Storage accounts should have blob versioning enabled
Checks whether blob versioning is turned on for each storage account. Versioning automatically retains previous versions of blobs that are created by updates or deletes. Prowler rates this check medium severity.
Without blob versioning, overwrites can't be reverted. Deletes or ransomware remove usable copies. Mistakes or compromised identities can cause irreversible object loss and wider impact.
What this control checks
Blob versioning enabled on storage accounts
Common pitfalls
High-churn data needs separate accounts
For high-churn data, isolate into separate accounts with tailored retention to balance security and cost.
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_blob_versioning_is_enabled (prowler azure --checks storage_blob_versioning_is_enabled); PowerPipe control azure_compliance.control.storage_account_blob_versioning_enabled.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.2.2 (Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts).
CIS Azure Benchmark v5.0.0: Mapped to 9.2.3 (Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts).
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-12 (Annex I (12) - Take periodic back up of the important data and store this data 'off line' (i.e., transferring important...).
BSI C5:2025: Mapped to AM-09.01B (Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs...), OPS-09.02B (The data classification of the original data is applied to backups.) and OPS-33.02B (Patch management procedures are harmonised with the cloud service provider's overall software change management process.).
HIPAA Security Rule 2003: Mapped to 164.308(a)(7)(i) (Contingency plan), 164.308(a)(7)(ii)(A) (Data backup plan), 164.308(a)(7)(ii)(B) (Disaster recovery plan) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.2 Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts
- 9.2.3 Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts
RBI Cyber Security Framework for UCBs
- Annex I (12)
- AM-09.01B Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits.
- OPS-09.02B The data classification of the original data is applied to backups.
- OPS-33.02B Patch management procedures are harmonised with the cloud service provider's overall software change management process.
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.312(c)(1) Integrity
- 164.312(c)(2) Mechanism to authenticate electronic protected health information
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_versioning_enabled - Powerpipe Control:
azure_compliance.control.storage_account_blob_versioning_enabled - Prowler Check:
storage_blob_versioning_is_enabled
Last reviewed: 2026-10-15