Storage accounts should have geo-redundant storage enabled
Checks that Azure Storage accounts use geo-redundant replication (GRS, GZRS, RA-GRS, or RA-GZRS). Data is copied to a paired secondary region. Geo-redundancy is used to create highly available applications.
Absent geo-replication, data resides in one region, undermining availability and durability during regional failures. Disasters can cause prolonged downtime or unrecoverable loss.
What this control checks
Checks the geo-redundant storage setting on storage accounts
Common pitfalls
Without RA-*, the secondary cannot be read
With geo-replication but without RA-*, the secondary is unreadable. This increases RTO and interrupts business continuity.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Geo-redundant storage should be enabled for Storage Accounts" (bf045164-79ba-4215-8f95-f8048dc1780b); Prowler check storage_geo_redundant_enabled (prowler azure --checks storage_geo_redundant_enabled); PowerPipe control azure_compliance.control.storage_account_geo_redundant_enabled.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0058.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CP-6 (Alternate Storage Site) and CP-6(1) (Separation from Primary Site).
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-11 (Backups of data are created, protected, maintained, and tested.), PR.IR-03 (Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.), RC.RP-01 (The recovery portion of the incident response plan is executed once initiated from the incident response process.) and 2 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to CP-6 (Alternate Storage Sites) and CP-6(1) (Separation From Primary Site).
Framework mappings
The clauses this control is mapped to in each framework.
- CP-6 Alternate Storage Site
- CP-6(1) Separation From Primary Site
NIST Cybersecurity Framework v2.0
- PR.DS-11: Backups of data are created, protected, maintained, and tested.
- PR.IR-03
- RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process.
- RC.RP-02
- RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
FedRAMP Moderate Baseline Rev 4
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- 10.3.12 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts
- 9.3.11 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts
RBI Cyber Security Framework for UCBs
- Annex I (12)
- PS-02.01AS The cloud service is provided from more than two locations that provide each other with redundancy. The locations are sufficiently far apart to achieve georedundancy. If two locations fail at the same time, at least one third location is still available to prevent a total service failure.
- PS-02.01B The cloud service is provided from at least two locations that provide each other with operational redundancy and resilience. The locations meet the security requirements of the cloud service provider (cf. PS-01) and are located in an adequate distance to each other to achieve...
- PS-02.02AS The georedundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met.
- PS-02.02B Operational redundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met.
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
Related controls
- Virtual machines should have disaster recovery configured
- Storage accounts should have the default network access rule set to deny
- Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
- Storage accounts should have 'Default to Microsoft Entra authorization' enabled
- Storage accounts should each have 'Enable key rotation reminders' enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_geo_redundant_enabled - Powerpipe Control:
azure_compliance.control.storage_account_geo_redundant_enabled - Prowler Check:
storage_geo_redundant_enabled - Azure Policy Definition:
bf045164-79ba-4215-8f95-f8048dc1780b - Trivy Check:
AZU-0058
Last reviewed: 2026-10-15