Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign
Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed.
Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed.
What this control checks
Service Fabric clusters must set ClusterProtectionLevel to EncryptAndSign
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign" (617c02be-7f02-4efd-8836-3180d47b6c68); PowerPipe control azure_compliance.control.servicefabric_cluster_protection_level_as_encrypt_and_sign.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_125.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicefabric_cluster_protection_level_as_encrypt_and_sign - Checkov Check:
CKV_AZURE_125 - Powerpipe Control:
azure_compliance.control.servicefabric_cluster_protection_level_as_encrypt_and_sign - Azure Policy Definition:
617c02be-7f02-4efd-8836-3180d47b6c68
Last reviewed: 2026-10-15