Question

A multinational financial services firm runs workloads across three Azure subscriptions and one AWS account, all connected to Microsoft Defender for Cloud. Auditors require the organization to demonstrate continuous compliance against both PCI DSS and the local ISO 27001 standard, and the compliance team wants each business unit's subscription measured against only the standards relevant to it. What is the most appropriate design to meet these requirements while minimizing manual reporting effort?

Accepted Answer

Assign the PCI DSS and ISO 27001 regulatory compliance standards at the appropriate scope in Defender for Cloud's regulatory compliance dashboard, and use its continuous assessment to generate posture reports per subscription and the AWS account.

Answer

Export Defender for Cloud secure score weekly to a spreadsheet and manually map each recommendation to PCI DSS and ISO 27001 control IDs for the audit.

Answer

Deploy a single custom Azure Policy initiative that combines all PCI DSS and ISO 27001 controls and assign it to the root management group so every subscription is evaluated identically.

Answer

Rely on Microsoft Purview Compliance Manager assessments alone, since Defender for Cloud does not evaluate infrastructure configuration against regulatory frameworks.