Azure Compliance ControlsAzure Storage
Storage account encryption scopes should use customer-managed keys to encrypt data at rest
Use customer-managed keys to manage the encryption at rest of your storage account encryption scopes. Customer-managed keys enable the data to be encrypted with an Azure key-vault key created and owned by you.
What this control checks
Checks whether storage account encryption scopes use customer-managed keys for encryption at rest
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_encryption_scopes_encrypted_at_rest_with_cmk - Powerpipe Control:
azure_compliance.control.storage_account_encryption_scopes_encrypted_at_rest_with_cmk - Azure Policy Definition:
b5ec538c-daa0-4006-8596-35468b9148e8
Last reviewed: 2026-10-15