Incorrect CIS Control Mapping and Title in IM-7 Section of Microsoft Cloud Security Benchmark

[espanet]

There is an error in the CIS Controls v8 ID mapping for the IM-7 section of the Microsoft Cloud Security Benchmark documentation under "Restrict resource access based on conditions."

The document currently maps the IM-7 section to CIS Controls v8 ID 6.4, which is "Require MFA for Remote Network Access." However, in the Excel spreadsheet CIS Control 6.4 is incorrectly titled as 6.5: "6.4 - Require MFA for Administrative Access."

In my opinion the two CIS Control 6.5 and 6.4 can be mapped to this "Restrict resource access based on conditions" CSB Control, and the Excel file should be corrected.

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 05adcb27-c771-5e97-95fd-b06c45a7c8ce
• Version Independent ID: 05adcb27-c771-5e97-95fd-b06c45a7c8ce
• Content: Microsoft cloud security benchmark - Identity Management
• Content Source: benchmark/azure/mcsb-identity-management.md
• Service: security
• GitHub Login: @msmbaldwin
• Microsoft Alias: mbaldwin

[PesalaPavan]

@espanet
Thanks for your feedback! I've assigned this issue to the author who will investigate and update as appropriate.