Azure Compliance ControlsAzure Key Vault
Key vaults should have soft delete enabled
Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion can lead to permanent data loss. Soft delete allows you to recover an accidentally deleted key vault.
What this control checks
Key vaults must not have enableSoftDelete set to false or missing, unless createMode is recover.
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 4 Business continuity and crisis management
- 9 Cryptography
- 12 Asset management
- CP-9 System Backup
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
- 3.8.9: Protect the confidentiality of backup CUI at storage locations.
- 9.3.5 Ensure the Key Vault is Recoverable
- 8.3.5 Ensure 'Purge protection' is set to 'Enabled'
RBI Cyber Security Framework for UCBs
- Annex I (12)
- 3.1.h Public Key Infrastructure (PKI)
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-16.02B Procedures for the recovery of lost or corrupted keys are in place.
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.5 Ensure the Key Vault is Recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 3.3.5 Ensure the Key Vault is Recoverable
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
- CP-9 System Backup
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
- 164.312(a)(2)(ii) Emergency access procedure
1 more clause
- 164.312(c)(1) Integrity
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_soft_delete_enabled - Checkov Check:
CKV_AZURE_111 - Powerpipe Controls:
azure_compliance.control.keyvault_soft_delete_enabled,azure_compliance.control.keyvault_vault_recoverable - Prowler Check:
keyvault_recoverable - Azure Policy Definitions:
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53,1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d
Last reviewed: 2026-10-13