Azure Compliance ControlsAzure Virtual Machines
Virtual machine backup policies should have daily retention set to the configured minimum or more
Azure virtual machines are evaluated for a backup policy in a Recovery Services vault with a daily retention period that meets the configured minimum. VMs lacking protection or using a shorter retention window are identified for review.
What this control checks
Backup policies must keep daily backups for at least the configured minimum number of days
Framework mappings
The clauses this control is mapped to in each framework.
RBI Cyber Security Framework for UCBs
- Annex I (12)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
- 164.312(a)(2)(ii) Emergency access procedure
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_sufficient_daily_backup_retention_period - Prowler Check:
vm_sufficient_daily_backup_retention_period
Last reviewed: 2026-10-11