SQL servers should use customer-managed keys to encrypt data at rest
Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector. Azure SQL Server uses TDE with a customer-managed key in Azure Key Vault, and each database has TDE Enabled.
Without TDE with CMK, data at rest may be unencrypted or controlled by service keys, weakening confidentiality and key custody. Attackers or insiders could read backups, snapshots, or stolen disks, and you cannot enforce rotation, revocation, or separation of duties, raising compliance and incident response risks.
What this control checks
SQL server TDE protector uses a customer-managed key (AzureKeyVault) and databases have TDE
Common pitfalls
Every database needs TDE enabled
Use a customer-managed TDE protector in Azure Key Vault or Managed HSM and ensure TDE is Enabled for every database.
Policy effect defaults to Audit
The effect parameter has allowed values Audit, Deny and Disabled. Its defaultValue is Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "SQL servers should use customer-managed keys to encrypt data at rest" (0a370ff3-6cab-4e85-8995-295fd854c5b8); Prowler check sqlserver_tde_encrypted_with_cmk (prowler azure --checks sqlserver_tde_encrypted_with_cmk); PowerPipe control azure_compliance.control.sql_server_tde_protector_cmk_encrypted.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention) and A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 9.2.a (in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic...) and 3 more clauses.
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 9 Cryptography
- 12 Asset management
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
4 more clauses
- OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.
- OPS-13.03B The cloud service provider protects all SIEM logs to avoid tampering and deletion.
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.5 Ensure SQL server's TDE protector is encrypted with Customer-managed key
- 4.6 Ensure SQL server's TDE protector is encrypted with Customer-managed key
- 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- 5.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 0304.09o3Organizational.1-09.o 09.07 Media Handling
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
- SQL managed instances should use customer-managed keys to encrypt data at rest
- Storage accounts should use Microsoft-managed key for encryption
- Azure Data Explorer clusters should have double encryption enabled
- HPC Cache accounts should use customer-managed keys for encryption
- Automation account variables should have encryption enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_tde_protector_cmk_encrypted - Powerpipe Control:
azure_compliance.control.sql_server_tde_protector_cmk_encrypted - Prowler Check:
sqlserver_tde_encrypted_with_cmk - Azure Policy Definition:
0a370ff3-6cab-4e85-8995-295fd854c5b8
Last reviewed: 2026-10-15