| name | cis-azure-storage-5.2.1 |
| description | Ensure soft delete on Recovery Services vaults is Enabled |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","recovery-services","backup","soft-delete","data-protection","retention"] |
| cis_id | 5.2.1 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.2.1 Ensure soft delete on Recovery Services vaults is Enabled (Automated)
Description
Soft delete provides additional protection for Recovery Services vault data. With soft delete enabled, deleted backup data can be recovered within the retention period.
Rationale
Important backup data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, data is retained for at least 14 days before permanent deletion, allowing for the recovery of the backup data.
Impact
There is no additional cost for backup data in the soft delete state for up to and including 14 days. However, retention beyond 14 days may incur additional charges.
Audit Procedure
Audit from Azure Portal
- Go to
Recovery Services vaults.
- Click the name of a Recovery Services vault.
- Under
Settings, click Properties.
- Under
Soft Delete and security settings, click Update.
- Ensure the box next to
Enable soft delete for cloud workloads is checked.
- Ensure the box next to
Enable soft delete and security settings for hybrid workloads is checked.
- Ensure that the
Soft delete retention period is set to an appropriate value between 14 and 180, inclusive.
- Repeat steps 1-7 for each Recovery Services vault.
Audit from Azure CLI
Run the following command to list Recovery Services vaults:
az backup vault list
For each Recovery Services vault, run the following command:
az backup vault show --resource-group <resource-group> --name <recovery-services-vault>
Ensure that under softDeleteSettings, softDeleteState is set to Enabled, enhancedSecurityState is set to Enabled, and softDeleteRetentionPeriodInDays is set to an appropriate value between 14 and 180, inclusive.
Audit from Azure Policy
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.
If referencing a printed copy, you can search Policy IDs from this URL:
https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
