Cloud Storage buckets should have soft delete enabled
Google Cloud Storage buckets are assessed for Soft Delete being enabled with a non-zero retention window. Deleted objects are temporarily preserved and can be restored until the window expires.
No Soft Delete makes object deletions immediate and irreversible, undermining data availability and integrity. Accidental removal, compromised credentials, wiper malware, or misconfigured lifecycle rules can erase datasets with no recovery path, breaking RPO/RTO and legal retention expectations.
What this control checks
Checks each Cloud Storage bucket's soft delete setting to decide pass or fail
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudstorage_bucket_soft_delete_enabled (prowler gcp --checks cloudstorage_bucket_soft_delete_enabled).
Framework-specific interpretation
BSI C5:2025: Mapped to AM-07.02B (The decommissioning includes the complete and permanent deletion of all cloud service customer data, cloud service...) and PI-03.02B (The deletion procedures prevent recovery by state-of-the-art forensic means.).
Framework mappings
The clauses this control is mapped to in each framework.
- AM-07.02B The decommissioning includes the complete and permanent deletion of all cloud service customer data, cloud service derived data, cloud service provider data and account data or proper destruction of the media. However, account data is only to be deleted if the data is located in the...
- PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_cloudstorage_bucket_soft_delete_enabled - Prowler Check:
cloudstorage_bucket_soft_delete_enabled
Last reviewed: 2026-10-09