Databricks workspaces should have a customer-managed key configured
Azure Databricks workspaces are evaluated for use of customer-managed keys (CMK) on at-rest encryption. Databricks workspaces should have a customer-managed key configured to encrypt data at rest.
Without CMK, keys are provider-controlled, degrading confidentiality and incident response. Risks include slower revoke/rotate during breaches, weaker separation of duties and audit trails, and a larger blast radius if storage or control plane is compromised.
What this control checks
Passes when a Databricks workspace has a customer-managed key configured, fails otherwise
Audit evidence
Evidence that deployed resources meet this control: Prowler check databricks_workspace_cmk_encryption_enabled (prowler azure --checks databricks_workspace_cmk_encryption_enabled); PowerPipe control azure_compliance.control.databricks_workspace_cmk_configured.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 2.1.1.2.1 (Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)) and 3.1.8 (Ensure that data at rest and in transit is encrypted in Azure Databricks using customer managed keys (CMK)).
CIS Azure Benchmark v5.0.0: Mapped to 2.1.8 (Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)).
BSI C5:2025: Mapped to BCM-01.01B (The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301...), CRY-05.01AC (The cloud service provider ensures that secure encryption mechanisms are in place to prevent the recovery of cloud...), CRY-05.01B (The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data...) and 2 more clauses.
HIPAA Security Rule 2003: Mapped to 164.308(a)(4)(ii)(A) (Isolating health care clearinghouse functions), 164.310(d)(1) (Device and media controls), 164.312(a)(2)(iv) (Encryption and decryption) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- 3.1.8 Ensure that data at rest and in transit is encrypted in Azure Databricks using customer managed keys (CMK)
- 2.1.8 Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- CRY-05.01AC The cloud service provider ensures that secure encryption mechanisms are in place to prevent the recovery of cloud service customer data when resources are reallocated or physical media are recovered.
- CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.310(d)(1) Device and media controls
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_cmk_configured - Powerpipe Control:
azure_compliance.control.databricks_workspace_cmk_configured - Prowler Check:
databricks_workspace_cmk_encryption_enabled
Last reviewed: 2026-10-11