Key vault keys should have automatic rotation enabled
This control evaluates each key in a Key Vault. It assesses whether the key has a rotation policy that contains a `Rotate` lifetime action, looking at the rotation policy of the key for that specific lifetime action type.
Without auto-rotation, keys may outlive policy, increasing exposure if material is leaked and weakening confidentiality. Expired keys without planned rollover can break decrypt/unwrap operations, impacting availability. Long-lived keys hinder incident response and enable prolonged misuse of stale versions.
What this control checks
Key vault keys should have automatic rotation enabled
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Keys should have a rotation policy ensuring that their rotation is scheduled within the specified number of days after..." (d8cf8476-a2ec-4916-896e-992351803c44); Prowler check keyvault_key_rotation_enabled (prowler azure --checks keyvault_key_rotation_enabled); PowerPipe control azure_compliance.control.keyvault_key_automatic_rotation_enabled.
Framework-specific interpretation
SOC 2: Mapped to PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
PCI DSS v4.0: Mapped to 3.7.4 (Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects...) and 3.7.5 (Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects...).
NIS2 Directive (EU 2022/2555): Mapped to 11.6.2.c (require the change of authentication credentials initially, at predefined intervals and upon suspicion that the...), 9.2.c (the relevant entities approach to key management, including, where appropriate, methods for the following:), 9.2.c.iv (storing keys, including how authorised users obtain access to keys;) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 9 Cryptography
- 11 Access control
- 9.3.9 Ensure automatic key rotation is enabled within Azure Key Vault
- 8.3.9 Ensure automatic key rotation is enabled within Azure Key Vault
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
7 more clauses
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- CRY-14.01B The cloud service provider has documented and implemented procedures to deactivate cryptographic keys once they expire. These procedures ensure that: - Expired keys are no longer used for encryption purposes, but may still be used for decryption if necessary;- Expired keys are no...
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 3.3.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_key_automatic_rotation_enabled - Powerpipe Control:
azure_compliance.control.keyvault_key_automatic_rotation_enabled - Prowler Check:
keyvault_key_rotation_enabled - Azure Policy Definition:
d8cf8476-a2ec-4916-896e-992351803c44
Last reviewed: 2026-10-13