Virtual machine backup policies should have daily retention set to the configured minimum or more
Azure virtual machines are evaluated for a backup policy in a Recovery Services vault with a daily retention period that meets the configured minimum. VMs lacking protection or using a shorter retention window are identified for review.
Insufficient or missing VM backups weaken availability and integrity. Short retention reduces recovery points, limiting rollback after ransomware, accidental deletion, or faulty changes. This increases RPO, extends RTO, and can force rebuilds, causing data loss and downtime.
What this control checks
Backup policies must keep daily backups for at least the configured minimum number of days
Audit evidence
Evidence that deployed resources meet this control: Prowler check vm_sufficient_daily_backup_retention_period (prowler azure --checks vm_sufficient_daily_backup_retention_period).
Framework-specific interpretation
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-12 (Annex I (12) - Take periodic back up of the important data and store this data 'off line' (i.e., transferring important...).
BSI C5:2025: Mapped to BCM-01.01B (The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301...), OPS-06.01B (Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived...), OPS-07.01B (The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is...) and 2 more clauses.
HIPAA Security Rule 2003: Mapped to 164.308(a)(7)(i) (Contingency plan), 164.308(a)(7)(ii)(A) (Data backup plan), 164.308(a)(7)(ii)(B) (Disaster recovery plan) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
RBI Cyber Security Framework for UCBs
- Annex I (12)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
- 164.312(a)(2)(ii) Emergency access procedure
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_sufficient_daily_backup_retention_period - Prowler Check:
vm_sufficient_daily_backup_retention_period
Last reviewed: 2026-10-11