Security & Trust Center

Protect Your Data With the Enhanced Security and Compliance Add-On

At Databricks, we recognize that maintaining data security and compliance is a top priority for our customers. That is why the Databricks Enhanced Security and Compliance add-on helps simplify the complexity of meeting security and regulatory requirements for our customers.

What is the Enhanced Security and Compliance add-on?

The Enhanced Security and Compliance add-on comprises three features:

Enhanced security monitoring (ESM) enables the use of enhanced hardened images, adds new security tools for behavior-based malware monitoring and provides vulnerability reports for Databricks images. 

The compliance security profile (CSP) builds on enhanced security monitoring and provides features required for compliance, like FIPS 140 encryption and cluster update enforcement.  

Automatic cluster update ensures that your clusters stay up to date with the latest host OS image and security updates.

The benefits of using enhanced security monitoring

In addition to existing Databricks security features, enhanced security monitoring provides customers with increased visibility, threat protection and security hardening for their workloads. Benefits of this offering include:

• A hardened OS image with enhanced CIS Level 1 benchmark
• Behavior-based malware monitoring and file integrity monitoring
• Malware and antivirus detection
• Vulnerability reports of the host OS*

With enhanced security monitoring, security event logs are delivered with your regular Databricks audit logs, providing comprehensive security monitoring in your organization’s SIEM or the Databricks environment. These logs include contextual information that assists analysts in quickly determining the origin of suspicious activity without requiring a lengthy investigation.

Benefits of the compliance security profile

The compliance security profile (CSP) provides customers with the applicable controls needed to meet the requirements for regulated workloads under standards like HIPAA, PCI-DSS or FedRAMP. For the complete list of supported standards, please visit the Compliance page of the Databricks Security & Trust Center.

The CSP is the most secure baseline for the data plane — and includes all of the benefits of enhanced security monitoring (ESM) — making it easier to meet and manage compliance control requirements. Key benefits of this offering include:

• ESM security enhancements listed above
• FIPS 140 Level 1 validated encryption modules (where available)
• Data-at-rest and in-transit encryption 
• Automatic cluster update with customizable maintenance window

Benefits of automatic cluster update

Automatic cluster update ensures that all classic compute resources in a workspace — including all-purpose and jobs compute, pools, classic SQL warehouses and legacy Model Serving — are periodically restarted to apply the latest host OS image and security updates. Key benefits include:

• Ensures compute resources run the latest security patches without manual intervention
• Configurable maintenance window — set the frequency (monthly or semimonthly), day and time to minimize disruption
• Enabled automatically when the compliance security profile is active
• Supports an “always restart” option to enforce restarts during every maintenance window, even when no new update is available

By default, the maintenance window is scheduled for the first Sunday of every month. Account admins can adjust the schedule from the account console. To learn more, see the documentation for AWS, Azure and GCP.