Disable the allMetrics diagnostic setting requirement for ISO 27001:2013

Context and Problem Statement

Our landing zone implementation adheres to the ASC, CIS 1.4.0, and ISO 27001:2013 compliance standards. However, currently, the storage account that is used to store the terraform state files is not deployed using IaC. Also we have not yet come to a decision which security aspects should be applied to the state storage account and which should be exempted.

Decision Drivers

• The requirement to be compliant with the ISO 27001:2013 compliance standard
• The requirement to be diligent about the costs of resources in the landing zone

Considered Options

• Create custom policies to enable allMetrics for all required resource types
• Disable the allMetrics requirement in the ISO 27001:2013 policy assignment

Create custom policies to enable allMetrics for all required resource types

The built-in diagnostic policies we currently use only enable allLogs on the diagnostic settings for the resources they apply to. But one of the ISO 27001:2013 policies requires that allMetrics is enable as well. We could copy the built-in policies, make the Custom and add the allMetrics setting to all of them.

Disable the allMetrics requirement in the ISO 27001:2013 policy assignment

The policy set definition for ISO27001:2013 has a parameter to enable (or disable) the allMetrics requirement for diagnostic settings. If we set this parameter to false the policy will no longer require allMetcis to be enabled on (almost) all resource types.

Decision Outcome

Chosen option: "Disable the allMetrics requirement in the ISO 27001:2013 policy assignment", because:

• Enabling allMetrics potentially incurs a lot of extra costs