Google Cloud Compliance ControlsGoogle Cloud Managed Service for Apache Spark
Dataproc clusters should use customer-managed encryption keys for encryption
Dataproc cluster and job data is stored on Persistent Disks (PDs) and in a Cloud Storage staging bucket. The CMEK feature allows you to create, use, and revoke the key-encryption key (KEK). Google still controls the data encryption key (DEK).
What this control checks
Dataproc clusters must be encrypted with a customer-managed encryption key (CMEK)
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 9 Cryptography
- IA-5: Authenticator Management
- SC-28 Protection Of Information At Rest
- 8.1 Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key
- 8.1 Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key
- CRY-01.02AC The cloud provider's PQC strategy is aligned with cryptography policies and procedures and includes the following aspects: - Maintenance of an inventory of cryptographic mechanisms in use, including priority levels to each inventory item based on the impact and probabilities of the...
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).
4 more clauses
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 1.17 Ensure that dataproc cluster is encrypted using customer-managed encryption key
- 1.17 Ensure that dataproc cluster is encrypted using customer-managed encryption key
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
NIST Cybersecurity Framework v1.0
- PR.DS-1: Data-at-rest is protected.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
dataproc_cluster_encryption_with_cmek - Powerpipe Control:
gcp_compliance.control.dataproc_cluster_encryption_with_cmek - Prowler Check:
dataproc_encrypted_with_cmks_disabled
Last reviewed: 2026-10-09