Azure Compliance ControlsAzure Storage
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption
This control identifies Azure Storage accounts containing VHD OS disks that are not encrypted with customer-managed keys (CMK). Storage accounts are encrypted using Microsoft Managed Keys by default, so accounts without CMK are flagged.
What this control checks
Storage accounts must have encryption.keySource set to Microsoft.Keyvault
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- 2.1.8 Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- CRY-06.01B Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion.
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
- IAM-03.01AS The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
1 more clause
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 4.11 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
- Batch accounts should use customer-managed keys to encrypt data
- Data factories should use customer-managed keys for encryption
- SQL managed instances should use customer-managed keys to encrypt data at rest
- Azure Data Explorer clusters should have double encryption enabled
- Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_containing_vhd_os_disk_cmk_encrypted - Checkov Check:
CKV2_AZURE_1 - Powerpipe Controls:
azure_compliance.control.storage_account_containing_vhd_os_disk_cmk_encrypted,azure_compliance.control.storage_account_encryption_at_rest_using_cmk - Prowler Check:
storage_ensure_encryption_with_customer_managed_keys - Azure Policy Definition:
f5c8be13-ecfa-4ed7-beee-fcd8a6d9519d
Last reviewed: 2026-10-15