cis-azure-storage-5-1-1

name	cis-azure-storage-5.1.1
description	Ensure soft delete on Backup vaults is Enabled
category	cis-azure-storage
version	1.0.0
author	cyberstrike-official
tags	["cis","azure","storage","backup","backup-vaults","soft-delete"]
cis_id	5.1.1
cis_benchmark	CIS Microsoft Azure Storage Services Benchmark v1.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.1.1 Ensure soft delete on Backup vaults is Enabled (Automated)

Description

Soft delete provides additional protection for Backup vault data. With soft delete enabled, deleted backup data can be recovered within the retention period.

Rationale

Important backup data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, data is retained for at least 14 days before permanent deletion, allowing for the recovery of the backup data.

Impact

There is no additional cost for backup data in the soft delete state for up to and including 14 days. However, retention beyond 14 days may incur additional charges.

Audit Procedure

Audit from Azure Portal

1. Go to Backup vaults.
2. Click the name of a Backup vault.
3. Under Manage, click Properties.
4. Ensure Soft delete is set to Enabled or Enabled with Always-On.
5. Next to Soft delete, click Update.
6. Ensure that the Retention period is set to an appropriate value between 14 and 180, inclusive.
7. Repeat steps 1-6 for each Backup vault.

Audit from Azure CLI

Run the following command to list Backup vaults:

az dataprotection backup-vault list

For each Backup vault, run the following command:

az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>

Ensure that under softDeleteSettings, state is set to on or alwayson, and retentionDurationInDays is set to an appropriate value between 14 and 180, inclusive.

Audit from Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

• Policy ID: 9798d31d-6028-4dee-8643-46102185c016
• Name: '[Preview]: Soft delete should be enabled for Backup Vaults'

Expected Result

softDeleteSettings.state should be or , and should be between 14 and 180, inclusive.