Storage accounts should have infrastructure encryption enabled
Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice. Prowler checks for requireInfrastructureEncryption=true.
Without this second layer, compromise of the service-level key or algorithm can expose stored data, degrading confidentiality and weakening defense in depth. Insider misuse or key theft is more likely to yield readable blobs, files, or tables.
What this control checks
Data is encrypted twice
Common pitfalls
Setting is immutable
Plan it at creation, as the setting is immutable. Migrate data from the old account to this new account and decommission the old one (infrastructure encryption cannot be enabled on existing accounts).
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should have infrastructure encryption" (4733ea7b-a883-42fe-8cac-97454c2a9e4a); Prowler check storage_infrastructure_encryption_is_enabled (prowler azure --checks storage_infrastructure_encryption_is_enabled); PowerPipe control azure_compliance.control.storage_account_infrastructure_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0061.
Framework-specific interpretation
SOC 2: Mapped to PI1.4 (System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's...) and PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
ISO/IEC 27001:2022: Mapped to A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...) and 9.2.a (in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic...).
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-05 (Assets are prioritized based on classification, criticality, resources, and impact on the mission.).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 10.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 9.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.1.h Public Key Infrastructure (PKI)
- CRY-06.01B Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 4.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
- Storage accounts should have 'Default to Microsoft Entra authorization' enabled
- Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
- Storage account Blob services should have Storage logging enabled for read, write, and delete requests
- Container registries should use customer-managed keys for encryption
- Azure HDInsight clusters should use encryption at host to encrypt data at rest
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_infrastructure_encryption_enabled - Powerpipe Control:
azure_compliance.control.storage_account_infrastructure_encryption_enabled - Prowler Check:
storage_infrastructure_encryption_is_enabled - Azure Policy Definition:
4733ea7b-a883-42fe-8cac-97454c2a9e4a - Trivy Check:
AZU-0061
Last reviewed: 2026-10-15