SQL databases should have transparent data encryption enabled
Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements. The Prowler check covers Azure SQL user databases. It ensures encryption of database files, backups, and transaction logs at rest.
Without TDE, data at rest remains unencrypted. Stolen backups, snapshots, or compromised storage enable offline data disclosure. Attackers with substrate access can bypass DB auth, harming confidentiality and enabling exfiltration.
What this control checks
Azure SQL user databases must have Transparent Data Encryption (TDE) enabled; master is excluded.
Common pitfalls
master system database is excluded
The master system database is excluded from evaluation.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Transparent Data Encryption on SQL databases should be enabled" (17k78e20-9358-41c9-923c-fb736d382a12) and "Deploy SQL DB transparent data encryption" (86a912f6-9a06-4e26-b447-11b16ba8659f); Prowler check sqlserver_tde_encryption_enabled (prowler azure --checks sqlserver_tde_encryption_enabled); PowerPipe control azure_compliance.control.sql_database_transparent_data_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_25; KICS query "Beta - SQL Database Without Data Encryption" (0745bb3f-60dc-43b6-90ae-67bb01fd1775).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention) and A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.2 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 5.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 0301.09o1Organizational.123-09.o 09.07 Media Handling
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_transparent_data_encryption_enabled - Checkov Check:
CKV2_AZURE_25 - Powerpipe Control:
azure_compliance.control.sql_database_transparent_data_encryption_enabled - Prowler Check:
sqlserver_tde_encryption_enabled - Azure Policy Definitions:
17k78e20-9358-41c9-923c-fb736d382a12,86a912f6-9a06-4e26-b447-11b16ba8659f - KICS Query:
0745bb3f-60dc-43b6-90ae-67bb01fd1775
Last reviewed: 2026-10-15