Azure Compliance ControlsAzure SQL Database
SQL databases should have transparent data encryption enabled
Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements. The Prowler check covers Azure SQL user databases. It ensures encryption of database files, backups, and transaction logs at rest.
What this control checks
Azure SQL user databases must have Transparent Data Encryption (TDE) enabled; master is excluded.
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 5.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 0301.09o1Organizational.123-09.o 09.07 Media Handling
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_transparent_data_encryption_enabled - Checkov Check:
CKV2_AZURE_25 - Powerpipe Control:
azure_compliance.control.sql_database_transparent_data_encryption_enabled - Prowler Check:
sqlserver_tde_encryption_enabled - Azure Policy Definitions:
17k78e20-9358-41c9-923c-fb736d382a12,86a912f6-9a06-4e26-b447-11b16ba8659f - KICS Query:
0745bb3f-60dc-43b6-90ae-67bb01fd1775
Last reviewed: 2026-10-15