Azure Compliance ControlsAzure Key Vault
Key vaults should have recoverability configured
Malicious deletion of a key vault can lead to permanent data loss. Purge protection and soft delete prevent permanent data loss. Purge protection enforces a mandatory retention period for soft deleted key vaults.
What this control checks
Key vaults must have purge protection and soft delete enabled
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
- 9.3.5 Ensure the Key Vault is Recoverable
- 8.4 Ensure the key vault is recoverable
- 8.5 Enable role-based access control (RBAC) within Azure Kubernetes Services
- 8.6 Ensure the key vault is recoverable
- 8.7 Enable role-based access control (RBAC) within Azure Kubernetes Services
- 8.5 Ensure the key vault is recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 3.3.5 Ensure the Key Vault is Recoverable
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_vault_recoverable - Checkov Checks:
CKV_AZURE_110,CKV_AZURE_42 - Powerpipe Controls:
azure_compliance.control.keyvault_purge_protection_enabled,azure_compliance.control.keyvault_vault_recoverable - Azure Policy Definition:
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 - KICS Query:
cec6e005-9309-46eb-b34b-456f6eae818b
Last reviewed: 2026-10-13