Azure Compliance ControlsAzure Automation
Automation account variables should have encryption enabled
Evaluates Azure Automation account variable assets and flags any variable where `isEncrypted` is not true. The check looks at the `isEncrypted` property of each variable asset, and every variable that does not have it set to true is reported as non-compliant.
What this control checks
Checks the encryption setting on Azure Automation account variables
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
automation_account_variable_encryption_enabled - Checkov Check:
CKV_AZURE_73 - Powerpipe Control:
azure_compliance.control.automation_account_variable_encryption_enabled - Azure Policy Definition:
3657f5a0-770e-44a3-b44e-9431ba1e9735
Last reviewed: 2026-10-11