Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption
This control identifies Azure Storage accounts containing VHD OS disks that are not encrypted with customer-managed keys (CMK). Storage accounts are encrypted using Microsoft Managed Keys by default, so accounts without CMK are flagged.
Without CMK, keys are provider-controlled, reducing confidentiality and governance. This weakens data sovereignty and hinders effective crypto-shredding.
What this control checks
Storage accounts must have encryption.keySource set to Microsoft.Keyvault
Common pitfalls
Default is Microsoft Managed Keys
By default Azure Storage account is encrypted using Microsoft Managed Keys.
Red Hat OpenShift accounts are excluded
Storage accounts in resource groups managed by Azure Red Hat OpenShift are excluded from evaluation.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should use customer-managed key for encryption (excluding storage accounts managed by Azure Red Hat..." (f5c8be13-ecfa-4ed7-beee-fcd8a6d9519d); Prowler check storage_ensure_encryption_with_customer_managed_keys (prowler azure --checks storage_ensure_encryption_with_customer_managed_keys); PowerPipe controls azure_compliance.control.storage_account_containing_vhd_os_disk_cmk_encrypted and azure_compliance.control.storage_account_encryption_at_rest_using_cmk.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_1.
Framework-specific interpretation
SOC 2: Mapped to PI1.4 (System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's...) and PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
ISO/IEC 27001:2022: Mapped to A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 9.2.a (in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic...) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- 2.1.8 Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- CRY-06.01B Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion.
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
- IAM-03.01AS The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
1 more clause
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 4.11 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
- Batch accounts should use customer-managed keys to encrypt data
- Data factories should use customer-managed keys for encryption
- SQL managed instances should use customer-managed keys to encrypt data at rest
- Azure Data Explorer clusters should have double encryption enabled
- Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_containing_vhd_os_disk_cmk_encrypted - Checkov Check:
CKV2_AZURE_1 - Powerpipe Controls:
azure_compliance.control.storage_account_containing_vhd_os_disk_cmk_encrypted,azure_compliance.control.storage_account_encryption_at_rest_using_cmk - Prowler Check:
storage_ensure_encryption_with_customer_managed_keys - Azure Policy Definition:
f5c8be13-ecfa-4ed7-beee-fcd8a6d9519d
Last reviewed: 2026-10-15