Virtual machines should be protected by Azure Backup
This control checks whether each Azure virtual machine appears as a backup item in a vault. This matters because the absence of a virtual machine from the backup items in a vault shows that no backup coverage has been configured for it.
Unprotected VMs jeopardize availability and integrity. Deletion, corruption, or ransomware can wipe data, and without recovery points recovery is slow or impossible, causing extended outages, missed RPO/RTO, and cascading impact on dependent services.
What this control checks
Virtual machines must be protected by Azure Backup
Common pitfalls
Databricks and OpenShift VMs are excluded
The policy rule skips VMs whose id contains "/resourceGroups/databricks-rg-". The policy rule also skips VMs whose image publisher is "azureopenshift" or "AzureDatabricks".
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Backup should be enabled for Virtual Machines" (013e242c-8828-4970-87b3-ab247555486d); Prowler check vm_backup_enabled (prowler azure --checks vm_backup_enabled).
Framework-specific interpretation
FedRAMP Moderate Baseline Rev 4: Mapped to CP-9 (Information System Backup).
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
RBI Cyber Security Framework for UCBs
- Annex I (12)
- Annex I (6)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-09.02B The data classification of the original data is applied to backups.
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
1 more clause
- 164.312(a)(2)(ii) Emergency access procedure
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_backup_enabled - Prowler Check:
vm_backup_enabled - Azure Policy Definition:
013e242c-8828-4970-87b3-ab247555486d
Last reviewed: 2026-10-11