SQL servers should have VA 'Periodic Recurring Scans' enabled
Azure SQL servers are evaluated for Vulnerability Assessment configuration. The check looks at whether periodic recurring scans are scheduled (e.g., weekly) for the server and its databases. Servers with scans not scheduled are identified.
Without scheduled scans, new misconfigurations and vulnerable settings can persist unnoticed, weakening confidentiality and integrity. Attackers can exploit stale permissions, unsafe firewall rules, or unpatched features to read or alter data and pivot to other resources.
What this control checks
Checks the periodic recurring scans setting for SQL server vulnerability assessment
Common pitfalls
Needs a connected vulnerability assessment
Checkov CKV2_AZURE_3 requires an azurerm_mssql_server_security_alert_policy connected to an azurerm_mssql_server_vulnerability_assessment. The recurring_scans.*.enabled attribute must equal true.
Missing assessment is flagged
Servers with Vulnerability Assessment missing or scans not scheduled are identified.
Audit evidence
Evidence that deployed resources meet this control: Prowler check sqlserver_va_periodic_recurring_scans_enabled (prowler azure --checks sqlserver_va_periodic_recurring_scans_enabled); PowerPipe control azure_compliance.control.sql_server_va_setting_periodic_scan_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_3.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.2.1 (The relevant entities shall regularly review the compliance with their policies on network and information system...).
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
RBI Cyber Security Framework for UCBs
- Annex I (12)
- 4.2.3 Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server
- 4.2.3 Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server
- 4.2.3 Ensure that Vulnerability Assessment (VA) setting 'Periodic recurring scans' is set to 'on' for each SQL server
- 4.2.3 Ensure that Vulnerability Assessment (VA) setting 'Periodic recurring scans' is set to 'on' for each SQL server
- 164.308(a)(8) Evaluation
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_va_setting_periodic_scan_enabled - Checkov Check:
CKV2_AZURE_3 - Powerpipe Control:
azure_compliance.control.sql_server_va_setting_periodic_scan_enabled - Prowler Check:
sqlserver_va_periodic_recurring_scans_enabled
Last reviewed: 2026-10-15