
- ✅ Implement customer-managed keys
- ✅ Add WAF via Front Door
- ✅ Extend log retention to 90+ days