Azure Compliance ControlsAzure Data Explorer
Azure Data Explorer clusters should have double encryption enabled
Checks that double encryption is enabled on Azure Data Explorer clusters. When enabled, data in the storage account is encrypted twice, once at the service level and once at the infrastructure level, using two different algorithms and two different keys.
What this control checks
Checks the double encryption setting on Azure Data Explorer (kusto) clusters
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kusto_cluster_double_encryption_enabled - Checkov Check:
CKV_AZURE_75 - Powerpipe Control:
azure_compliance.control.kusto_cluster_double_encryption_enabled - Azure Policy Definition:
ec068d99-e9c7-401f-8cef-5bdde4e6ccf1
Last reviewed: 2026-10-13