Azure Compliance ControlsAzure Databricks
Databricks workspaces should have a customer-managed key configured
Azure Databricks workspaces are evaluated for use of customer-managed keys (CMK) on at-rest encryption. Databricks workspaces should have a customer-managed key configured to encrypt data at rest.
What this control checks
Passes when a Databricks workspace has a customer-managed key configured, fails otherwise
Framework mappings
The clauses this control is mapped to in each framework.
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- 3.1.8 Ensure that data at rest and in transit is encrypted in Azure Databricks using customer managed keys (CMK)
- 2.1.8 Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)
- BCM-01.01B The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
- CRY-05.01AC The cloud service provider ensures that secure encryption mechanisms are in place to prevent the recovery of cloud service customer data when resources are reallocated or physical media are recovered.
- CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.310(d)(1) Device and media controls
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_cmk_configured - Powerpipe Control:
azure_compliance.control.databricks_workspace_cmk_configured - Prowler Check:
databricks_workspace_cmk_encryption_enabled
Last reviewed: 2026-10-11