What percentage of cloud providers report encryption and key management controls as not in place?
By Margareta Petrovic, Chief AI Officer, DigitalXForce. Published 22 October 2026. Last updated 22 October 2026.
52.0% of the 2,112 companies in the CSA STAR Registry report at least one Cryptography, Encryption and Key Management control as not in place, which is the highest share of any of the 17 Cloud Controls Matrix domains. The figure comes from the DigitalXForce Security Posture Benchmark 2026, which scored the published security answers of those companies, retrieved on 26 August 2026.
Data: CSA STAR Registry, retrieved 26 August 2026. Population: 2,112 companies. License: CC BY 4.0.
What the 52.0% measures
The Cloud Security Alliance publishes a questionnaire called the CAIQ, the Consensus Assessments Initiative Questionnaire, and each company in the registry answers it with yes, no or not applicable. The benchmark counts a company when at least one of its answers in the Cryptography, Encryption and Key Management domain is a no. In that domain, 2,098 companies answered at least one question, and 1,092 of them gave at least one no.
The median company scores 95.7% in this domain, which is the lowest median of the 17 domains. The 10th percentile score is 78.3%. Every other Cloud Controls Matrix domain has a median of 100.0%, so this is the domain where the typical company reports something specific that is not in place.
DigitalXForce's own twelve-domain model shows the same direction. Under that model, 54.9% of the 2,112 companies report at least one Data Protection and Encryption control not in place, the highest share of the ten DigitalXForce domains with public data.
How the gap changes with company size and industry
The size of the company changes the picture. Of the companies with more than 5,000 employees, 29.5% report an encryption and key management gap, against 49.8% to 55.6% in every smaller size band. Industry matters too: 27.6% of Cloud Infrastructure and Hosting companies report one, against 57.0% of Software and SaaS companies.
The region of the company headquarters adds a third view. In Asia-Pacific, 36.3% of companies report an encryption gap, against 55.7% in North America and 53.8% in Europe.
What the number does not say
A no answer records that a company does not consider a control in place. The benchmark does not test any company's environment, and it does not rate or rank companies. Some no answers are design choices, so a company with several of them may be more careful than a company with none. The registry is also self-selected, which means the companies that publish tend to care about security posture.
What a buyer should do
The benchmark gives five steps for a buyer, and three of them apply directly to encryption.
- Read the no answers before the yes answers, because the no answers are where the provider has told you something specific.
- Ask about encryption keys directly. If your data is regulated, ask who holds the keys, whether you can manage your own, and what happens to them at exit.
- Ask for independent evidence, such as a STAR Level 2 certification or attestation, a SOC 2 Type 2 report or an ISO/IEC 27001 certificate.
For a longer guide to this kind of review, read the DigitalXForce guide on assessing the security of your cloud service providers. A team that wants to track the same questions across all of its suppliers can use the third-party risk management module with the External Risk View. A team that wants to check the configurations of its own cloud accounts can use ESRPM, the DigitalXForce module for enterprise security risk and posture management.
DigitalXForce checks controls with Continuous Control Assurance (CCA), which uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and Continuous Control Monitoring (CCM) is the capability within it that monitors conditions, evidence and signals associated with controls.
More questions the benchmark answers
The benchmark answers four questions in detail. Each one reads the same data and links back to the full report.
Questions about this finding
Does a company that reports a no on encryption controls have a weak security program?
Not necessarily. The benchmark states that not every no is a weakness, because some answers reflect design choices that many sound companies make on purpose. A buyer should ask the provider for its reasoning before drawing a conclusion.
How current is the 52.0% figure?
The figure reflects the CSA STAR Registry as retrieved on 26 August 2026. DigitalXForce measures the benchmark again each quarter and publishes the result at the benchmark address with the date.
Can I reuse this figure?
Yes. The data and figures are published under CC BY 4.0, so anyone may reuse them, including commercially, with credit to DigitalXForce and a link to the benchmark page.
How to cite
Petrovic, M. (2026). DigitalXForce Security Posture Benchmark 2026: 2,112 companies scored on the DigitalXForce twelve-domain model. DigitalXForce. https://digitalxforce.com/research/security-posture-benchmark-2026/
The data and figures are licensed under CC BY 4.0.
