Azure Compliance ControlsAzure Disk Storage
Unattached managed disks should use customer-managed keys (CMK) for encryption
Unattached Azure managed disks use Customer-Managed Keys (CMK) for server-side encryption rather than platform-managed keys. Only disks not currently attached to a VM are in scope. Prowler rates the check medium severity.
What this control checks
Unattached managed disks must be encrypted with a customer-managed key (CMK).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
2 more clauses
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-13.03B The cloud service provider protects all SIEM logs to avoid tampering and deletion.
- 7.3 Ensure that 'Unattached disks' are encrypted with CMK
- 7.3 Ensure that 'Unattached disks' are encrypted with CMK
- 7.3 Ensure that 'Unattached disks' are encrypted with CMK
- 7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
- 7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
- 8.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(d)(1) Device and media controls
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_unattached_disk_encrypted_with_cmk - Checkov Check:
CKV_AZURE_93 - Powerpipe Control:
azure_compliance.control.compute_unattached_disk_encrypted_with_cmk - Prowler Check:
vm_ensure_unattached_disks_encrypted_with_cmk
Last reviewed: 2026-10-11