Key vaults should have resource logs enabled

Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes when a security incident occurs or when your network is compromised. Key Vault needs a diagnostic setting with audit logging.

What this control checks

Key Vault has at least one diagnostic setting with audit logging enabled (AuditEvent).

Framework mappings

The clauses this control is mapped to in each framework.

SOC 2

CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures

PCI DSS v4.0

3.5.1: Primary account number (PAN) is secured wherever it is stored.
8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify
10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts

1 more clause

A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.

ISO/IEC 27001:2022

A.8.15 Logging

NIS2 Directive (EU 2022/2555)

2 Risk management policy
3 Incident handling
9 Cryptography
11 Access control

NIST SP 800-53 Rev 5

AU-6(4) Central Review And Analysis
AU-6(5) Central Review And Analysis
AU-12 Audit Record Generation
AU-12(1) System-Wide And Time-Correlated Audit Trial

NIST Cybersecurity Framework v2.0

ID.AM-03

NIST SP 800-171 Rev 2

3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions

CIS Azure Benchmark v4.0.0

7.1.1.4 Ensure that logging for Azure Key Vault is 'Enabled'

CIS Azure Benchmark v5.0.0

6.1.1.4 Ensure that logging for Azure Key Vault is 'Enabled'

RBI Cyber Security Framework for UCBs

Annex I (7.4)

BSI C5:2025

AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...

12 more clauses

DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.
OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident.
OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records.
OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.

CIS Azure Benchmark v1.3.0