Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Note
The most up-to-date Azure Security Benchmark is available here.
Ensure that all system data, configurations, and secrets are automatically backed up on a regular basis.
| Azure ID | CIS IDs | Responsibility |
|---|---|---|
| 9.1 | 10.1 | Customer |
Enable Azure Backup and configure the backup source (Azure VMs, SQL Server, or File Shares), as well as the desired frequency and retention period.
| Azure ID | CIS IDs | Responsibility |
|---|---|---|
| 9.2 | 10.2 | Customer |
Enable Azure Backup and target VM(s), as well as the desired frequency and retention periods. Backup customer managed keys within Azure Key Vault.
| Azure ID | CIS IDs | Responsibility |
|---|---|---|
| 9.3 | 10.3 | Customer |
Ensure ability to periodically perform data restoration of content within Azure Backup. Test restoration of backed up customer managed keys.
| Azure ID | CIS IDs | Responsibility |
|---|---|---|
| 9.4 | 10.4 | Customer |
For on-premises backup, encryption-at-rest is provided using the passphrase you provide when backing up to Azure. For Azure VMs, data is encrypted-at-rest using Storage Service Encryption (SSE). Use Azure role-based access control to protect backups and customer managed keys.
Enable Soft-Delete and purge protection in Key Vault to protect keys against accidental or malicious deletion. If Azure Storage is used to store backups, enable soft delete to save and recover your data when blobs or blob snapshots are deleted.
- See the next Security Control: Incident Response