Azure Compliance ControlsAzure HDInsight
Azure HDInsight clusters should use encryption at host to encrypt data at rest
Azure HDInsight clusters should use encryption at host to encrypt data at rest. When you enable encryption at host, data stored on the VM host is encrypted at rest and flows encrypted to the Storage service.
What this control checks
Checks whether encryption at host is turned on for each Azure HDInsight cluster
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
hdinsight_cluster_encryption_at_host_enabled - Powerpipe Control:
azure_compliance.control.hdinsight_cluster_encryption_at_host_enabled - Azure Policy Definition:
1fd32ebd-e4c3-4e13-a54a-d7422d4d95f6
Last reviewed: 2026-10-13