Azure Compliance ControlsAzure Service Fabric
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign
Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed.
What this control checks
Service Fabric clusters must set ClusterProtectionLevel to EncryptAndSign
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicefabric_cluster_protection_level_as_encrypt_and_sign - Checkov Check:
CKV_AZURE_125 - Powerpipe Control:
azure_compliance.control.servicefabric_cluster_protection_level_as_encrypt_and_sign - Azure Policy Definition:
617c02be-7f02-4efd-8836-3180d47b6c68
Last reviewed: 2026-10-15