Automation account variables should have encryption enabled
Evaluates Azure Automation account variable assets and flags any variable where `isEncrypted` is not true. The check looks at the `isEncrypted` property of each variable asset, and every variable that does not have it set to true is reported as non-compliant.
It is important to enable encryption of Automation account variable assets when storing sensitive data.
What this control checks
Checks the encryption setting on Azure Automation account variables
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Automation account variables should be encrypted" (3657f5a0-770e-44a3-b44e-9431ba1e9735); PowerPipe control azure_compliance.control.automation_account_variable_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_73.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
automation_account_variable_encryption_enabled - Checkov Check:
CKV_AZURE_73 - Powerpipe Control:
azure_compliance.control.automation_account_variable_encryption_enabled - Azure Policy Definition:
3657f5a0-770e-44a3-b44e-9431ba1e9735
Last reviewed: 2026-10-11