Enable NIST 800-53 Compliance Assessment in Defender for Cloud
Short answer
C Enable the NIST 800-53 security standard in Microsoft Defender for Cloud for the subscription so the regulatory compliance dashboard can assess it.
Question
The company signs a contract with the United States government.
You need to review the current subscription for NIST 800-53 compliance.
What should you do first?
Key Takeaways
The question tests that Defender for Cloud only assesses the Microsoft Cloud Security Benchmark by default, so enabling the NIST 800-53 standard is a prerequisite before any NIST compliance review is possible.
To review an Azure subscription against NIST 800-53 in Microsoft Defender for Cloud, you must first enable the NIST 800-53 security standard; only then does the regulatory compliance dashboard report control-level results.
Common mistake: Option A looks right because NIST 800-53 maps to an Azure Policy initiative, and Option D looks right because secure score shows recommendations — but neither surfaces NIST 800-53 results until the standard is enabled in Defender for Cloud.
Expert Analysis
The qualifier that decides this question The verb that governs everything is review — you must produce a compliance assessment for NIST 800-53 against the subscription. But the decisive qualifier is first. You cannot review something that has not been turned on, so the answer must be whatever step creates the NIST 800-53 assessment data in the first place.
Why C is correct By default, Microsoft Defender for Cloud assesses a subscription only against the Microsoft Cloud Security Benchmark. The regulatory compliance dashboard therefore shows no NIST 800-53 line item until the standard is explicitly enabled under Environment settings → the subscription → Security policies (or Regulatory compliance → Manage). Only after that assignment are the built-in NIST 800-53 Rev. 5 initiatives evaluated, producing per-control compliance data. Turning on the security standard is exactly the first action, so C is the answer.
Why A fails on timing Option A describes an Azure Policy assignment with subscription scope. NIST 800-53 compliance in Defender for Cloud is in fact implemented behind the scenes as an Azure Policy initiative assignment, so A is technically adjacent to the real mechanism. It is nonetheless wrong as the first step here: the question places you in Defender for Cloud with a NIST requirement, and the supported, intended workflow is enabling the regulatory standard in Defender for Cloud, not hand-assigning a raw policy definition. Choosing A means skipping the step that surfaces the assessment in the compliance dashboard.
Why D and B fail Option D (secure score) returns recommendations mapped to the MCSB, not to NIST 800-53 controls; without the standard enabled you would never see NIST findings there. Option B belongs to Defender for Cloud Apps and governs SaaS app access policies, which has no bearing on subscription-level regulatory compliance.
Trap awareness The trap is treating "NIST 800-53" as an Azure Policy initiative you must assign manually, or assuming secure score already covers it. Defender for Cloud requires the standard to be enabled first; everything else follows.
Official Reference
https://learn.microsoft.com/en-us/azure/defender-for-cloud/regulatory-compliance-dashboards
This link opens the official vendor documentation in a new tab.
Exam Strategy
In SC-100 design questions, always isolate the action verb and its qualifier. "First" means the step that generates the underlying data, not a step that consumes data that does not yet exist. When a regulatory framework is named (NIST, PCI DSS, SOC), check whether Defender for Cloud assessments for it exist by default — they do not — which eliminates any option that reads compliance results, such as secure score or the compliance dashboard, until the standard is enabled.
Frequently Asked Questions
Why does NIST 800-53 not appear in the Defender for Cloud compliance dashboard by default?
Is NIST 800-53 compliance in Defender for Cloud implemented with Azure Policy?
Can secure score be used to check NIST 800-53 compliance?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
rsanx42 👍 1 Answered CC. From Microsoft Defender for Cloud, turn on a security standard. By default, Defender for Cloud assesses subscriptions against the MCSB only. NIST SP 800-53 isn't shown in the regulatory compliance dashboard until you add it as a security standard. So the first step is to go to Environment settings → your subscription → Security policies and enable NIST SP 800-53 Rev. 5. Once it's on, the regulatory compliance dashboard maps your resources against the NIST controls. https://learn.microsoft.com/en-us/azure/defender-for-cloud/assign-regulatory-compliance-standards
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-100 Questions
Access 110 questions with complete answers and detailed explanations.
View Full SC-100 Practice Test →