# Cis Azure Storage 5.2.4 > Ensure 'Use infrastructure encryption for this vault' is enabled on Recovery Services vaults - Skill: `cyberstrikeus/cis-azure-storage-5-2-4` (Agent Skill) - Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-storage-5-2-4` - Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-storage-5-2-4/raw - Safety review: PASS (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-storage-5-2-4 --- # 5.2.4 Ensure 'Use infrastructure encryption for this vault' is enabled on Recovery Services vaults (Automated) ## Description In addition to using customer-managed keys for encryption at rest in the Recovery Services vault, you can enable an additional layer of platform-managed infrastructure encryption. This dual-layer approach enhances the protection of your backup data. ## Rationale Enabling infrastructure encryption on an Azure Recovery Services vault adds a second layer of protection to backup data, enhancing security and ensuring compliance for sensitive data storage. This dual-layer strategy reduces the risk of unauthorized access by keeping data encrypted even if one layer is compromised. ## Impact Enabling infrastructure encryption on an Azure Recovery Services vault does not incur additional costs; however infrastructure encryption must be set when configuring the encryption of the vault for the first time and requires customer-managed keys for encryption at rest. Once configured, the infrastructure encryption setting cannot be changed. This recommendation is linked to `Ensure that backup data in Recovery Services vaults is encrypted using customer-managed keys (CMK)` and should be applied alongside it if you choose to implement this recommendation. ## Audit Procedure ### Audit from Azure Portal 1. Go to `Recovery Services vaults`. 2. Click the name of a Recovery Services vault. 3. Under `Settings`, click `Properties`. 4. Under `Encryption Settings`, click `Update`. 5. Under `Infrastructure encryption`, ensure the box next to `Use infrastructure encryption for this vault` is checked. 6. Repeat steps 1-5 for each Recovery Services vault. ### Audit from Azure CLI Run the following command to list Recovery Services vaults: ```bash az backup vault list ``` For each Recovery Services vault, run the following command: ```bash az backup vault encryption show --resource-group --name ``` Ensure that `infrastructureEncryptionState` is set to `Enabled`. ### Audit from PowerShell Run the following command to list Recovery Services vaults: ```powershell Get-AzRecoveryServicesVault ``` Run the following command to get the Recovery Services vault in a resource group with a given name: ```powershell $vault = Get-AzRecoveryServicesVault -ResourceGroupName -Name ``` Run the following command to get the infrastructure encryption setting for the Recovery Services vault: ```powershell $vault.Properties.EncryptionProperty.InfrastructureEncryption ``` Ensure that the command returns `Enabled`. Repeat for each Recovery Services vault. ## Expected Result - `infrastructureEncryptionState` is set to `Enabled` - In Azure Portal, `Use infrastructure encryption for this vault` is checked - PowerShell returns `Enabled` for `$vault.Properties.EncryptionProperty.InfrastructureEncryption` ## Remediation ### Remediate from Azure Portal After configuring a customer-managed key for encryption, next to `Infrastructure Encryption`, click the radio button next to `Enabled`. ### Remediate from Azure CLI For each Recovery Services vault requiring remediation, run the following command to assign a customer-managed encryption key and enable infrastructure encryption: ```bash az backup vault encryption update --resource-group --name --encryption-key-id --mi-system-assigned --infrastructure-encryption Enabled ``` Note: Use `--mi-user-assigned` with the above command to provide a UserAssigned Identity Id. ### Remediate from PowerShell For each Recovery Services vault requiring remediation, run the following command to assign a customer-managed encryption key and enable infrastructure encryption: ```powershell Set-AzRecoveryServicesVaultProperty -VaultId -EncryptionKeyId -UseSystemAssignedIdentity $true -InfrastructureEncryption ``` Note: Use `-UseSystemAssignedIdentity $false` with the above command and `-UserAssignedIdentity` to provide a UserAssigned Identity Id. ## Default Value Infrastructure encryption is disabled by default on Azure Recovery Services vaults. ## References 1. https://learn.microsoft.com/en-us/azure/backup/backup-encryption 2. https://learn.microsoft.com/en-us/cli/azure/backup/vault/encryption 3. https://learn.microsoft.com/en-us/powershell/module/az.recoveryservices/get-azrecoveryservicesvault 4. https://learn.microsoft.com/en-us/powershell/module/az.recoveryservices/set-azrecoveryservicesvaultproperty ### CIS Controls | Controls Version | Control | IG 1 | IG 2 | IG 3 | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- | | v8 | 3.11 Encrypt Sensitive Data at Rest - Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. | | X | X | | v7 | 14.8 Encrypt Sensitive Information at Rest - Encrypt all sensitive information at rest using a tool that requires a secondary authentication mechanism not integrated into the operating system, in order to access the information. | | | X | ## Profile Level 2 | Automated