cis-azure-storage-5-2-1

name	cis-azure-storage-5.2.1
description	Ensure soft delete on Recovery Services vaults is Enabled
category	cis-azure-storage
version	1.0.0
author	cyberstrike-official
tags	["cis","azure","storage","recovery-services","backup","soft-delete","data-protection","retention"]
cis_id	5.2.1
cis_benchmark	CIS Microsoft Azure Storage Services Benchmark v1.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.2.1 Ensure soft delete on Recovery Services vaults is Enabled (Automated)

Description

Soft delete provides additional protection for Recovery Services vault data. With soft delete enabled, deleted backup data can be recovered within the retention period.

Rationale

Important backup data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, data is retained for at least 14 days before permanent deletion, allowing for the recovery of the backup data.

Impact

There is no additional cost for backup data in the soft delete state for up to and including 14 days. However, retention beyond 14 days may incur additional charges.

Audit Procedure

Audit from Azure Portal

1. Go to Recovery Services vaults.
2. Click the name of a Recovery Services vault.
3. Under Settings, click Properties.
4. Under Soft Delete and security settings, click Update.
5. Ensure the box next to Enable soft delete for cloud workloads is checked.
6. Ensure the box next to Enable soft delete and security settings for hybrid workloads is checked.
7. Ensure that the Soft delete retention period is set to an appropriate value between 14 and 180, inclusive.
8. Repeat steps 1-7 for each Recovery Services vault.

Audit from Azure CLI

Run the following command to list Recovery Services vaults:

az backup vault list

For each Recovery Services vault, run the following command:

az backup vault show --resource-group <resource-group> --name <recovery-services-vault>

Ensure that under softDeleteSettings, softDeleteState is set to Enabled, enhancedSecurityState is set to Enabled, and softDeleteRetentionPeriodInDays is set to an appropriate value between 14 and 180, inclusive.

Audit from Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions