Azure Key Vaults should use private link

Azure Private Link lets you connect your virtual networks to Azure services without a public IP address. By mapping private endpoints to key vault, you can reduce data leakage risks. Prowler checks that Key Vault has private endpoint connections.

What this control checks

Azure Key Vaults should use Private Link

Framework mappings

The clauses this control is mapped to in each framework.

PCI DSS v4.0

1.2.8: Network security controls (NSCs) are configured and maintained.
1.3.1: Network access to and from the cardholder data environment is restricted.
1.3.2: Network access to and from the cardholder data environment is restricted.
1.4.2: Network connections between trusted and untrusted networks are controlled.
1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks

1 more clause

A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.

NIS2 Directive (EU 2022/2555)

9 Cryptography
11 Access control

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

NIST Cybersecurity Framework v2.0

RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0

2.2.2.1 Ensure Private Endpoints are used to access {service}
9.3.8 Ensure that Private Endpoints are Used for Azure Key Vault

CIS Azure Benchmark v5.0.0

8.3.7 Ensure Public Network Access is Disabled
8.3.8 Ensure Private Endpoints are used to access Azure Key Vault

RBI Cyber Security Framework for UCBs

Annex I (1.3)

RBI IT Framework for NBFCs

3.1.h Public Key Infrastructure (PKI)

BSI C5:2025

CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and...
PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.

CIS Azure Benchmark v1.5.0