SQL databases should have Transparent Data Encryption enabled
Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements. Azure SQL user databases should have Transparent Data Encryption (TDE) enabled. The master system database is excluded from evaluation.
Without TDE, data at rest remains unencrypted. Stolen backups, snapshots, or compromised storage enable offline data disclosure.
What this control checks
Azure SQL user databases (not master) must have Transparent Data Encryption enabled
Common pitfalls
master system database is excluded
The master system database is excluded from evaluation.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Transparent Data Encryption on SQL databases should be enabled" (17k78e20-9358-41c9-923c-fb736d382a12) and "Deploy SQL DB transparent data encryption" (86a912f6-9a06-4e26-b447-11b16ba8659f); Prowler check sqlserver_tde_encryption_enabled (prowler azure --checks sqlserver_tde_encryption_enabled); PowerPipe controls azure_compliance.control.sql_database_transparent_data_encryption_enabled and azure_compliance.control.sql_server_transparent_data_encryption_enabled.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention) and A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...) and 2 more clauses.
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 3.1.h Public Key Infrastructure (PKI)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-14.03B Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- 5.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_transparent_data_encryption_enabled - Checkov Check:
CKV2_AZURE_25 - Powerpipe Controls:
azure_compliance.control.sql_database_transparent_data_encryption_enabled,azure_compliance.control.sql_server_transparent_data_encryption_enabled - Prowler Check:
sqlserver_tde_encryption_enabled - Azure Policy Definitions:
17k78e20-9358-41c9-923c-fb736d382a12,86a912f6-9a06-4e26-b447-11b16ba8659f - KICS Query:
0745bb3f-60dc-43b6-90ae-67bb01fd1775
Last reviewed: 2026-10-15