Which compliance frameworks require ensure backup vault has aws backup vault lock enabled for compliance?

This security check is required by the following compliance frameworks: SEC 17a-4, FINRA, HIPAA, SOC 2.

HIGH

Ensure backup vault has AWS Backup Vault Lock enabled for compliance

Vault Lock provides WORM (Write-Once-Read-Many) protection for backups, preventing deletion even by account administrators during retention period.

Security Impact

Without Vault Lock, backups can be deleted by privileged users, violating regulatory requirements for data retention.

How to Remediate

Enable Vault Lock for compliance-critical backups. Configure minimum and maximum retention periods. Test in compliance mode first.

Affected Resources

AWS::Backup::BackupVault

Compliance Frameworks

SEC 17a-4FINRAHIPAASOC 2

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

Continuous Scanning
Automatically scans all AWS Backup resources across your AWS accounts every hour
Instant Alerts
Get notified via Slack, email, or webhooks when this misconfiguration is detected
One-Click Remediation
Fix this issue directly from the TigerGate dashboard with our guided remediation
Compliance Evidence
Automatically collect audit evidence for SEC 17a-4, FINRA, HIPAA compliance
Drift Detection
Get alerted if this configuration drifts back to an insecure state after remediation