Azure Compliance ControlsMicrosoft Defender for Cloud
Azure subscriptions should have Microsoft Defender for Key Vault enabled
Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts. The Microsoft.Security/pricings KeyVaults plan must be Standard.
What this control checks
Microsoft.Security/pricings KeyVaults pricingTier must equal Standard on the subscription
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.5.28 Collection of evidence
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- AC-2(12) Account Monitoring for Atypical Usage
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
6 more clauses
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- SI-4: System Monitoring
NIST Cybersecurity Framework v2.0
- GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.3.4 Alert in the event of an audit logging process failure
- 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
6 more clauses
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.3 Monitor system security alerts and advisories and take action in response
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 9.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On'
- 8.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- 3.1.f Maker-checker
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 2.8 Ensure that Azure Defender is set to On for Key Vault
- 2.8 Ensure that Microsoft Defender for Key Vault is set to 'On'
- 2.1.10 Ensure That Microsoft Defender for Key Vault Is Set To 'On'
- 2.1.10 Ensure That Microsoft Defender for Key Vault Is Set To 'On'
- 2.1.9 Ensure That Microsoft Defender for Key Vault Is Set To 'On'
- 3.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On'
- AC-2(12) Account Monitoring
- AU-6 Audit Record Review, Analysis And Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
6 more clauses
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Scanning
- SI-2 Flaw Remediation
- SI-4 Information System Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_keyvault - Checkov Check:
CKV_AZURE_87 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_keyvault - Prowler Check:
defender_ensure_defender_for_keyvault_is_on - Azure Policy Definitions:
0e6763cc-5078-4e64-889d-ff4d9a839047,1f725891-01c0-420a-9059-4fa46cb770b7
Last reviewed: 2026-10-14