Benchmark: SC-28(1) Cryptographic Protection
Description
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignment: organization-defined information].
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select SC-28(1) Cryptographic Protection.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.fedramp_high_sc_28_1Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.fedramp_high_sc_28_1 --shareControls
- App Service Environment should enable internal encryption
- Automation account variables should be encrypted
- Virtual machines and virtual machine scale sets should have encryption at host enabled
- Azure Stack Edge devices should use double-encryption
- Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host
- Disk encryption should be enabled on Azure Data Explorer
- Double encryption should be enabled on Azure Data Explorer
- Infrastructure encryption should be enabled for Azure Database for MySQL servers
- Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers
- Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign
- Transparent Data Encryption on SQL databases should be enabled
- Storage accounts should have infrastructure encryption