What’s the issue?
SQL Server has supported native backup encryption since SQL Server 2014, applied with the WITH ENCRYPTION clause and protected by a server certificate or asymmetric key. When used, the backup file itself is encrypted, so its contents cannot be read without the protecting key.
However, encryption is not the default. A backup taken without encryption produces a file whose contents are readable by anyone who can open it, regardless of what permissions were required to take the backup or what protections exist on the source database.
This check identifies databases whose native full backups in the last 7 days were taken without any kind of encryption.
Why is this a problem?
An unencrypted backup is a complete, portable copy of the database that carries none of the access controls the live database has. Anyone who obtains the file can restore it on their own instance and read every table, bypassing logins, permissions, and auditing entirely.
Backups also are copied to secondary storage, replicated offsite, written to tape, handed to vendors, restored into non-production environments, and retained for years, which multiplies the number of places a readable copy can end up.
Encryption at the database level does not necessarily cover this. Always Encrypted protects only specific columns, and while TDE does encrypt backups of TDE-enabled databases, a database without TDE produces readable backups even when other protections are in place.
What should you do about this?
Review recent backup history in msdb.dbo.backupset to identify which databases are producing unencrypted backups and which process is taking them, since maintenance plans, scripts, and third-party tools each configure encryption differently.
Set up the supporting keys before changing the backup process. Create a database master key in master, create a certificate for backup encryption, and back up that certificate and its private key to a secure location separate from the backup files. Without that certificate backup, encrypted backups cannot be restored.
If native encryption is determined to be best, you can update the backup process to include WITH ENCRYPTION, specifying the algorithm and the certificate, and verify by restoring an encrypted backup on a separate instance using only the certificate backup.