Compliance security profile

This page describes the compliance security profile, its compliance controls, and supported features. To enable the compliance security profile, see Configure enhanced security and compliance settings.

Compliance security profile overview

The compliance security profile enables additional monitoring, a hardened compute image, and other features and controls on Azure Databricks workspaces. The compliance security profile includes controls that help meet the applicable security requirements of some compliance standards.

The compliance security profile is required to use Azure Databricks to process data regulated under:

• C5
• Korean Financial Security Institute (K-FSI)
• PCI-DSS
• UK Cyber Essentials Plus
• CCCS Medium (Protected B)
• TISAX
• ISMAP

You can also select to enable the compliance security profile for its enhanced security features without conforming to a compliance standard.

If you enable this feature on any workspace, you are charged for the Enhanced Security and Compliance add-on as described on the pricing page.

Compliance security profile security enhancements

Security enhancements include:

• A CIS Level 1 hardened image.

• Automatic cluster updates, ensuring clusters have the latest updates by periodically restarting them during configurable maintenance windows. See Automatic cluster update.

• Enhanced security monitoring, which includes monitoring agents that generate reviewable logs. See Monitoring agents in Azure Databricks compute plane images.

• Communications within the cluster and for egress use TLS 1.2 or higher, including communication with the metastore.

Supported preview features

Only the Public Preview, Private Preview, and Beta features listed in this section are supported for workspaces with the compliance security profile enabled. The compliance security profile does not support any other Public Preview, Private Preview, or Beta features.

The following table lists all supported Public Preview, Private Preview, and Beta features:

• Most features are available for all compliance standards with the compliance security profile enabled.
• Features marked with a specific compliance standard (such as "HIPAA only") are supported only for workspaces configured with that compliance standard.
• Features marked "Serverless" are only available on the serverless compute plane. For serverless availability by region and compliance standard, see the Regional support for features table on each compliance standard page.