Key vaults should have soft delete enabled
Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion can lead to permanent data loss. Soft delete allows you to recover an accidentally deleted key vault.
Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of a key vault can lead to permanent data loss.
What this control checks
Key vaults must not have enableSoftDelete set to false or missing, unless createMode is recover.
Common pitfalls
Checkov passes when the block is missing
The check CKV_AZURE_111 inspects soft_delete_enabled on azurerm_key_vault. It is created with missing_block_result=CheckResult.PASSED.
Soft delete alone does not make a vault recoverable
Azure Key Vault recoverability requires both enable_soft_delete and enable_purge_protection.
Recover createMode is exempt from the check
The policy rule only applies when Microsoft.KeyVault/vaults/createMode does not equal recover.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Key vaults should have deletion protection enabled" (0b60c0b2-2dc2-4e1c-b5c9-abbed971de53) and "Key vaults should have soft delete enabled" (1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d); Prowler check keyvault_recoverable (prowler azure --checks keyvault_recoverable); PowerPipe controls azure_compliance.control.keyvault_soft_delete_enabled and azure_compliance.control.keyvault_vault_recoverable.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_111.
Framework-specific interpretation
SOC 2: Mapped to PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
NIS2 Directive (EU 2022/2555): Mapped to 12.1.2.c (align the availability requirements of the assets with the delivery and recovery objectives set out in their business...), 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 4.1.1 (For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and...) and 9 more clauses.
NIST SP 800-53 Rev 5: Mapped to CP-9 (System Backup).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-05 (Assets are prioritized based on classification, criticality, resources, and impact on the mission.).
FedRAMP Moderate Baseline Rev 4: Mapped to CP-9 (Information System Backup).
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 4 Business continuity and crisis management
- 9 Cryptography
- 12 Asset management
- CP-9 System Backup
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
- 3.8.9: Protect the confidentiality of backup CUI at storage locations.
- 9.3.5 Ensure the Key Vault is Recoverable
- 8.3.5 Ensure 'Purge protection' is set to 'Enabled'
RBI Cyber Security Framework for UCBs
- Annex I (12)
- 3.1.h Public Key Infrastructure (PKI)
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-16.02B Procedures for the recovery of lost or corrupted keys are in place.
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.5 Ensure the Key Vault is Recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 3.3.5 Ensure the Key Vault is Recoverable
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
- CP-9 System Backup
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
- 164.312(a)(2)(ii) Emergency access procedure
1 more clause
- 164.312(c)(1) Integrity
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_soft_delete_enabled - Checkov Check:
CKV_AZURE_111 - Powerpipe Controls:
azure_compliance.control.keyvault_soft_delete_enabled,azure_compliance.control.keyvault_vault_recoverable - Prowler Check:
keyvault_recoverable - Azure Policy Definitions:
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53,1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d
Last reviewed: 2026-10-13