Azure Compliance ControlsAzure Storage
Storage accounts should have infrastructure encryption enabled
Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice. Prowler checks for requireInfrastructureEncryption=true.
What this control checks
Data is encrypted twice
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 10.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 9.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.1.h Public Key Infrastructure (PKI)
- CRY-06.01B Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 4.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'
- 4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
- Storage accounts should have 'Default to Microsoft Entra authorization' enabled
- Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
- Storage account Blob services should have Storage logging enabled for read, write, and delete requests
- Container registries should use customer-managed keys for encryption
- Azure HDInsight clusters should use encryption at host to encrypt data at rest
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_infrastructure_encryption_enabled - Powerpipe Control:
azure_compliance.control.storage_account_infrastructure_encryption_enabled - Prowler Check:
storage_infrastructure_encryption_is_enabled - Azure Policy Definition:
4733ea7b-a883-42fe-8cac-97454c2a9e4a - Trivy Check:
AZU-0061
Last reviewed: 2026-10-15