Azure Stack Edge devices should have double encryption enabled
Azure Stack Edge devices should use double-encryption. Double encryption is the use of two layers of encryption: BitLocker XTS-AES 256-bit encryption on the data volumes and built-in encryption of the hard drives.
To secure the data at rest on the device, ensure it's double-encrypted, the access to data is controlled, and once the device is deactivated, the data is securely erased off the data disks.
What this control checks
Checks that double encryption uses BitLocker XTS-AES 256-bit plus built-in drive encryption
Common pitfalls
Policy effect depends on the sku.name notIn list
The policy applies its effect when Microsoft.DataboxEdge/DataBoxEdgeDevices/sku.name is notIn a list of SKUs. The list includes TEA_1Node, TMA, EdgePR_Base and EdgeMR_Mini.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Stack Edge devices should use double-encryption" (b4ac1030-89c5-4697-8e00-28b5ba6a8811); PowerPipe control azure_compliance.control.databox_edge_device_double_encryption_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databox_edge_device_double_encryption_enabled - Powerpipe Control:
azure_compliance.control.databox_edge_device_double_encryption_enabled - Azure Policy Definition:
b4ac1030-89c5-4697-8e00-28b5ba6a8811
Last reviewed: 2026-10-11