Azure Compliance ControlsAzure Key Vault
Key vaults should have deletion protection enabled
Malicious deletion of a key vault can lead to permanent data loss. Purge protection enforces a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft can purge them during the soft delete retention period.
What this control checks
Key vaults should have deletion protection (purge protection) enabled
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 4 Business continuity and crisis management
- 9 Cryptography
- 12 Asset management
- CP-9 System Backup
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
- 3.8.9: Protect the confidentiality of backup CUI at storage locations.
- 9.3.5 Ensure the Key Vault is Recoverable
- 8.3.5 Ensure 'Purge protection' is set to 'Enabled'
RBI Cyber Security Framework for UCBs
- Annex I (12)
- 3.1.h Public Key Infrastructure (PKI)
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-16.02B Procedures for the recovery of lost or corrupted keys are in place.
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.5 Ensure the Key Vault is Recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 3.3.5 Ensure the Key Vault is Recoverable
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
- CP-9 System Backup
- 1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.312(c)(1) Integrity
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_purge_protection_enabled - Checkov Checks:
CKV_AZURE_110,CKV_AZURE_42 - Powerpipe Controls:
azure_compliance.control.keyvault_purge_protection_enabled,azure_compliance.control.keyvault_vault_recoverable - Prowler Check:
keyvault_recoverable - Azure Policy Definition:
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 - KICS Query:
cec6e005-9309-46eb-b34b-456f6eae818b - Trivy Check:
AZU-0016
Last reviewed: 2026-10-13