OS and data disks should use customer-managed keys for encryption
Use customer-managed keys to manage the encryption at rest of the contents of your managed disks. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. By default, platform-managed keys are used.
Without CMK, you lose control over key lifecycle and access. You can't enforce independent rotation, promptly revoke keys to crypto-lock stolen copies/snapshots, or separate duties.
What this control checks
OS and data disks must be encrypted with a customer-managed key via a disk encryption set.
Common pitfalls
Platform-managed keys are the default
By default, the data is encrypted at rest with platform-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards.
Policy effect defaults to Audit
The effect parameter has a defaultValue of Audit. Its allowedValues are Audit, Deny and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "OS and data disks should be encrypted with a customer-managed key" (702dd420-7fcc-42c5-afe8-4026edd20fe0); Prowler check vm_ensure_attached_disks_encrypted_with_cmk (prowler azure --checks vm_ensure_attached_disks_encrypted_with_cmk); PowerPipe control azure_compliance.control.compute_os_and_data_disk_encrypted_with_cmk.
Framework-specific interpretation
SOC 2: Mapped to CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...) and PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
ISO/IEC 27001:2022: Mapped to A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 9.2.a (in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic...), 9.2.c (the relevant entities approach to key management, including, where appropriate, methods for the following:) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-13.03B The cloud service provider protects all SIEM logs to avoid tampering and deletion.
- 7.2 Ensure that 'OS and Data' disks are encrypted with CMK
- 7.2 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 7.2 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- 8.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(d)(1) Device and media controls
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(c)(1) Integrity
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_os_and_data_disk_encrypted_with_cmk - Powerpipe Control:
azure_compliance.control.compute_os_and_data_disk_encrypted_with_cmk - Prowler Check:
vm_ensure_attached_disks_encrypted_with_cmk - Azure Policy Definition:
702dd420-7fcc-42c5-afe8-4026edd20fe0
Last reviewed: 2026-10-11