Azure Compliance ControlsAzure Storage
Storage accounts should use customer-managed key for encryption
Secure your storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.
What this control checks
Storage accounts pass when encryption.keySource equals Microsoft.Keyvault; otherwise they fail.
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- 2.1.8 Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 3.1.h Public Key Infrastructure (PKI)
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- CRY-06.01B Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion.
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
- IAM-03.01AS The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
1 more clause
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- 3.9 Ensure storage for critical data are encrypted with Customer Managed Key
- 3.9 Ensure storage for critical data are encrypted with Customer Managed Key
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- 4.11 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(c)(1) Integrity
- 164.312(e)(2)(ii) Encryption
Related controls
- Storage account encryption scopes should use customer-managed keys to encrypt data at rest
- Storage accounts should prohibit public access
- Storage account access keys should have periodic regeneration configured
- Key vaults should have recoverability configured
- SQL databases should have Transparent Data Encryption enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_encryption_at_rest_using_cmk - Checkov Check:
CKV2_AZURE_1 - Powerpipe Control:
azure_compliance.control.storage_account_encryption_at_rest_using_cmk - Prowler Check:
storage_ensure_encryption_with_customer_managed_keys - Azure Policy Definition:
6fac406b-40ca-413b-bf8e-0bf964659c25
Last reviewed: 2026-10-15