Yandex Cloud basic security rules

Requirement ID

Security standard requirement

Check ID in the CSPM module

Authentication and access management (IAM)

IAM1

An identity federation (Single Sign-On, SSO) is configured

cspm.access.idp

IAM5

Only appropriate administrators can manage IAM group membership

cspm.access.user-groups-access

IAM17

Two-factor authentication for privileged accounts is in place.

cspm.access.userpool-mfa

IAM22

There is no public access to resources within the organization

cspm.access.public-access

Network security (NET)

NET3

Security groups have no access rule that is too broad

cspm.network.network-firewall-scope

Secure virtual environment configuration (ENV)

ENV1

A serial console is either used under control or not used

cspm.access.serial-console

Data encryption and key management (CRYPT)

CRYPT9

KMS keys are stored in a hardware security module (HSM)

cspm.crypto.keys-hsm

CRYPT13

The organization uses Yandex Lockbox for secure secret storage

cspm.crypto.secrets-lockbox

CRYPT14

For Yandex Serverless Containers and Yandex Cloud Functions, Yandex Lockbox secrets are used

cspm.crypto.secrets-serverless

CRYPT16

Cloud administrator is instructed what to do if cloud secrets get compromised

cspm.crypto.leaked-secrets-detection

Collecting, monitoring, and analyzing audit logs (AUDIT)

AUDIT1

Yandex Audit Trails is enabled at the organization level

cspm.o11y.audit-trails

AUDIT8

Data events are monitored

cspm.o11y.data-plane-events

Application security (APPSEC)

APPSEC1

Yandex SmartCaptcha is used

cspm.appsec.use-smartcaptcha

APPSEC2

Docker images are scanned when uploaded to Yandex Container Registry

cspm.appsec.secure-registry

APPSEC3

Docker images stored in Container Registry are regularly scanned

cspm.appsec.periodic-scan

APPSEC9

A Yandex Smart Web Security profile is used

cspm.appsec.use-sws

APPSEC10

A web application firewall is used

cspm.appsec.use-waf

APPSEC11

Advanced Rate Limiter is used

cspm.appsec.use-arl

Kubernetes security (K8S)

K8S11

A Kubernetes security policy is used

cspm.k8s.kspm