MySQL servers should have infrastructure encryption enabled
Enable infrastructure encryption for Azure Database for MySQL servers to have higher level of assurance that the data is secure. When infrastructure encryption is enabled, the data at rest is encrypted twice using FIPS 140-2 compliant Microsoft managed keys.
Enable infrastructure encryption for Azure Database for MySQL servers to have higher level of assurance that the data is secure.
What this control checks
Checks the MySQL server infrastructure encryption setting
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Infrastructure encryption should be enabled for Azure Database for MySQL servers" (3a58212a-c829-4f13-9872-6371df2fd0b4); PowerPipe control azure_compliance.control.mysql_server_infrastructure_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_96.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_server_infrastructure_encryption_enabled - Checkov Check:
CKV_AZURE_96 - Powerpipe Control:
azure_compliance.control.mysql_server_infrastructure_encryption_enabled - Azure Policy Definition:
3a58212a-c829-4f13-9872-6371df2fd0b4
Last reviewed: 2026-10-13