用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-storage-5-2-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-azure-storage-5.2.1 |
| description | Ensure soft delete on Recovery Services vaults is Enabled |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","recovery-services","backup","soft-delete","data-protection","retention"] |
| cis_id | 5.2.1 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Soft delete provides additional protection for Recovery Services vault data. With soft delete enabled, deleted backup data can be recovered within the retention period.
Important backup data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, data is retained for at least 14 days before permanent deletion, allowing for the recovery of the backup data.
There is no additional cost for backup data in the soft delete state for up to and including 14 days. However, retention beyond 14 days may incur additional charges.
Recovery Services vaults.Settings, click Properties.Soft Delete and security settings, click Update.Enable soft delete for cloud workloads is checked.Enable soft delete and security settings for hybrid workloads is checked.Soft delete retention period is set to an appropriate value between 14 and 180, inclusive.Run the following command to list Recovery Services vaults:
az backup vault list
For each Recovery Services vault, run the following command:
az backup vault show --resource-group <resource-group> --name <recovery-services-vault>
Ensure that under softDeleteSettings, softDeleteState is set to Enabled, enhancedSecurityState is set to Enabled, and softDeleteRetentionPeriodInDays is set to an appropriate value between 14 and 180, inclusive.
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
31b8092a-36b8-434b-9af7-5ec844364148softDeleteSettings.softDeleteState is set to EnabledenhancedSecurityState is set to EnabledsoftDeleteRetentionPeriodInDays is between 14 and 180, inclusiveEnable soft delete for cloud workloads and Enable soft delete and security settings for hybrid workloads boxes are checkedRecovery Services vaults.Settings, click Properties.Soft Delete and security settings, click Update.Enable soft delete for cloud workloads.Enable soft delete and security settings for hybrid workloads.Soft delete retention period, set an appropriate number of days for deleted data to be retained, between 14 and 180, inclusive.Enable always-on soft delete. Note: Once enabled, this setting cannot be disabled.Confirm enabling always-on soft delete.Update.Run the following command to list Recovery Services vaults:
az backup vault list
For each Recovery Services vault requiring remediation, run the following command to enable soft delete and set an appropriate number of days for deleted data to be retained, between 14 and 180, inclusive:
az backup vault backup-properties set --resource-group <resource-group> --name <recovery-services-vault> --soft-delete-feature-state Enable --hybrid-backup-security-features Enable --soft-delete-duration <retention-duration>
Note: To enable always-on soft delete, the above command can be executed with --soft-delete-feature-state AlwaysOn. Once enabled, this setting cannot be disabled.
Soft delete is enabled by default on newly created Recovery Services vaults.
Azure Backup soft delete protection is available for the following services:
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 11.1 Establish and Maintain a Data Recovery Process - Establish and maintain a data recovery process. In the process, address the scope of data recovery activities, recovery prioritization, and the security of backup data. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. | X | X | X |
| v7 | 10.4 Ensure Protection of Backups - Ensure that backups are properly protected via physical security or encryption when they are stored, as well as when they are moved across the network. This includes remote backups and cloud services. | X | X | X |
Level 1 | Automated