Azure Compliance ControlsAzure Key Vault
Key vault keys should have automatic rotation enabled
This control evaluates each key in a Key Vault. It assesses whether the key has a rotation policy that contains a `Rotate` lifetime action, looking at the rotation policy of the key for that specific lifetime action type.
What this control checks
Key vault keys should have automatic rotation enabled
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 9 Cryptography
- 11 Access control
- 9.3.9 Ensure automatic key rotation is enabled within Azure Key Vault
- 8.3.9 Ensure automatic key rotation is enabled within Azure Key Vault
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
7 more clauses
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- CRY-14.01B The cloud service provider has documented and implemented procedures to deactivate cryptographic keys once they expire. These procedures ensure that: - Expired keys are no longer used for encryption purposes, but may still be used for decryption if necessary;- Expired keys are no...
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 3.3.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_key_automatic_rotation_enabled - Powerpipe Control:
azure_compliance.control.keyvault_key_automatic_rotation_enabled - Prowler Check:
keyvault_key_rotation_enabled - Azure Policy Definition:
d8cf8476-a2ec-4916-896e-992351803c44
Last reviewed: 2026-10-13