Key vaults should have deletion protection enabled
Malicious deletion of a key vault can lead to permanent data loss. Purge protection enforces a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft can purge them during the soft delete retention period.
Malicious deletion of a key vault can lead to permanent data loss. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. Malicious insiders can purge to block recovery.
What this control checks
Key vaults should have deletion protection (purge protection) enabled
Common pitfalls
Purge protection is not enabled by default
Purge protection is an optional Key Vault behavior and is not enabled by default.
Purge protection needs soft-delete enabled
Purge protection can only be enabled once soft-delete is enabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Key vaults should have deletion protection enabled" (0b60c0b2-2dc2-4e1c-b5c9-abbed971de53); Prowler check keyvault_recoverable (prowler azure --checks keyvault_recoverable); PowerPipe controls azure_compliance.control.keyvault_purge_protection_enabled and azure_compliance.control.keyvault_vault_recoverable.
Scans of the Terraform code that flag the same setting before deployment: Checkov checks CKV_AZURE_110 and CKV_AZURE_42; KICS query "Beta - Key Vault Purge Protection Is Enabled" (cec6e005-9309-46eb-b34b-456f6eae818b); Trivy check AZU-0016.
Framework-specific interpretation
SOC 2: Mapped to PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
NIS2 Directive (EU 2022/2555): Mapped to 12.1.2.c (align the availability requirements of the assets with the delivery and recovery objectives set out in their business...), 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 4.1.1 (For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and...) and 9 more clauses.
NIST SP 800-53 Rev 5: Mapped to CP-9 (System Backup).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-05 (Assets are prioritized based on classification, criticality, resources, and impact on the mission.).
FedRAMP Moderate Baseline Rev 4: Mapped to CP-9 (Information System Backup).
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 4 Business continuity and crisis management
- 9 Cryptography
- 12 Asset management
- CP-9 System Backup
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
- 3.8.9: Protect the confidentiality of backup CUI at storage locations.
- 9.3.5 Ensure the Key Vault is Recoverable
- 8.3.5 Ensure 'Purge protection' is set to 'Enabled'
RBI Cyber Security Framework for UCBs
- Annex I (12)
- 3.1.h Public Key Infrastructure (PKI)
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-16.02B Procedures for the recovery of lost or corrupted keys are in place.
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.5 Ensure the Key Vault is Recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 3.3.5 Ensure the Key Vault is Recoverable
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
- CP-9 System Backup
- 1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.312(c)(1) Integrity
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_purge_protection_enabled - Checkov Checks:
CKV_AZURE_110,CKV_AZURE_42 - Powerpipe Controls:
azure_compliance.control.keyvault_purge_protection_enabled,azure_compliance.control.keyvault_vault_recoverable - Prowler Check:
keyvault_recoverable - Azure Policy Definition:
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 - KICS Query:
cec6e005-9309-46eb-b34b-456f6eae818b - Trivy Check:
AZU-0016
Last reviewed: 2026-10-13