Explore Azure mappings for CIS, ISO 27001, SOC 2, PCI DSS, NIS2, Cyber Essentials and more. Review control evidence, coverage gaps and PDF, CSV or JSON exports.
Catalog illustration, not a customer scan or compliance score. *Exports on eligible plans.
203Supported Azure checks
22Azure service areas
25Framework definitions, including versions
Verified catalog. Your scan determines actual coverage.
CONNECT THE TECHNICAL AND THE PRACTICAL
Give each control conversation a starting point.
Futrly maps supported Azure findings to framework controls, keeping resource evidence with the result. Use that structure to organise a review, identify technical gaps and prepare a more useful conversation with a client, control owner or assessor.
CIS Azure
Establish a repeatable Azure configuration baseline, compare observed settings with mapped benchmark requirements, and give remediation owners a concrete starting point.
Bring Azure technical evidence into an information security management review. Organisational controls, risk treatment and certification still require work beyond a cloud scan.
Organise mapped Azure findings for control owners and evidence collection. A scan is a point-in-time input to the review, not an auditor's opinion on your controls.
Review mapped technical settings in selected Azure subscriptions. Cardholder-data scope, operational processes and assessment requirements need separate validation.
Connect available Azure configuration evidence to the catalog's mapped requirements. Use the findings to support security discussions alongside governance and operational evidence.
Review the Azure evidence available for mapped infrastructure requirements. Endpoint configuration, people, processes and the certification assessment remain separate responsibilities.
A cloud scan cannot assess an entire organisation's policies, people, processes or legal obligations. Futrly reports mapped technical evidence and identifies controls without sufficient automated coverage. Certification, attestation and regulatory applicability remain separate assessments.
ALL SUPPORTED DEFINITIONS
25 framework and benchmark definitions.
This catalog includes separate versions of the CIS Azure Foundations Benchmark, cross-provider frameworks with Azure mappings and security reference frameworks. The 4,498 control entries are catalog entries, not that many independent automated checks or a count of passed controls.
“Controls with Azure mappings” means the definition links that control to one or more Azure check IDs. “Available checks” counts distinct mapped checks present in this scanner release. Neither value measures the results of your tenant's scan. Open a definition to inspect its scope and control coverage.
10 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
HIPAA compliance framework for AzureUnversioned definition34 / 34controls mapped
Catalog controls
34
Controls with Azure mappings
34
Available checks
128
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
ISO/IEC 27001 Information Security Management Standard 2022Version 202231 / 92controls mapped
Catalog controls
92
Controls with Azure mappings
31
Available checks
109
61 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
15 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
MITRE ATT&CK is a security knowledge framework; this mapping is not a regulatory certification.
NIS2 - Network and Information Security Directive (Directive (EU) 2022/2555)Unversioned definition91 / 91controls mapped
Catalog controls
91
Controls with Azure mappings
91
Available checks
133
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
Payment Card Industry Data Security Standard (PCI DSS) v4.0Version 4.0756 / 1669controls mapped
Catalog controls
1669
Controls with Azure mappings
756
Available checks
48
913 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
Azure threat control mappingVersion 1.076 / 76controls mapped
Catalog controls
76
Controls with Azure mappings
76
Available checks
75
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
This supplementary definition maps Azure security controls. Futrly does not calculate an aggregate threat score from this mapping.
Reserve Bank of India (RBI) Cyber Security FrameworkUnversioned definition9 / 9controls mapped
Catalog controls
9
Controls with Azure mappings
9
Available checks
117
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
58 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
System and Organization Controls 2 (SOC2)Unversioned definition26 / 26controls mapped
Catalog controls
26
Controls with Azure mappings
26
Available checks
100
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
NCSC Cyber Essentials: Requirements for IT InfrastructureVersion 3.315 / 28controls mapped
Catalog controls
28
Controls with Azure mappings
15
Available checks
29
13 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
Every control entry has an Azure check mapping. This does not mean every control will be fully evaluated in your scan or that the framework is fully satisfied.
FedRAMP 20x Class C Rules (FRR) 2026Version 2026.09.13.027 / 158controls mapped
Catalog controls
158
Controls with Azure mappings
7
Available checks
6
151 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
23 controls have no Azure check mapping in this definition. These need separate evidence and must not be treated as passed.
KEEP THE EVIDENCE USEFUL
Choose the report your next step needs.
PDF
Share a readable review
Export a framework report for a security meeting or client discussion. Keep the summary, control outcomes and supporting context together so readers can understand both the findings and the limits of the evidence.
CSV
Work through the detail
Bring control and resource evidence into your review worksheet. Exports include outcomes, missing checks, recommendations and scope information to support triage and the collection of additional evidence.
JSON
Retain structured evidence
Download a machine-readable framework report for your own analysis or evidence-handling process. Keep the scan identity, engine version and selected scope with the findings when you share or archive the output.
Framework downloads require a plan entitled to compliance packs and a completed supported scan. These export formats do not imply a direct integration with an external audit platform.
READ THE RESULT, NOT JUST THE PERCENTAGE
A passing check and complete coverage are different things.
Futrly shows evaluated-pass and coverage measures separately. Evaluated pass compares passing controls with passing plus failing controls. Control coverage asks whether all mapped checks have been evaluated across the selected scope; unmapped controls remain part of that coverage denominator. A high evaluated-pass figure can coexist with incomplete evidence.
Pass
The mapped checks have passing evidence with no missing, manual or unknown gaps in the selected scope.
Fail
At least one resource fails a mapped check. Review the evidence and coverage together: a failure can coexist with other missing results.
Manual
The available result requires a human review. Collect and assess the additional evidence before drawing a control-level conclusion.
Unknown
A mapped check or subscription result is missing, or the evidence is unknown. Investigate the gap instead of counting it as success.
Unmapped
The catalog has no Azure check mapped to this control. The control remains in the report so that work outside the automated scan stays visible.
The report also distinguishes tenant-wide checks from subscription evidence. Review the selected scope, warnings and missing checks before using a result in an assurance discussion. See the Azure services and checks that supply this evidence.
PLAN YOUR REVIEW
Questions about compliance reporting
Does a passing report mean my organisation is certified?
No. Futrly supplies technical configuration evidence and framework mappings. It does not issue ISO certification, a SOC 2 attestation, Cyber Essentials certification or a regulatory compliance decision. Use the report as one input to the broader assessment.
Why are several CIS Azure versions listed?
Clients and internal policies may refer to different benchmark editions. The pinned catalog contains Azure Foundations versions 2.0, 2.1, 3.0, 4.0, 5.0 and 6.0, plus CIS Controls 8.1. These are separate mapping definitions, not seven additional sets of unique Azure checks. Choose the version agreed for your review.
Can the same scan support more than one framework?
Yes. The stored Azure findings can be mapped into multiple supported framework views. A single check may contribute evidence to several controls or frameworks. That reuse reduces duplicated evidence handling, but each framework still needs its own scope and coverage review.
Which plan and permissions do I need?
Connect and authorise the Azure tenant, enable scanning in the workspace and use a plan that includes compliance packs. The account signing in, the administrator granting cloud access and the report entitlement serve different purposes. Read the access overview and compare plans before starting.
YOUR NEXT SECURITY REVIEW
Start with one tenant. Build a repeatable review.
Sign in with Microsoft, connect an authorised Azure tenant and confirm the access needed for your chosen scope. Scan availability depends on workspace setup; compliance reports and exports require an eligible plan.