{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["Dashboard","Checklist","Values"],"not_rendered":{"charts":8,"images":1,"macros":1,"external_links":0,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Dashboard","index":0,"n_rows":55,"n_cols":21,"rows_kept":55,"cut":false,"hidden":false,"merged":[]}
[null,null,null,"Reviewed Items","Open Items"]
["Review Status",null,null,{"$f":"IF($T$29=0,0,1-$Q$29/$T$29)","v":0},{"$f":"IF(T29=0,0,R29/T29)","v":0}]
[]
[]
[null,{"$f":"Values!$B$2","v":"Not verified"},{"$f":"Values!$B$3","v":"Open"},{"$f":"Values!$B$4","v":"Fulfilled"},{"$f":"Values!$B$5","v":"Not required"},{"$f":"Values!$B$6","v":"N/A"},null,null,null,{"$f":"Values!$B$2","v":"Not verified"},{"$f":"Values!$B$3","v":"Open"},{"$f":"Values!$B$4","v":"Fulfilled"},{"$f":"Values!$B$5","v":"Not required"},{"$f":"Values!$B$6","v":"N/A"},"Total"]
[{"$f":"Values!A2","v":"High"},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A6)*--(Checklist!$F$10:$F$487=B$5))","v":19},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A6)*--(Checklist!$F$10:$F$487=C$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A6)*--(Checklist!$F$10:$F$487=D$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A6)*--(Checklist!$F$10:$F$487=E$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A6)*--(Checklist!$F$10:$F$487=F$5))","v":0},{"$f":"SUM(B6:F6)","v":19},null,{"$f":"IF(Values!$C2=\"\",\"\",Values!$C2)","v":"Identity and Access"},{"$f":"IF($I6=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I6)*--(Checklist!$F$10:$F$487=J$5)))","v":15},{"$f":"IF($I6=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I6)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I6=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I6)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I6=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I6)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I6=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I6)*--(Checklist!$F$10:$F$487=N$5)))","v":0},{"$f":"IF($I6=\"\",\"\",SUM(J6:N6))","v":15}]
[{"$f":"Values!A3","v":"Medium"},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A7)*--(Checklist!$F$10:$F$487=B$5))","v":162},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A7)*--(Checklist!$F$10:$F$487=C$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A7)*--(Checklist!$F$10:$F$487=D$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A7)*--(Checklist!$F$10:$F$487=E$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A7)*--(Checklist!$F$10:$F$487=F$5))","v":0},{"$f":"SUM(B7:F7)","v":162},null,{"$f":"IF(Values!$C3=\"\",\"\",Values!$C3)","v":"Network Topology and Connectivity"},{"$f":"IF($I7=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I7)*--(Checklist!$F$10:$F$487=J$5)))","v":88},{"$f":"IF($I7=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I7)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I7=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I7)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I7=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I7)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I7=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I7)*--(Checklist!$F$10:$F$487=N$5)))","v":0},{"$f":"IF($I7=\"\",\"\",SUM(J7:N7))","v":88}]
[{"$f":"Values!A4","v":"Low"},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A8)*--(Checklist!$F$10:$F$487=B$5))","v":7},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A8)*--(Checklist!$F$10:$F$487=C$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A8)*--(Checklist!$F$10:$F$487=D$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A8)*--(Checklist!$F$10:$F$487=E$5))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$E$10:$H$487=$A8)*--(Checklist!$F$10:$F$487=F$5))","v":0},{"$f":"SUM(B8:F8)","v":7},null,{"$f":"IF(Values!$C4=\"\",\"\",Values!$C4)","v":"Security, Governance and Compliance"},{"$f":"IF($I8=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I8)*--(Checklist!$F$10:$F$487=J$5)))","v":44},{"$f":"IF($I8=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I8)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I8=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I8)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I8=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I8)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I8=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I8)*--(Checklist!$F$10:$F$487=N$5)))","v":0},44]
[null,{"$f":"SUM(B6:B8)","v":188},0,0,0,0,188,null,{"$f":"IF(Values!$C5=\"\",\"\",Values!$C5)","v":"Management and Monitoring"},{"$f":"IF($I9=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I9)*--(Checklist!$F$10:$F$487=J$5)))","v":22},{"$f":"IF($I9=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I9)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I9=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I9)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I9=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I9)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I9=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I9)*--(Checklist!$F$10:$F$487=N$5)))","v":0},22]
[null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C6=\"\",\"\",Values!$C6)","v":"Management Group and Subscriptions"},{"$f":"IF($I10=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I10)*--(Checklist!$F$10:$F$487=J$5)))","v":16},{"$f":"IF($I10=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I10)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I10=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I10)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I10=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I10)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I10=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I10)*--(Checklist!$F$10:$F$487=N$5)))","v":0},16]
[null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C7=\"\",\"\",Values!$C7)","v":"Operations"},{"$f":"IF($I11=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I11)*--(Checklist!$F$10:$F$487=J$5)))","v":3},{"$f":"IF($I11=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I11)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I11=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I11)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I11=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I11)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I11=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I11)*--(Checklist!$F$10:$F$487=N$5)))","v":0},3]
[null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C8=\"\",\"\",Values!$C8)","v":"Application Deployment"},{"$f":"IF($I12=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I12)*--(Checklist!$F$10:$F$487=J$5)))","v":0},{"$f":"IF($I12=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I12)*--(Checklist!$F$10:$F$487=K$5)))","v":0},{"$f":"IF($I12=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I12)*--(Checklist!$F$10:$F$487=L$5)))","v":0},{"$f":"IF($I12=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I12)*--(Checklist!$F$10:$F$487=M$5)))","v":0},{"$f":"IF($I12=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I12)*--(Checklist!$F$10:$F$487=N$5)))","v":0},0]
[null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C9=\"\",\"\",Values!$C9)","v":""},{"$f":"IF($I13=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I13)*--(Checklist!$F$10:$F$487=J$5)))","v":""},{"$f":"IF($I13=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I13)*--(Checklist!$F$10:$F$487=K$5)))","v":""},{"$f":"IF($I13=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I13)*--(Checklist!$F$10:$F$487=L$5)))","v":""},{"$f":"IF($I13=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I13)*--(Checklist!$F$10:$F$487=M$5)))","v":""},{"$f":"IF($I13=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$I13)*--(Checklist!$F$10:$F$487=N$5)))","v":""},""]
[null,null,null,null,null,null,null,null,null,{"$f":"SUM(J6:J13)","v":188},{"$f":"SUM(K6:K13)","v":0},{"$f":"SUM(L6:L13)","v":0},{"$f":"SUM(M6:M13)","v":0},{"$f":"SUM(N6:N13)","v":0},{"$f":"SUM(O6:O13)","v":188}]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Category",{"$f":"Values!$B$2","v":"Not verified"},{"$f":"Values!$B$3","v":"Open"},"Closed","Total","Progress"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C2=\"\",\"\",Values!$C2)","v":"Identity and Access"},{"$f":"IF($P21=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P21)*--(Checklist!$F$10:$F$487=Q$20)))","v":15},{"$f":"IF($P21=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P21)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P21=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P21)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},{"$f":"IF($P21=\"\",\"\",SUM(Q21:S21))","v":15},{"$f":"IF($P21=\"\",\"\",S21/T21)","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C3=\"\",\"\",Values!$C3)","v":"Network Topology and Connectivity"},{"$f":"IF($P22=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P22)*--(Checklist!$F$10:$F$487=Q$20)))","v":88},{"$f":"IF($P22=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P22)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P22=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P22)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},{"$f":"IF($P22=\"\",\"\",SUM(Q22:S22))","v":88},{"$f":"IF($P22=\"\",\"\",S22/T22)","v":0}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C4=\"\",\"\",Values!$C4)","v":"Security, Governance and Compliance"},{"$f":"IF($P23=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P23)*--(Checklist!$F$10:$F$487=Q$20)))","v":44},{"$f":"IF($P23=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P23)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P23=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P23)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},44,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C5=\"\",\"\",Values!$C5)","v":"Management and Monitoring"},{"$f":"IF($P24=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P24)*--(Checklist!$F$10:$F$487=Q$20)))","v":22},{"$f":"IF($P24=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P24)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P24=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P24)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},22,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C6=\"\",\"\",Values!$C6)","v":"Management Group and Subscriptions"},{"$f":"IF($P25=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P25)*--(Checklist!$F$10:$F$487=Q$20)))","v":16},{"$f":"IF($P25=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P25)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P25=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P25)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},16,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C7=\"\",\"\",Values!$C7)","v":"Operations"},{"$f":"IF($P26=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P26)*--(Checklist!$F$10:$F$487=Q$20)))","v":3},{"$f":"IF($P26=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P26)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P26=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P26)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},3,0]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C8=\"\",\"\",Values!$C8)","v":"Application Deployment"},{"$f":"IF($P27=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P27)*--(Checklist!$F$10:$F$487=Q$20)))","v":0},{"$f":"IF($P27=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P27)*--(Checklist!$F$10:$F$487=R$20)))","v":0},{"$f":"IF($P27=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P27)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":0},0,{"$error":"#DIV/0!"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Values!$C9=\"\",\"\",Values!$C9)","v":""},{"$f":"IF($P28=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P28)*--(Checklist!$F$10:$F$487=Q$20)))","v":""},{"$f":"IF($P28=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P28)*--(Checklist!$F$10:$F$487=R$20)))","v":""},{"$f":"IF($P28=\"\",\"\",SUMPRODUCT(--(Checklist!$A$10:$A$487=$P28)*(--(Checklist!$F$10:$F$487=Values!$B$4)+--(Checklist!$F$10:$F$487=Values!$B$5)+--(Checklist!$F$10:$F$487=Values!$B$6))))","v":""},{"$f":"IF($P28=\"\",\"\",SUM(Q28:S28))","v":""},{"$f":"IF($P28=\"\",\"\",S28/T28)","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUM(Q21:Q28)","v":188},{"$f":"SUM(R21:R28)","v":0},{"$f":"SUM(S21:S28)","v":0},{"$f":"SUM(T21:T28)","v":188},{"$f":"IF(T29=0,0,S29/T29)","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["Max score only Fulfilled/NotRequired/Open"]
[null,"Min (F/NR/O)","Max (F/NR/O)","F+O","Progress"]
["Secure",{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$L$10:$L$299,--(Checklist!$L$10:$L$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$L$10:$L$299,--(Checklist!$L$10:$L$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$L$10:$L$299,--(Checklist!$L$10:$L$299<0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$L$10:$L$299,--(Checklist!$L$10:$L$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$L$10:$L$299,--(Checklist!$L$10:$L$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$L$10:$L$299,--(Checklist!$L$10:$L$299>0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$L$10:$L$299)+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$L$10:$L$299)","v":0},{"$f":"IF((C51-B51)=0,1,(D51-B51)/(C51-B51))","v":1}]
["Cost-efficient",{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$M$10:$M$299,--(Checklist!$M$10:$M$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$M$10:$M$299,--(Checklist!$M$10:$M$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$M$10:$M$299,--(Checklist!$M$10:$M$299<0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$M$10:$M$299,--(Checklist!$M$10:$M$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$M$10:$M$299,--(Checklist!$M$10:$M$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$M$10:$M$299,--(Checklist!$M$10:$M$299>0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$M$10:$M$299)+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$M$10:$M$299)","v":0},{"$f":"IF((C52-B52)=0,1,(D52-B52)/(C52-B52))","v":1}]
["Scalable",{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$N$10:$N$299,--(Checklist!$N$10:$N$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$N$10:$N$299,--(Checklist!$N$10:$N$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$N$10:$N$299,--(Checklist!$N$10:$N$299<0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$N$10:$N$299,--(Checklist!$N$10:$N$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$N$10:$N$299,--(Checklist!$N$10:$N$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$N$10:$N$299,--(Checklist!$N$10:$N$299>0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$N$10:$N$299)+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$N$10:$N$299)","v":0},1]
["Simple",{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$O$10:$O$299,--(Checklist!$O$10:$O$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$O$10:$O$299,--(Checklist!$O$10:$O$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$O$10:$O$299,--(Checklist!$O$10:$O$299<0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$O$10:$O$299,--(Checklist!$O$10:$O$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$O$10:$O$299,--(Checklist!$O$10:$O$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$O$10:$O$299,--(Checklist!$O$10:$O$299>0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$O$10:$O$299)+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$O$10:$O$299)","v":0},1]
["Highly available",{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$P$10:$P$299,--(Checklist!$P$10:$P$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$P$10:$P$299,--(Checklist!$P$10:$P$299<0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$P$10:$P$299,--(Checklist!$P$10:$P$299<0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$P$10:$P$299,--(Checklist!$P$10:$P$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$6),Checklist!$P$10:$P$299,--(Checklist!$P$10:$P$299>0))+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$P$10:$P$299,--(Checklist!$P$10:$P$299>0))","v":0},{"$f":"SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$4),Checklist!$P$10:$P$299)+SUMPRODUCT(--(Checklist!$F$10:$F$299=Values!$B$3),Checklist!$P$10:$P$299)","v":0},1]

{"sheet":"Checklist","index":1,"n_rows":197,"n_cols":16,"rows_kept":197,"cut":false,"hidden":false,"merged":[[1,0,1,1]]}
[]
[null,null,"FastTrack for Azure\nAzure Review Checklist",null,"Landing Zone","English","ç\nSelect a technology\nand a language\nç"]
[]
[null,null,null,null,{"$f":"Values!B2","v":"Not verified"},{"$f":"Values!H2","v":"This check has not been looked at yet"}]
[null,null,null,null,{"$f":"Values!B3","v":"Open"},{"$f":"Values!H3","v":"There is an action item associated to this check"}]
["Azure Landing Zone Review",null,null,null,{"$f":"Values!B4","v":"Fulfilled"},{"$f":"Values!H4","v":"This check has been verified, and there are no further action items associated to it"}]
[null,null,null,null,{"$f":"Values!B5","v":"Not required"},{"$f":"Values!H5","v":"Recommendation understood, but not needed by current requirements"}]
[null,null,null,null,{"$f":"Values!B6","v":"N/A"},{"$f":"Values!H6","v":"Not applicable for current design"},null,null,null,null,null,{"$f":"Dashboard!$E$51","v":1},{"$f":"Dashboard!$E$52","v":1},{"$f":"Dashboard!$E$53","v":1},{"$f":"Dashboard!$E$54","v":1},{"$f":"Dashboard!$E$55","v":1}]
["Main Area","Sub Area","Checklist item","Description (optional)","Severity","Status","Comment","More info","Training","Graph Query","GUID","Secure","Cost","Scale","Simple","HA"]
["Identity and Access","Identity","Implement for emergency access or break-glass accounts to prevent tenant-wide account lockout",null,"High","Not verified",null,"More info","Training",null,"984a859c-773e-47d2-9162-3a765a917e1f"]
["Identity and Access","Identity","Enforce a RBAC model for management groups, subscriptions, resource groups and resources",null,"High","Not verified",null,"More info","Training",null,"348ef254-c27d-442e-abba-c7571559ab91"]
["Identity and Access","Identity","Enforce Azure AD conditional-access policies for any user with rights to Azure environments",null,"Low","Not verified",null,"More info","Training",null,"53e8908a-e28c-484c-93b6-b7808b9fe5c4"]
["Identity and Access","Identity","Enforce multi-factor authentication for any user with rights to the Azure environments",null,"High","Not verified",null,"More info","Training",null,"1049d403-a923-4c34-94d0-0018ac6a9e01"]
["Identity and Access","Identity","Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone based on role and security requirements",null,"Medium","Not verified",null,"More info","Training",null,"e6a83de5-de32-4c19-a248-1607d5d1e4e6"]
["Identity and Access","Identity","Enforce Azure AD Privileged Identity Management (PIM) to establish zero standing access and least privilege",null,"Medium","Not verified",null,"More info","Training",null,"14658d35-58fd-4772-99b8-21112df27ee4"]
["Identity and Access","Identity","Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",null,"High","Not verified",null,"More info","Training",null,"12e7f983-f630-4472-8dd6-9c5b5c2622f5"]
["Identity and Access","Identity","Only use groups to assign permissions. Add on-premises groups to the Azure-AD-only group if a group management system is already in place.",null,"Medium","Not verified",null,"More info","Training",null,"4b69bad3-3aad-45e8-a68e-1d76667313b4"]
["Identity and Access","Identity","Consider using Azure custom roles for the following key roles: Azure platform owner, network management, security operations, subscription owner, application owner",null,"Medium","Not verified",null,"More info","Training",null,"f5664b5e-984a-4859-a773-e7d261623a76"]
["Identity and Access","Identity","If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them",null,"Medium","Not verified",null,"More info","Training",null,"5a917e1f-348e-4f25-9c27-d42e8bbac757"]
["Identity and Access","Identity","If Azure Active Directory Domains Services (AADDS) is in use, deploy AADDS within the primary region because this service can only be projected into one subscription",null,"Medium","Not verified",null,"More info","Training",null,"1559ab91-53e8-4908-ae28-c84c33b6b780"]
["Identity and Access","Identity","If AADDS in use, evaluate the compatibility of all workloads",null,"Medium","Not verified",null,"More info","Training",null,"8b9fe5c4-1049-4d40-9a92-3c3474d00018"]
["Identity and Access","Identity","If AD on Windows server in use, can all required resources access correct domain controller?",null,"Medium","Not verified",null,"More info","Training",null,"ac6a9e01-e6a8-43de-9de3-2c1992481607"]
["Identity and Access","Identity","Consider using Azure AD Application Proxy as a VPN or reverse proxy replacement to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).",null,"Medium","Not verified",null,"More info","Training",null,"d5d1e4e6-1465-48d3-958f-d77249b82111"]
["Identity and Access","Identity","Avoid using on-premises synced accounts for Azure AD role assignments.",null,"Medium","Not verified",null,"More info","Training",null,"35037e68-9349-4c15-b371-228514f4cdff"]
["Management Group and Subscriptions","Subscriptions","Enforce reasonably flat management group hierarchy with no more than three to four levels, ideally",null,"Medium","Not verified",null,"More info","Training","resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) < 4 and array_length(mgmtChain) > 1)","2df27ee4-12e7-4f98-9f63-04722dd69c5b"]
["Management Group and Subscriptions","Subscriptions","Enforce or appended resource tags through Azure Policy",null,"Medium","Not verified",null,"More info","Training","resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant","5c2622f5-4b69-4bad-93aa-d5e8c68e1d76"]
["Management Group and Subscriptions","Subscriptions","Enforce a sandbox management group to allow users to immediately experiment with Azure",null,"Medium","Not verified",null,"More info","Training",null,"667313b4-f566-44b5-b984-a859c773e7d2"]
["Management Group and Subscriptions","Subscriptions","Enforce a platform management group under the root management group to support common platform policy and Azure role assignment",null,"Medium","Not verified",null,"More info","Training",null,"61623a76-5a91-47e1-b348-ef254c27d42e"]
["Management Group and Subscriptions","Subscriptions","Enforce a dedicated connectivity subscription in the Platform management group to host an Azure Virtual WAN hub, private Domain Name System (DNS), ExpressRoute circuit, and other networking resources.",null,"Medium","Not verified",null,"More info","Training",null,"8bbac757-1559-4ab9-853e-8908ae28c84c"]
["Management Group and Subscriptions","Subscriptions","Enforce no subscriptions are placed under the root management group",null,"Medium","Not verified",null,"More info",null,"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)","33b6b780-8b9f-4e5c-9104-9d403a923c34"]
["Management Group and Subscriptions","Subscriptions","Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings",null,"Medium","Not verified",null,"More info",null,null,"74d00018-ac6a-49e0-8e6a-83de5de32c19"]
["Management Group and Subscriptions","Subscriptions","Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.",null,"Medium","Not verified",null,"More info",null,null,"92481607-d5d1-4e4e-9146-58d3558fd772"]
["Management Group and Subscriptions","Subscriptions","Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.",null,"High","Not verified",null,"More info",null,null,"49b82111-2df2-47ee-912e-7f983f630472"]
["Management Group and Subscriptions","Subscriptions","Ensure that all subscription owners and IT core team are aware of subscription resource limitations as part of workload design sessions.",null,"Medium","Not verified",null,"More info",null,null,"2dd69c5b-5c26-422f-94b6-9bad33aad5e8"]
["Management Group and Subscriptions","Subscriptions","Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions. Enforce the use of purchased Reserved Instance VM SKUs via Azure Policy.",null,"High","Not verified",null,"More info","Training",null,"c68e1d76-6673-413b-9f56-64b5e984a859"]
["Management Group and Subscriptions","Subscriptions","Enforce a dashboard, workbook, or manual process to monitor used capacity levels",null,"High","Not verified",null,"More info","Training",null,"c773e7d2-6162-43a7-95a9-17e1f348ef25"]
["Management Group and Subscriptions","Subscriptions","Ensure required services and features are available within the chosen deployment regions",null,"Medium","Not verified",null,"More info","Training",null,"4c27d42e-8bba-4c75-9155-9ab9153e8908"]
["Management Group and Subscriptions","Subscriptions","Enforce a process for cost management",null,"High","Not verified",null,"More info","Training",null,"ae28c84c-33b6-4b78-88b9-fe5c41049d40"]
["Management Group and Subscriptions","Subscriptions","If AD on Windows Server, establish a dedicated identity subscription in the Platform management group to host Windows Server Active Directory domain controllers",null,"Medium","Not verified",null,"More info","Training",null,"3a923c34-74d0-4001-aac6-a9e01e6a83de"]
["Management Group and Subscriptions","Subscriptions","Ensure tags are used for billing and cost management",null,"Medium","Not verified",null,"More info","Training","resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant","5de32c19-9248-4160-9d5d-1e4e614658d3"]
["Network Topology and Connectivity","IP plan","Ensure no overlapping IP address spaces across Azure regions and on-premises locations",null,"Medium","Not verified",null,"More info","Training",null,"558fd772-49b8-4211-82df-27ee412e7f98"]
["Network Topology and Connectivity","IP plan","Ensure to use IP addresses from the address allocation for private internets (RFC 1918).",null,"Medium","Not verified",null,"More info","Training","resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10(\\\\.(25[0-5]|2[0-4][0-9]|1[0-9]{1,2}|[0-9]{1,2})){3}|((172\\\\.(1[6-9]|2[0-9]|3[01]))|192\\\\.168)(\\\\.(25[0-5]|2[0-4][0-9]|1[0-9]{1,2}|[0-9]{1,2})){2})')  | project name, id, subscriptionId, resourceGroup, compliant, cidr","3f630472-2dd6-49c5-a5c2-622f54b69bad"]
["Network Topology and Connectivity","IP plan","Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16) ",null,"Medium","Not verified",null,"More info","Training","resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask >= 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant","33aad5e8-c68e-41d7-9667-313b4f5664b5"]
["Network Topology and Connectivity","IP plan","Ensure no public IP address range (CIDR block) for VNETs, especially if not owned by your organization",null,"Medium","Not verified",null,"More info","Training",null,"e984a859-c773-4e7d-8616-23a765a917e1"]
["Network Topology and Connectivity","IP plan","Avoid using overlapping IP address ranges for production and DR sites.",null,"Medium","Not verified",null,"More info","Training",null,"f348ef25-4c27-4d42-b8bb-ac7571559ab9"]
["Network Topology and Connectivity","IP plan","For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution. Create a delegated zone for name resolution (such as 'azure.contoso.com').",null,"Medium","Not verified",null,"More info","Training",null,"153e8908-ae28-4c84-a33b-6b7808b9fe5c"]
["Network Topology and Connectivity","IP plan","For environments where name resolution across Azure and on-premises is required, use existing DNS infrastructure (for example, Active Directory integrated DNS) deployed onto at least two virtual machines (VMs). Configure DNS settings in virtual networks to use those DNS servers.",null,"Medium","Not verified",null,"More info","Training",null,"41049d40-3a92-43c3-974d-00018ac6a9e0"]
["Network Topology and Connectivity","IP plan","Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",null,"Medium","Not verified",null,"More info",null,null,"1e6a83de-5de3-42c1-a924-81607d5d1e4e"]
["Network Topology and Connectivity","IP plan","Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",null,"Medium","Not verified",null,"More info","Training",null,"614658d3-558f-4d77-849b-821112df27ee"]
["Network Topology and Connectivity","Virtual WAN","Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs",null,"Medium","Not verified",null,"More info","Training",null,"412e7f98-3f63-4047-82dd-69c5b5c2622f"]
["Network Topology and Connectivity","Virtual WAN","Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",null,"Medium","Not verified",null,"More info",null,null,"54b69bad-33aa-4d5e-ac68-e1d76667313b"]
["Network Topology and Connectivity","Virtual WAN","Use Virtual Hub Routing features to further segment traffic between VNets and branches.",null,"Medium","Not verified",null,"More info",null,null,"4f5664b5-e984-4a85-ac77-3e7d261623a7"]
["Network Topology and Connectivity","Virtual WAN","Connect Virtual WAN hubs to on-premises datacenters by using ExpressRoute",null,"Medium","Not verified",null,"More info","Training",null,"65a917e1-f348-4ef2-94c2-7d42e8bbac75"]
["Network Topology and Connectivity","Virtual WAN","Connect branches and remote locations to the nearest Virtual WAN hub via Site-to-Site VPN, or enable branch connectivity to Virtual WAN via an SD-WAN partner solution.",null,"Medium","Not verified",null,"More info","Training",null,"71559ab9-153e-4890-aae2-8c84c33b6b78"]
["Network Topology and Connectivity","Virtual WAN","Connect users to the Virtual WAN hub via a Point-to-Site VPN.",null,"Medium","Not verified",null,"More info","Training",null,"08b9fe5c-4104-49d4-83a9-23c3474d0001"]
["Network Topology and Connectivity","Virtual WAN","Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network",null,"Medium","Not verified",null,"More info",null,null,"8ac6a9e0-1e6a-483d-b5de-32c199248160"]
["Network Topology and Connectivity","Virtual WAN","For outbound Internet traffic protection and filtering, deploy Azure Firewall",null,"Medium","Not verified",null,"More info","Training",null,"7d5d1e4e-6146-458d-9558-fd77249b8211"]
["Network Topology and Connectivity","Virtual WAN","When deploying partner networking technologies and NVAs in VWAN, verify configuration with partner vendor's guidance to ensure there are no conflicting configurations",null,"Medium","Not verified",null,"More info",null,null,"12df27ee-412e-47f9-a3f6-304722dd69c5"]
["Network Topology and Connectivity","Virtual WAN","Ensure that Azure Virtual WAN and Azure Firewall resources are created in the connectivity subscription.",null,"Medium","Not verified",null,"More info",null,null,"b5c2622f-54b6-49ba-b33a-ad5e8c68e1d7"]
["Network Topology and Connectivity","Virtual WAN","Ensure that the network architecture is within the Azure Virtual WAN limits.",null,"Medium","Not verified",null,"More info",null,null,"6667313b-4f56-464b-9e98-4a859c773e7d"]
["Network Topology and Connectivity","Virtual WAN","Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",null,"Medium","Not verified",null,"More info",null,null,"261623a7-65a9-417e-8f34-8ef254c27d42"]
["Network Topology and Connectivity","Hub and spoke","Consider a network design based on the traditional hub-and-spoke network topology for the following scenarios: a network architecture deployed within a single Azure region; a network architecture spans multiple Azure regions with no need for transitive connectivity between virtual networks for landing zones across regions; a network architecture that spans multiple Azure regions with global VNet peering used to connect virtual networks across Azure regions; a network architecture with no need for transitive connectivity between VPN and ExpressRoute connections; the main hybrid connectivity method in place is ExpressRoute, and the number of VPN connections is less than 30 per VPN gateway; there's a dependency on centralized NVAs and granular routing.",null,"Medium","Not verified",null,"More info","Training",null,"e8bbac75-7155-49ab-a153-e8908ae28c84"]
["Network Topology and Connectivity","Hub and spoke","Ensure that shared services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy Active Directory domain controllers and DNS servers.",null,"Medium","Not verified",null,"More info",null,null,"7dd61623-a364-4a90-9eca-e48ebd54cd7d"]
["Network Topology and Connectivity","Hub and spoke","When deploying partner networking technologies or NVAs, follow the partner vendor's guidance",null,"Medium","Not verified",null,"More info",null,null,"e2e8abac-3571-4559-ab91-53e89f89dc7b"]
["Network Topology and Connectivity","Hub and spoke","Do not deploy inbound L7 services such as Azure Application Gateway as a shared service in the central-hub virtual network. Instead, deploy them together with the app in their respective landing zones.",null,"Medium","Not verified",null,"More info",null,null,"44ce3b1a-2808-4b9e-a1bf-1038df03a822"]
["Network Topology and Connectivity","Hub and spoke","If you need transit between ExpressRoute and VPN gateways, use Azure Route Server.",null,"Medium","Not verified",null,"More info",null,null,"ce463dbb-bc8a-4c2a-aebc-92a43da1dae2"]
["Network Topology and Connectivity","Hub and spoke","For network architectures with multiple hub-and-spoke topologies across Azure regions, use Global Virtual Network Peering to connect landing-zone virtual networks when a small number of landing zones need to communicate across regions. ",null,"Medium","Not verified",null,"More info","Training",null,"cc881471-607c-41cc-a0e6-14658dd558f9"]
["Network Topology and Connectivity","Hub and spoke","When you deploy a hub-and-spoke network architecture in two Azure regions and transit connectivity between all landing zones across regions is required, use ExpressRoute with dual circuits to provide transit connectivity for landing-zone virtual networks across Azure regions. ",null,"Medium","Not verified",null,"More info","Training",null,"37239b82-1112-4dbd-9eaf-12e6f943e53f"]
["Network Topology and Connectivity","Hub and spoke","Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",null,"Medium","Not verified",null,"More info","Training",null,"4722d929-c1b1-4cd6-81f5-4b29bade39ad"]
["Network Topology and Connectivity","Hub and spoke","When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits and the maximum number of prefixes that can be advertised via ExpressRoute",null,"Medium","Not verified",null,"More info",null,null,"0e7c28ec-9366-4572-83b0-f4664b1d944a"]
["Network Topology and Connectivity","Hybrid","Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.",null,"Medium","Not verified",null,"More info","Training",null,"359c373e-7dd6-4162-9a36-4a907ecae48e"]
["Network Topology and Connectivity","Hybrid","When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.",null,"Medium","Not verified",null,"More info","Training",null,"f29812b2-363c-4efe-879b-599de0d5973c"]
["Network Topology and Connectivity","Hybrid","Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",null,"Medium","Not verified",null,"More info","Training","resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant","d4cd21b0-8813-47f5-b6c4-cfd3e504547c"]
["Network Topology and Connectivity","Hybrid","Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",null,"Medium","Not verified",null,"More info","Training","resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant","2447ec66-138a-4720-8f1c-e16ed301d6e8"]
["Network Topology and Connectivity","Hybrid","For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",null,"Medium","Not verified",null,"More info","Training",null,"72e52e36-11cc-458b-9a4b-1511e43a58a9"]
["Network Topology and Connectivity","Hybrid","When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",null,"Medium","Not verified",null,"More info","Training",null,"c2299c4d-7b57-4d0c-9555-62f2b3e4563a"]
["Network Topology and Connectivity","Hybrid","Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available).",null,"Medium","Not verified",null,"More info","Training",null,"4d873974-8b66-42d6-b15f-512a65498f6d"]
["Network Topology and Connectivity","Hybrid","Use ExpressRoute Global Reach to connect large offices, regional headquarters, or datacenters connected to Azure via ExpressRoute.",null,"Medium","Not verified",null,"More info","Training",null,"fe237de1-43b1-46c3-8d7a-a9b64704489a"]
["Network Topology and Connectivity","Hybrid","When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",null,"Medium","Not verified",null,"More info","Training",null,"8042d88e-79d1-47b7-9b22-a5a67e7a8ed4"]
["Network Topology and Connectivity","Hybrid","Monitor ExpressRoute availability and utilization using built-in Azure Monitor metrics.",null,"Medium","Not verified",null,"More info","Training",null,"b30e38c3-f298-412b-8363-cefe179b599d"]
["Network Topology and Connectivity","Hybrid","Use Connection Monitor for connectivity monitoring across the environment.",null,"Medium","Not verified",null,"More info","Training",null,"5bf68dc9-325e-4873-bf88-f8214ef2e5d2"]
["Network Topology and Connectivity","Hybrid","Don't explicitly use ExpressRoute circuits from a single peering location. Doing so creates a single point of failure and makes the organization susceptible to peering location outages.",null,"Medium","Not verified",null,"More info","Training",null,"e0d5973c-d4cd-421b-8881-37f5e6c4cfd3"]
["Network Topology and Connectivity","PaaS","If you need private communication to PaaS services, consider the different options available.",null,"Medium","Not verified",null,"More info","Training",null,"e504547c-2447-4ec6-9138-a7200f1ce16e"]
["Network Topology and Connectivity","PaaS","Azure PaaS services that have been injected into a virtual network still perform management plane operations by using public IP addresses. Ensure that this communication is not broken",null,"Medium","Not verified",null,"More info","Training",null,"d301d6e8-72e5-42e3-911c-c58b5a4b1511"]
["Network Topology and Connectivity","PaaS","Use Private Link, where available, for shared Azure PaaS services.",null,"Medium","Not verified",null,"More info","Training",null,"e43a58a9-c229-49c4-b7b5-7d0c655562f2"]
["Network Topology and Connectivity","PaaS","Access Azure PaaS services from on-premises via ExpressRoute private peering. This method avoids transiting over the public internet.",null,"Medium","Not verified",null,"More info","Training",null,"b3e4563a-4d87-4397-98b6-62d6d15f512a"]
["Network Topology and Connectivity","PaaS","Use virtual network service endpoints when Private Link isn't available",null,"Medium","Not verified",null,"More info","Training",null,"65498f6d-fe23-47de-843b-16c31d7aa9b6"]
["Network Topology and Connectivity","PaaS","Don't enable virtual network service endpoints by default on all subnets.",null,"Medium","Not verified",null,"More info","Training",null,"4704489a-8042-4d88-b79d-17b73b22a5a6"]
["Network Topology and Connectivity","PaaS","Don't use virtual network service endpoints when there are data exfiltration concerns, unless you use NVA filtering.",null,"Medium","Not verified",null,"More info","Training",null,"7e7a8ed4-b30e-438c-9f29-812b2363cefe"]
["Network Topology and Connectivity","PaaS","Don't implement forced tunneling to enable communication from Azure to Azure resources.",null,"Medium","Not verified",null,"More info","Training",null,"179b599d-e0d5-4973-ad4c-d21b088137f5"]
["Network Topology and Connectivity","Internet","Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",null,"Medium","Not verified",null,"More info","Training",null,"e6c4cfd3-e504-4547-a244-7ec66138a720"]
["Network Topology and Connectivity","Internet","Use Firewall Manager with Virtual WAN to deploy and manage Azure firewalls across Virtual WAN hubs or in hub virtual networks. Firewall Manager is now in general availability for both Virtual WAN and regular virtual networks.",null,"Medium","Not verified",null,"More info","Training",null,"0f1ce16e-d301-4d6e-a72e-52e3611cc58b"]
["Network Topology and Connectivity","Internet","Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",null,"Medium","Not verified",null,"More info","Training",null,"5a4b1511-e43a-458a-ac22-99c4d7b57d0c"]
["Network Topology and Connectivity","Internet","Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",null,"Medium","Not verified",null,"More info","Training",null,"655562f2-b3e4-4563-a4d8-739748b662d6"]
["Network Topology and Connectivity","Internet","Use WAF within a landing-zone virtual network for protecting inbound HTTP/S traffic from the internet.",null,"Medium","Not verified",null,"More info","Training",null,"d15f512a-6549-48f6-bfe2-37de143b16c3"]
["Network Topology and Connectivity","Internet","Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",null,"Medium","Not verified",null,"More info","Training",null,"1d7aa9b6-4704-4489-a804-2d88e79d17b7"]
["Network Topology and Connectivity","Internet","When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",null,"Medium","Not verified",null,"More info","Training",null,"3b22a5a6-7e7a-48ed-9b30-e38c3f29812b"]
["Network Topology and Connectivity","Internet","If partner NVAs are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",null,"Medium","Not verified",null,"More info","Training",null,"2363cefe-179b-4599-be0d-5973cd4cd21b"]
["Network Topology and Connectivity","Internet","Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",null,"Medium","Not verified",null,"More info","Training",null,"088137f5-e6c4-4cfd-9e50-4547c2447ec6"]
["Network Topology and Connectivity","App delivery","Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).",null,"Medium","Not verified",null,"More info","Training",null,"6138a720-0f1c-4e16-bd30-1d6e872e52e3"]
["Network Topology and Connectivity","App delivery","For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",null,"Medium","Not verified",null,"More info","Training",null,"611cc58b-5a4b-4151-8e43-a58a9c2299c4"]
["Network Topology and Connectivity","App delivery","Use a partner NVA if you can't use Application Gateway v2 for the security of HTTP/S apps.",null,"Medium","Not verified",null,"More info","Training",null,"d7b57d0c-6555-462f-8b3e-4563a4d87397"]
["Network Topology and Connectivity","App delivery","Deploy Azure Application Gateway v2 or partner NVAs used for inbound HTTP/S connections within the landing-zone virtual network and with the apps that they're securing.",null,"Medium","Not verified",null,"More info","Training",null,"48b662d6-d15f-4512-a654-98f6dfe237de"]
["Network Topology and Connectivity","App delivery","Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",null,"Medium","Not verified",null,"More info","Training",null,"143b16c3-1d7a-4a9b-9470-4489a8042d88"]
["Network Topology and Connectivity","App delivery","Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span Azure regions.",null,"Medium","Not verified",null,"More info","Training",null,"e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c"]
["Network Topology and Connectivity","App delivery","When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",null,"Medium","Not verified",null,"More info","Training",null,"3f29812b-2363-4cef-b179-b599de0d5973"]
["Network Topology and Connectivity","App delivery","Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",null,"Medium","Not verified",null,"More info","Training",null,"cd4cd21b-0881-437f-9e6c-4cfd3e504547"]
["Network Topology and Connectivity","App delivery","If users only need access to internal applications, has Azure AD Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",null,"Low","Not verified",null,"More info","Training",null,"3b4b3e88-a459-4ed5-a22f-644dfbc58204"]
["Network Topology and Connectivity","Segmentation","Delegate subnet creation to the landing zone owner. ",null,"Medium","Not verified",null,"More info","Training",null,"c2447ec6-6138-4a72-80f1-ce16ed301d6e"]
["Network Topology and Connectivity","App delivery","To reduce the number of firewall ports open for incoming connections in your network, consider using Azure AD Application Proxy to give remote users secure and authenticated access to internal applications.",null,"Medium","Not verified",null,"More info","Training",null,"01ca7cf1-5754-442d-babb-8ba6772e5c30"]
["Network Topology and Connectivity","Segmentation","Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",null,"Medium","Not verified",null,"More info","Training",null,"872e52e3-611c-4c58-a5a4-b1511e43a58a"]
["Network Topology and Connectivity","Segmentation","The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.",null,"Medium","Not verified",null,"More info","Training",null,"9c2299c4-d7b5-47d0-a655-562f2b3e4563"]
["Network Topology and Connectivity","Segmentation","Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",null,"Medium","Not verified",null,"More info","Training",null,"a4d87397-48b6-462d-9d15-f512a65498f6"]
["Network Topology and Connectivity","Segmentation","Enable NSG flow logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",null,"Medium","Not verified",null,"More info","Training",null,"dfe237de-143b-416c-91d7-aa9b64704489"]
["Network Topology and Connectivity","Segmentation","Use NSGs to selectively allow connectivity between landing zones.",null,"Medium","Not verified",null,"More info","Training",null,"a8042d88-e79d-417b-93b2-2a5a67e7a8ed"]
["Network Topology and Connectivity","Segmentation","For Virtual WAN topologies, route traffic across landing zones via Azure Firewall if the organization requires filtering and logging capabilities for traffic flowing across landing zones.",null,"Medium","Not verified",null,"More info","Training",null,"4b30e38c-3f29-4812-a236-3cefe179b599"]
["Network Topology and Connectivity","Encryption","When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",null,"Medium","Not verified",null,"More info",null,null,"de0d5973-cd4c-4d21-a088-137f5e6c4cfd"]
["Network Topology and Connectivity","Encryption","If traffic between Azure regions must be encrypted, use global VNet peering to connect virtual networks across regions.",null,"Medium","Not verified",null,"More info","Training",null,"3e504547-c244-47ec-9613-8a7200f1ce16"]
["Network Topology and Connectivity","Encryption","For Virtual WAN scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a Virtual WAN VPN gateway to establish IPsec tunnels over ExpressRoute private peering. ",null,"Medium","Not verified",null,"More info","Training",null,"ed301d6e-872e-452e-9611-cc58b5a4b151"]
["Network Topology and Connectivity","Inspection","Use Network Watcher packets to capture despite the limited capture window.",null,"Medium","Not verified",null,"More info","Training",null,"1e43a58a-9c22-499c-9d7b-57d0c655562f"]
["Network Topology and Connectivity","Inspection","Evaluate whether the latest version of NSG flow logs provides the level of detail that you need.",null,"Medium","Not verified",null,"More info",null,null,"2b3e4563-a4d8-4739-948b-662d6d15f512"]
["Network Topology and Connectivity","Inspection","Use partner solutions for scenarios that require deep packet inspection.",null,"Medium","Not verified",null,"More info",null,null,"a65498f6-dfe2-437d-b143-b16c31d7aa9b"]
["Network Topology and Connectivity","Inspection","Don't develop a custom solution to mirror traffic. Although this approach might be acceptable for small-scale scenarios, we don't encourage it at scale because of complexity and the supportability issues that might arise.",null,"Medium","Not verified",null,"More info",null,null,"64704489-a804-42d8-ae79-d17b73b22a5a"]
["Management and Monitoring","Monitoring","Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",null,"Medium","Not verified",null,"More info","Training",null,"67e7a8ed-4b30-4e38-a3f2-9812b2363cef"]
["Management and Monitoring","Monitoring","Is the landing zone documented?",null,"Medium","Not verified",null,null,null,null,"e179b599-de0d-4597-9cd4-cd21b088137f"]
["Management and Monitoring","Monitoring","Export logs to Azure Storage if log retention requirements exceed two years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",null,"Medium","Not verified",null,"More info","Training",null,"5e6c4cfd-3e50-4454-9c24-47ec66138a72"]
["Management and Monitoring","Monitoring","Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",null,"Medium","Not verified",null,"More info","Training",null,"00f1ce16-ed30-41d6-b872-e52e3611cc58"]
["Management and Monitoring","Monitoring","Monitor in-guest virtual machine (VM) configuration drift using Azure Policy. Enabling guest configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",null,"Medium","Not verified",null,"More info","Training",null,"e7d7e484-3276-4d8b-bc05-5bcf619e8a13"]
["Management and Monitoring","Monitoring","Use Update Management in Azure Automation as a long-term patching mechanism for both Windows and Linux VMs. ",null,"Medium","Not verified",null,"More info","Training",null,"f9887952-5d62-4688-9d70-ba6c97be9951"]
["Management and Monitoring","Monitoring","Use Network Watcher to proactively monitor traffic flows",null,"Medium","Not verified",null,"More info","Training",null,"90483845-c986-4cb2-a131-56a12476e49f"]
["Management and Monitoring","Monitoring","Use resource locks to prevent accidental deletion of critical shared services.",null,"Medium","Not verified",null,"More info","Training",null,"541acdce-9793-477b-adb3-751ab2ab13ad"]
["Management and Monitoring","Monitoring","Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.",null,"Low","Not verified",null,"More info",null,null,"a6e55d7d-8a2a-4db1-87d6-326af625ca44"]
["Management and Monitoring","Monitoring","Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.",null,"Medium","Not verified",null,"More info",null,null,"e5695f22-23ac-4e8c-a123-08ca5017f154"]
["Management and Monitoring","Monitoring","Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned",null,"Medium","Not verified",null,"More info",null,null,"d5f345bf-97ab-41a7-819c-6104baa7d48c"]
["Management and Monitoring","Monitoring","Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.",null,"Medium","Not verified",null,"More info",null,null,"e3ab3693-829e-47e3-8618-3687a0477a20"]
["Management and Monitoring","Monitoring","Use a centralized Azure Monitor Log Analytics workspace to collect logs and metrics from IaaS and PaaS application resources and control log access with Azure RBAC.",null,"Medium","Not verified",null,"More info",null,null,"9945bda4-3334-4f24-a116-34182ba52752"]
["Management and Monitoring","Monitoring","Use Azure Monitor Logs for insights and reporting.",null,"Medium","Not verified",null,"More info",null,null,"6944008b-e7d7-4e48-9327-6d8bdc055bcf"]
["Management and Monitoring","Monitoring","When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.",null,"Medium","Not verified",null,"More info",null,null,"619e8a13-f988-4795-85d6-26886d70ba6c"]
["Management and Monitoring","Monitoring","Use Azure Monitor alerts for the generation of operational alerts.",null,"Medium","Not verified",null,"More info",null,null,"97be9951-9048-4384-9c98-6cb2913156a1"]
["Management and Monitoring","Monitoring","Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",null,"Medium","Not verified",null,"More info",null,null,"2476e49f-541a-4cdc-b979-377bcdb3751a"]
["Management and Monitoring","Monitoring","Ensure to use and test native PaaS service disaster recovery capabilities.",null,"Medium","Not verified",null,"More info",null,null,"b2ab13ad-a6e5-45d7-b8a2-adb117d6326a"]
["Management and Monitoring","Monitoring","Use Azure-native backup capabilities. Verify that partner/customer is aware of Azure Backup and all new capabilities which greatly can simplify backup management",null,"Medium","Not verified",null,"More info",null,null,"f625ca44-e569-45f2-823a-ce8cb12308ca"]
["Management and Monitoring","Monitoring","Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied",null,"Medium","Not verified",null,"More info",null,null,"859c3900-4514-41eb-b010-475d695abd74"]
["Security, Governance and Compliance","Secrets","Use Azure Key Vault to store your secrets and credentials",null,"High","Not verified",null,"More info",null,null,"5017f154-e3ab-4369-9829-e7e316183687"]
["Security, Governance and Compliance","Secrets","Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",null,"Medium","Not verified",null,"More info",null,"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)","a0477a20-9945-4bda-9333-4f2491163418"]
["Security, Governance and Compliance","Secrets","Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",null,"Medium","Not verified",null,"More info",null,null,"2ba52752-6944-4008-ae7d-7e4843276d8b"]
["Security, Governance and Compliance","Secrets","Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Azure Active Directory (Azure AD) roles.",null,"Medium","Not verified",null,"More info",null,null,"dc055bcf-619e-48a1-9f98-879525d62688"]
["Security, Governance and Compliance","Secrets","Automate the certificate management and renewal process with public certificate authorities to ease administration.",null,"Medium","Not verified",null,"More info",null,null,"6d70ba6c-97be-4995-8904-83845c986cb2"]
["Security, Governance and Compliance","Secrets","Establish an automated process for key and certificate rotation.",null,"Medium","Not verified",null,"More info",null,null,"913156a1-2476-4e49-b541-acdce979377b"]
["Security, Governance and Compliance","Secrets","Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",null,"Medium","Not verified",null,"More info",null,null,"cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1"]
["Security, Governance and Compliance","Secrets","Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",null,"Medium","Not verified",null,"More info",null,null,"17d6326a-f625-4ca4-9e56-95f2223ace8c"]
["Security, Governance and Compliance","Secrets","Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",null,"Medium","Not verified",null,"More info",null,null,"b12308ca-5017-4f15-9e3a-b3693829e7e3"]
["Security, Governance and Compliance","Secrets","Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",null,"Medium","Not verified",null,"More info",null,null,"16183687-a047-47a2-8994-5bda43334f24"]
["Security, Governance and Compliance","Secrets","Use an Azure Key Vault per application per environment per region.",null,"Medium","Not verified",null,"More info",null,null,"91163418-2ba5-4275-8694-4008be7d7e48"]
["Security, Governance and Compliance","Secrets","If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",null,"Medium","Not verified",null,"More info",null,null,"25d62688-6d70-4ba6-a97b-e99519048384"]
["Security, Governance and Compliance","Governance","Leverage Azure Policy",null,"High","Not verified",null,"More info",null,null,"5c986cb2-9131-456a-8247-6e49f541acdc"]
["Security, Governance and Compliance","Governance","Identify required Azure tags and use the append policy mode to enforce usage.",null,"Medium","Not verified",null,"More info",null,null,"e979377b-cdb3-4751-ab2a-b13ada6e55d7"]
["Security, Governance and Compliance","Governance","Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",null,"Medium","Not verified",null,"More info",null,null,"d8a2adb1-17d6-4326-af62-5ca44e5695f2"]
["Security, Governance and Compliance","Governance","Establish Azure Policy definitions at the top-level root management group so that they can be assigned at inherited scopes",null,"Medium","Not verified",null,"More info",null,null,"223ace8c-b123-408c-a501-7f154e3ab369"]
["Security, Governance and Compliance","Governance","Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required",null,"Medium","Not verified",null,"More info",null,null,"3829e7e3-1618-4368-9a04-77a209945bda"]
["Security, Governance and Compliance","Governance","Use Azure Policy to control resource provider registrations at the subscription and/or management group levels",null,"Low","Not verified",null,"More info",null,null,"43334f24-9116-4341-a2ba-527526944008"]
["Security, Governance and Compliance","Governance","Use built-in policies where possible to minimize operational overhead.",null,"Medium","Not verified",null,"More info",null,null,"be7d7e48-4327-46d8-adc0-55bcf619e8a1"]
["Security, Governance and Compliance","Governance","Assign the built-in Policy Contributor role at a particular scope to enable application-level governance.",null,"Medium","Not verified",null,"More info",null,null,"3f988795-25d6-4268-a6d7-0ba6c97be995"]
["Security, Governance and Compliance","Governance","Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",null,"Medium","Not verified",null,"More info",null,null,"19048384-5c98-46cb-8913-156a12476e49"]
["Security, Governance and Compliance","Governance","Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",null,"Medium","Not verified",null,"More info",null,null,"f541acdc-e979-4377-acdb-3751ab2ab13a"]
["Security, Governance and Compliance","Governance","Monitor VM security configuration drift via Azure Policy.",null,"Medium","Not verified",null,"More info",null,null,"da6e55d7-d8a2-4adb-817d-6326af625ca4"]
["Security, Governance and Compliance","Security","Use Azure AD reporting capabilities to generate access control audit reports.",null,"Medium","Not verified",null,"More info",null,null,"4e5695f2-223a-4ce8-ab12-308ca5017f15"]
["Security, Governance and Compliance","Security","Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.",null,"Medium","Not verified",null,"More info",null,null,"4e3ab369-3829-4e7e-9161-83687a0477a2"]
["Security, Governance and Compliance","Security","Enable Defender for Cloud Standard for all subscriptions.",null,"Medium","Not verified",null,"More info",null,null,"09945bda-4333-44f2-9911-634182ba5275"]
["Security, Governance and Compliance","Security","Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",null,"Medium","Not verified",null,"More info",null,null,"15833ee7-ad6c-46d3-9331-65c7acbe44ab"]
["Security, Governance and Compliance","Security","Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",null,"Medium","Not verified",null,"More info",null,null,"e5f8d79f-2e87-4768-924c-516775c6ea95"]
["Security, Governance and Compliance","Security","Determine the incident response plan for Azure services before allowing it into production.",null,"Medium","Not verified",null,"More info",null,null,"b86ad884-08e3-4727-94b8-75ba18f20459"]
["Security, Governance and Compliance","Security","Implement a zero-trust approach for access to the Azure platform, where appropriate.",null,"Medium","Not verified",null,"More info",null,null,"01365d38-e43f-49cc-ad86-8266abca264f"]
["Security, Governance and Compliance","Security","Plan how new azure services will be implemented",null,"Medium","Not verified",null,"More info",null,null,"9a19bf39-c95d-444c-9c89-19ca1f6d5215"]
["Security, Governance and Compliance","Security","Plan how service request will be fulfilled for Azure services",null,"Medium","Not verified",null,"More info",null,null,"ae514b93-3d45-485e-8112-9bd7ba012f7b"]
["Network Topology and Connectivity","Front Door","Avoid combining Azure Traffic Manager and Azure Front Door.",null,"High","Not verified",null,"More info",null,null,"062d5839-4d36-402f-bfa4-02811eb936e9"]
["Security, Governance and Compliance","Front Door","Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",null,"High","Not verified",null,"More info",null,null,"2e30abab-5478-417c-81bf-bf1ad4ed1ed4"]
["Security, Governance and Compliance","Front Door","Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",null,"Medium","Not verified",null,"More info",null,null,"10aa45af-166f-44c4-9f36-b6d592dac2ca"]
["Operations","Front Door","Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",null,"High","Not verified",null,"More info",null,null,"af95c92d-d723-4f4a-98d7-8722324efd4d"]
["Operations","Front Door","If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",null,"Medium","Not verified",null,"More info",null,null,"f00a69de-7076-4734-a734-6e4552cad9e1"]
["Network Topology and Connectivity","Front Door","Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",null,"Medium","Not verified",null,"More info",null,null,"5efeb96a-003f-4b18-8fcd-b4d84459c2b2"]
["Security, Governance and Compliance","Front Door","Enable the Azure Front Door WAF. Protect your application from a range of attacks.",null,"High","Not verified",null,"More info",null,null,"28b9ee82-b2c7-45aa-bc98-6de6f59a095d"]
["Network Topology and Connectivity","Front Door","Disable health probes when there’s only one origin in an Azure Front Door origin group.",null,"Low","Not verified",null,"More info",null,null,"0b5a380c-4bfb-47bc-b1d7-dcfef363a61b"]
["Network Topology and Connectivity","Front Door","Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",null,"Medium","Not verified",null,"More info",null,null,"5567048e-e5d7-4206-9c55-b5ed45d2cc0c"]
["Network Topology and Connectivity","Front Door","Use HEAD health probes with Azure Front Door. Reduce the traffic that Front Door sends to your application.",null,"Low","Not verified",null,"More info",null,null,"a13f72f3-8f5c-4864-95e5-75bf37fbbeb1"]
["Security, Governance and Compliance","Front Door","Tune the Azure Front Door WAF for your workload. Reduce false positive detections.",null,"High","Not verified",null,"More info",null,null,"2902d8cc-1b0c-4495-afad-624ab70f7bd6"]
["Security, Governance and Compliance","Front Door","Use prevention mode with the Azure Front Door WAF. Prevention mode ensures that the WAF blocks malicious requests.",null,"High","Not verified",null,"More info",null,null,"17ba124b-127d-42b6-9322-388d5b2bbcfc"]
["Operations","Front Door","Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new ruleset versions and gain additional protection.",null,"Medium","Not verified",null,"More info",null,null,"189ea962-3969-4863-8f5a-5ad808c2cf4b"]
["Security, Governance and Compliance","Front Door","Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",null,"High","Not verified",null,"More info",null,null,"49a98f2b-ec22-4a87-9415-6a10b00d6555"]
["Security, Governance and Compliance","Front Door","Enable the Azure Front Door WAF bot management rules. The bot rules detect good and bad bots.",null,"High","Not verified",null,"More info",null,null,"147a13d4-2a2f-4824-a524-f5855b52b946"]
["Security, Governance and Compliance","Front Door","Use the latest Azure Front Door WAF ruleset versions. Ruleset updates are regularly updated to take account of the current threat landscape.",null,"Medium","Not verified",null,"More info",null,null,"d7dcdcb9-0d99-44b9-baab-ac7570ede79a"]
["Security, Governance and Compliance","Front Door","Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",null,"Medium","Not verified",null,"More info",null,null,"b9620385-1cde-418f-914b-a84a06982ffc"]
["Security, Governance and Compliance","Front Door","Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",null,"Medium","Not verified",null,"More info",null,null,"6dc36c52-0124-4ffe-9eaf-23ec1282dedb"]
["Security, Governance and Compliance","Front Door","Geo-filter traffic by using the Azure Front Door WAF. Allow traffic only from expected regions, and block traffic from other regions.",null,"Low","Not verified",null,"More info",null,null,"388a3d0e-0a43-4367-90b2-3dd2aeece5ee"]
["Security, Governance and Compliance","Front Door","Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",null,"Medium","Not verified",null,"More info",null,null,"00acd8a9-6975-414f-8491-2be6309893b8"]
["Management and Monitoring","Front Door","Add diagnostic settings to save your Azure Front Door WAF's logs. Regularly review the logs to check for attacks and for false positive detections.",null,"High","Not verified",null,"More info",null,null,"89cc5e11-aa4d-4c3b-893d-feb99215266a"]
["Management and Monitoring","Front Door","Send Azure Front Door logs to Microsoft Sentinel. Detect attacks and integrate Front Door telemetry into your overall Azure environment.",null,"Medium","Not verified",null,"More info",null,null,"7f408960-c626-44cb-a018-347c8d790cdf"]

{"sheet":"Values","index":2,"n_rows":9,"n_cols":11,"rows_kept":9,"cut":false,"hidden":false,"merged":[]}
["Severity","Status","Category","Reference checklist base URL","Default title","Technologies","Languages","Status descriptions",null,"Technology file prefix","Language file suffix"]
["High","Not verified","Identity and Access","https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/","Use the \"Import latest checklist\" button to get the latest version of a review checklist","Landing Zone","English","This check has not been looked at yet",null,"lz","en"]
["Medium","Open","Network Topology and Connectivity",null,null,"AKS","Japanese","There is an action item associated to this check",null,"aks","ja"]
["Low","Fulfilled","Security, Governance and Compliance",null,null,"AVD","Korean","This check has been verified, and there are no further action items associated to it",null,"avd","ko"]
[null,"Not required","Management and Monitoring",null,null,"AVS","Brazilian Portuguese","Recommendation understood, but not needed by current requirements",null,"avs","pt"]
[null,"N/A","Management Group and Subscriptions",null,null,"Security","Spanish","Not applicable for current design",null,"security","es"]
[null,null,"Operations",null,null,"Multitenancy",null,null,null,"multitenancy"]
[null,null,"Application Deployment",null,null,"SAP",null,null,null,"sap"]
[null,null,null,null,null,"App Services Security",null,null,null,"appsvc_security"]