Ten ISM controls you can diff, not just document

In October 2025 Microsoft warned of rising attacks on Azure Blob Storage exploiting exposed credentials and misconfiguration, and industry data attributes a large share of cloud breaches to misconfiguration. Written as Azure Policy, a control is enforced continuously and its state is a thing you can diff, not a claim in a document.

1. Misconfiguration beats zero-days. What the Blob Storage wave actually exploited.
2. Control text to code. Taking an ISM control and expressing it as enforceable policy.
3. Ten worked examples. Deny public blob access, require private endpoints, enforce encryption, and more.
4. Prove it. Compliance state as evidence an assessor can read directly.
5. Drift and remediation. What happens when someone changes a setting.

The purest expression of deployed configs, not strategy documents. Compliance-as-code is defensible in procurement and auditable by an assessor, and it shows our work is inspectable rather than asserted.

• Anchor on the Blob Storage wave to make misconfiguration concrete.
• Show real policy, even in outline; the code is the credibility.
• Stress the diff-able, provable nature; that is the value.
• Cover drift remediation, because assessors ask about it.