Azure Compliance ControlsAzure SQL Database
SQL databases should have Transparent Data Encryption enabled
Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements. Azure SQL user databases should have Transparent Data Encryption (TDE) enabled. The master system database is excluded from evaluation.
What this control checks
Azure SQL user databases (not master) must have Transparent Data Encryption enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 3.1.h Public Key Infrastructure (PKI)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 5.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_transparent_data_encryption_enabled - Checkov Check:
CKV2_AZURE_25 - Powerpipe Controls:
azure_compliance.control.sql_database_transparent_data_encryption_enabled,azure_compliance.control.sql_server_transparent_data_encryption_enabled - Prowler Check:
sqlserver_tde_encryption_enabled - Azure Policy Definitions:
17k78e20-9358-41c9-923c-fb736d382a12,86a912f6-9a06-4e26-b447-11b16ba8659f - KICS Query:
0745bb3f-60dc-43b6-90ae-67bb01fd1775
Last reviewed: 2026-10-15