Network security group flow logs should have retention set to greater than 90 days
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days.
What this control checks
Checks the retention period setting on network security group flow logs
Common pitfalls
Retention of 0 days passes the check
retention_in_days == 0 or retention_in_days >= 90
Flow log must be enabled
'enabled' in conf and conf['enabled'][0] and 'retention_policy' in conf
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_sg_flowlog_retention_period_greater_than_90.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_12.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 8.5 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
CIS Azure Benchmark v5.0.0: Mapped to 7.5 (Ensure that network security group flow log retention days is set to greater than or equal to 90).
CIS Azure Benchmark v1.3.0: Mapped to 6.4 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
CIS Azure Benchmark v1.4.0: Mapped to 6.4 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
CIS Azure Benchmark v1.5.0: Mapped to 6.5 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
CIS Azure Benchmark v2.0.0: Mapped to 6.5 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
CIS Azure Benchmark v2.1.0: Mapped to 6.5 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
CIS Azure Benchmark v3.0.0: Mapped to 7.5 (Ensure that Network Security Group Flow Log retention period is 'greater than 90 days').
Framework mappings
The clauses this control is mapped to in each framework.
- 8.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90
- 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
Related controls
- Flow log resources should have flow logging enabled
- Network security groups should limit inbound TCP port 1433 access from the internet
- Network security groups should limit inbound TCP port 5900 access from the internet
- Azure subscriptions should have at least one Azure Bastion host
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_sg_flowlog_retention_period_greater_than_90 - Checkov Check:
CKV_AZURE_12 - Powerpipe Control:
azure_compliance.control.network_sg_flowlog_retention_period_greater_than_90
Last reviewed: 2026-10-14