Azure Compliance ControlsAzure Database for MySQL
MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher
Checks that `tls_version` on Azure Database for MySQL flexible servers permits only modern TLS for client connections. It requires `TLSv1.2` or higher and excludes `TLSv1.0` and `TLSv1.1`.
What this control checks
MySQL flexible server tls_version is TLSv1.2 or higher
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 6 Security in network and information systems acquisition, development and maintenance
- 12 Asset management
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
1 more clause
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 5.3.2 Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
- MySQL flexible servers should have 'require_secure_transport' set to 'ON'
- MySQL servers should have 'TLS Version' set to 'TLSV1.2' or higher
- MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'
- PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_flexible_server_min_tls_1_2 - Powerpipe Control:
azure_compliance.control.mysql_flexible_server_min_tls_1_2 - Prowler Check:
mysql_flexible_server_minimum_tls_version_12
Last reviewed: 2026-10-13