Cognitive Services accounts should use customer-managed keys to encrypt data
Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management.
Using customer-managed keys to encrypt data at rest provides more control over the key lifecycle, including rotation and management. This is particularly relevant for organizations with related compliance requirements.
What this control checks
Cognitive Services accounts should use customer-managed keys to encrypt data
Common pitfalls
Apply only when compliance or policy requires it
This control should only be applied when required by compliance or restrictive policy requirements. If not enabled, the data will be encrypted using platform-managed keys.
Excluded API kinds default to no stored data
The list of excluded API kinds for customer-managed key, default is the list of API kinds that don't have data stored in Cognitive Services.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure AI Services resources should encrypt data at rest with a customer-managed key (CMK)" (67121cc7-ff39-4ab8-b7e3-95b84dab487d); Prowler check aiservices_account_encrypted_with_cmk (prowler azure --checks aiservices_account_encrypted_with_cmk); PowerPipe control azure_compliance.control.cognitive_account_encrypted_with_cmk.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_22.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_account_encrypted_with_cmk - Checkov Check:
CKV2_AZURE_22 - Powerpipe Control:
azure_compliance.control.cognitive_account_encrypted_with_cmk - Prowler Check:
aiservices_account_encrypted_with_cmk - Azure Policy Definition:
67121cc7-ff39-4ab8-b7e3-95b84dab487d
Last reviewed: 2026-10-11