Azure API for FHIR should use a customer-managed key to encrypt data at rest
Use a customer-managed key to control the encryption at rest of the data stored in Azure API for FHIR. Customer-managed keys also deliver double encryption by adding a second layer on top of the default one done with service-managed keys.
Customer-managed keys also deliver double encryption by adding a second layer of encryption on top of the default one done with service-managed keys.
What this control checks
Azure API for FHIR should use a customer-managed key to encrypt data at rest
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure API for FHIR should use a customer-managed key to encrypt data at rest" (051cba44-2429-45b9-9649-46cec11c7119); PowerPipe control azure_compliance.control.healthcare_fhir_azure_api_encrypted_at_rest_with_cmk.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
healthcare_fhir_azure_api_encrypted_at_rest_with_cmk - Powerpipe Control:
azure_compliance.control.healthcare_fhir_azure_api_encrypted_at_rest_with_cmk - Azure Policy Definition:
051cba44-2429-45b9-9649-46cec11c7119
Last reviewed: 2026-10-13