🛡️ Azure Managed HSM purge protection is not enabled🟢⚪

• Contextual name: 🛡️ Managed HSM purge protection is not enabled🟢⚪
• ID: /ce/ca/azure/managed-hsm/purge-protection
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A deleted Managed HSM and its deleted keys stay recoverable for a soft-delete retention period of 7 to 90 days. The Purge protection setting, Enabled or Disabled, decides whether a deleted HSM or key can be purged, which deletes it permanently, before that period ends.

Rationale

With purge protection disabled, a Managed HSM Contributor can delete and immediately purge the HSM, and a Managed HSM Crypto Officer can do the same to its keys. Unless a full HSM backup and its security domain are held, the key material is destroyed and all data encrypted with it becomes permanently unreadable, whether by mistake or sabotage.

Audit

This requirement needs manual assessment. Managed HSM resources and enablePurgeProtection are not collected.

Remediation

Open File

Remediation

A deleted Managed HSM and its deleted keys stay recoverable for a soft-delete retention period of 7 to 90 days. The Purge protection setting, Enabled or Disabled, decides whether a deleted HSM or key can be purged, which deletes it permanently, before that period ends.

Enable Purge protection on the Managed HSM using an account with Azure Resource Manager write access, such as the Managed HSM Contributor role. Verify that purge protection is enabled and that the soft-delete retention period meets the organization's recovery requirements.

Enabling purge protection is irreversible. Confirm the retention requirements before applying the change.

Automated assessment is unavailable: Managed HSM resources and enablePurgeProtection are not collected.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.3.1.4 Ensure 'Purge protection' is Set to 'Enabled' for Azure Key Vault Managed HSM (Automated)			1		no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery			27		no data