Ensure Databases are Encrypted with TDE

MediumLevel 2Automatedmssql

Description

Ensure user databases are encrypted using Transparent Data Encryption (TDE). Backups of databases encrypted with TDE are automatically encrypted as well. Runs one sqlcmd query with its defaults (Windows authentication to the local default instance); set SQLCMDSERVER, SQLCMDUSER and SQLCMDPASSWORD for another instance or SQL authentication. Needs VIEW SERVER STATE / sysadmin-level read access.

How it is checked

Audit method: SQL query

sql_query

sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM sys.databases WHERE database_id > 4 AND is_encrypted <> 1;"

Expected output: 0

How it is fixed

Fix method: Guidance or infrastructure patch

Implement TDE encryption on each user database with sensitive data. More info on how to do this is available here: https://learn.microsoft.com/en- us/sql/relational-databases/security/encryption/transparent-data-encryption

Properties

Operating systems: Any
Tags: mssqldatabaseencryption
Reference: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 7.5 Ensure Databases are Encrypted with TDE

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target mssql --level 2