SQL servers should use customer-managed keys to encrypt data at rest
Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector. Azure SQL Server uses TDE with a customer-managed key in Azure Key Vault, and each database has TDE Enabled.
What this control checks
Azure Policy 0a370ff3-6cab-4e85-8995-295fd854c5b8 flags a Microsoft.Sql/servers resource when Microsoft.Sql/servers/keyid does not exist or equals an empty string. The same policy flags a Microsoft.Sql/servers/encryptionProtector resource when serverKeyType is not equal to AzureKeyVault. Prowler check sqlserver_tde_encrypted_with_cmk looks at microsoft.sql/servers and wants a customer-managed TDE protector in Azure Key Vault or Managed HSM with TDE Enabled for every database. Powerpipe control sql_server_tde_protector_cmk_encrypted is titled "SQL servers should use customer-managed keys to encrypt data at rest".
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
4 more clauses
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-13.03B The cloud service provider protects all SIEM logs to avoid tampering and deletion.
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.5 Ensure SQL server's TDE protector is encrypted with Customer-managed key
- 4.6 Ensure SQL server's TDE protector is encrypted with Customer-managed key
- 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- 5.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 0304.09o3Organizational.1-09.o 09.07 Media Handling
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
- SQL managed instances should use customer-managed keys to encrypt data at rest
- Storage accounts should use Microsoft-managed key for encryption
- Azure Data Explorer clusters should have double encryption enabled
- HPC Cache accounts should use customer-managed keys for encryption
- Automation account variables should have encryption enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_tde_protector_cmk_encrypted - Powerpipe Control:
azure_compliance.control.sql_server_tde_protector_cmk_encrypted - Prowler Check:
sqlserver_tde_encrypted_with_cmk - Azure Policy Definition:
0a370ff3-6cab-4e85-8995-295fd854c5b8
Last reviewed: 2026-10-15