SQL servers should have vulnerability assessment enabled
Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.
Without Vulnerability Assessment, misconfigurations and excessive permissions can go unnoticed. Adversaries may exploit weak server or database settings to escalate privileges, exfiltrate data, or alter records, degrading confidentiality and integrity.
What this control checks
Whether SQL servers have vulnerability assessment turned on
Common pitfalls
Needs a storage location for reports
Azure SQL Server has Vulnerability Assessment configured with a defined location to persist assessment reports and scan results.
Needs an enabled security alert policy
The check requires an azurerm_mssql_server_security_alert_policy connected to the server.
Recurring scans must be enabled
The check requires an azurerm_mssql_server_vulnerability_assessment where recurring_scans.*.enabled equals true.
Audit evidence
Evidence that deployed resources meet this control: Prowler check sqlserver_vulnerability_assessment_enabled (prowler azure --checks sqlserver_vulnerability_assessment_enabled); PowerPipe controls azure_compliance.control.sql_server_and_databases_va_enabled and azure_compliance.control.sql_server_va_setting_periodic_scan_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov checks CKV2_AZURE_2 and CKV2_AZURE_3.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 5.1.4.f (an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the...) and 6.6.1.a (security patches are applied within a reasonable time after they become available;).
NIST SP 800-53 Rev 5: Mapped to RA-5 (Vulnerability Monitoring and Scanning).
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- RA-5 Vulnerability Monitoring and Scanning
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
RBI Cyber Security Framework for UCBs
- Annex I (12)
- 1 IT Governance
- 3.3 Vulnerability Management
- 4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
- 4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
- 4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
- 4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
- RA-5 Vulnerability Scanning
- 0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management
- 164.308(a)(8) Evaluation
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_and_databases_va_enabled - Checkov Checks:
CKV2_AZURE_2,CKV2_AZURE_3 - Powerpipe Controls:
azure_compliance.control.sql_server_and_databases_va_enabled,azure_compliance.control.sql_server_va_setting_periodic_scan_enabled - Prowler Check:
sqlserver_vulnerability_assessment_enabled
Last reviewed: 2026-10-15