MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher
Checks that `tls_version` on Azure Database for MySQL flexible servers permits only modern TLS for client connections. It requires `TLSv1.2` or higher and excludes `TLSv1.0` and `TLSv1.1`.
Allowing legacy TLS (TLSv1.0 / TLSv1.1) weakens confidentiality and integrity of data in transit. Attackers can force downgrades and perform man-in-the-middle interception, exposing credentials and queries or altering results, leading to unauthorized access and data exfiltration.
What this control checks
MySQL flexible server tls_version is TLSv1.2 or higher
Audit evidence
Evidence that deployed resources meet this control: Prowler check mysql_flexible_server_minimum_tls_version_12 (prowler azure --checks mysql_flexible_server_minimum_tls_version_12); PowerPipe control azure_compliance.control.mysql_flexible_server_min_tls_1_2.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...) and 6.7.2.l (apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 6 Security in network and information systems acquisition, development and maintenance
- 12 Asset management
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
1 more clause
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- 5.3.2 Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
- MySQL flexible servers should have 'require_secure_transport' set to 'ON'
- MySQL servers should have 'TLS Version' set to 'TLSV1.2' or higher
- MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'
- PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mysql_flexible_server_min_tls_1_2 - Powerpipe Control:
azure_compliance.control.mysql_flexible_server_min_tls_1_2 - Prowler Check:
mysql_flexible_server_minimum_tls_version_12
Last reviewed: 2026-10-13