Azure Compliance ControlsAzure Disk Storage
OS and data disks should use customer-managed keys for encryption
Use customer-managed keys to manage the encryption at rest of the contents of your managed disks. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. By default, platform-managed keys are used.
What this control checks
OS and data disks must be encrypted with a customer-managed key via a disk encryption set.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-13.03B The cloud service provider protects all SIEM logs to avoid tampering and deletion.
- 7.2 Ensure that 'OS and Data' disks are encrypted with CMK
- 7.2 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 7.2 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 8.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(d)(1) Device and media controls
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(c)(1) Integrity
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_os_and_data_disk_encrypted_with_cmk - Powerpipe Control:
azure_compliance.control.compute_os_and_data_disk_encrypted_with_cmk - Prowler Check:
vm_ensure_attached_disks_encrypted_with_cmk - Azure Policy Definition:
702dd420-7fcc-42c5-afe8-4026edd20fe0
Last reviewed: 2026-10-11