Azure Compliance ControlsFoundry Tools
Cognitive Services accounts should use customer-managed keys to encrypt data
Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management.
What this control checks
Cognitive Services accounts should use customer-managed keys to encrypt data
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_account_encrypted_with_cmk - Checkov Check:
CKV2_AZURE_22 - Powerpipe Control:
azure_compliance.control.cognitive_account_encrypted_with_cmk - Prowler Check:
aiservices_account_encrypted_with_cmk - Azure Policy Definition:
67121cc7-ff39-4ab8-b7e3-95b84dab487d
Last reviewed: 2026-10-11