| DP-01 |
Legacy DBFS root and mounts should be disabled in workspace |
Data Protection > UC readiness |
Medium |
All |
| DP-02 |
Workspace should be assigned to a metastore |
Data Protection > UC readiness |
High |
All |
| DP-03 |
UC metastore storage credentials should not be used directly in workspace |
Data Protection > UC readiness |
Medium |
All |
| DP-04 |
Customer-managed keys should be configured for managed services in workspace |
Data Protection > Encryption |
Low |
Enterprise |
| DP-05 |
Customer-managed keys should be configured for storage in workspace |
Data Protection > Encryption |
Low |
Enterprise |
| DP-06 |
Local disk encryption should be enabled in all workspace clusters |
Data Protection > Encryption |
Low |
All |
| DP-07 |
SQL results download should be disabled in workspace |
Data Protection > Data export |
Informational |
All |
| DP-08 |
Notebook results download should be disabled in workspace |
Data Protection > Data export |
Informational |
All |
| DP-09 |
Notebook and file export should be disabled in workspace |
Data Protection > Data export |
Informational |
All |
| DP-10 |
Copy results table to clipboard should be disabled in workspace |
Data Protection > Data export |
Informational |
All |
| HYG-01 |
Legacy features should be disabled for new workspaces |
Platform Hygiene > Platform baseline |
High |
All |
| HYG-02 |
Deprecated Databricks runtimes should not be used in workspace clusters |
Platform Hygiene > Compute hardening |
High |
All |
| HYG-03 |
User isolation should be enabled in all workspace clusters |
Platform Hygiene > Compute hardening |
High |
All |
| HYG-05 |
Automatic cluster update should be enabled in workspace |
Platform Hygiene > Compute hardening |
Medium |
ESC |
| HYG-06 |
Workspace clusters should not run longer than the configured threshold |
Platform Hygiene > Compute hardening |
Medium |
All |
| HYG-07 |
Global init scripts should not exist in workspace |
Platform Hygiene > Software supply chain |
Medium |
All |
| HYG-08 |
Global cluster libraries should not exist in workspace |
Platform Hygiene > Software supply chain |
Medium |
All |
| HYG-09 |
Git folders should be enabled in workspace |
Platform Hygiene > Software supply chain |
Medium |
All |
| HYG-10 |
Git repository allowlist should be enabled and enforced in workspace |
Platform Hygiene > Software supply chain |
Medium |
All |
| HYG-11 |
Compliance Security Profile should be automatically applied to new workspaces |
Platform Hygiene > Platform baseline |
High |
ESC |
| HYG-12 |
Compliance Security Profile should be enabled in workspace |
Platform Hygiene > Platform baseline |
High |
ESC |
| HYG-13 |
Enhanced Security Monitoring should be enabled in workspace |
Platform Hygiene > Platform baseline |
High |
ESC |
| HYG-15 |
Encryption-supported VM types should be used in all workspace clusters |
Platform Hygiene > Platform baseline |
High |
ESC |
| IAM-01 |
Personal access token maximum lifetime workspace setting should be at or below the configured threshold |
Identity & Access > Authentication |
Medium |
All |
| IAM-02 |
Personal access tokens should not have a lifetime above the configured threshold |
Identity & Access > Authentication |
Medium |
All |
| IAM-03 |
Personal access tokens should not have a lifetime above the maximum lifetime workspace setting |
Identity & Access > Authentication |
Medium |
All |
| IAM-04 |
Personal access tokens should not be nearing expiration within the configured threshold |
Identity & Access > Authentication |
High |
All |
| IAM-06 |
OpenSharing recipient token maximum lifetime metastore setting should be at or below the configured threshold |
Identity & Access > Authentication |
High |
All |
| IAM-07 |
OpenSharing recipient tokens should not have a lifetime above the configured threshold |
Identity & Access > Authentication |
Medium |
All |
| IAM-08 |
Service principal client secrets should not have a lifetime above the configured threshold |
Identity & Access > Authentication |
Medium |
All |
| IAM-09 |
Single sign-on (SSO) should be enabled for the account and all workspaces |
Identity & Access > Authentication |
High |
All |
| IAM-11 |
Users and groups should be synchronized with your identity provider |
Identity & Access > Identity governance |
High |
All |
| IAM-12 |
Automatic Identity Management (AIM) should be enabled for the account |
Identity & Access > Identity governance |
Informational |
All |
| IAM-13 |
Number of workspace admins should be at or below the configured threshold |
Identity & Access > Identity governance |
Medium |
All |
| IAM-14 |
Number of metastore admins should be at or below the configured threshold |
Identity & Access > Identity governance |
Medium |
All |
| IAM-15 |
Number of account admins should be at or below the configured threshold |
Identity & Access > Identity governance |
Medium |
All |
| IAM-16 |
Restrict Workspace Admins setting should be enabled in workspace |
Identity & Access > Identity governance |
Medium |
All |
| IAM-17 |
UC metastore admin should only be granted to non-account-admin groups |
Identity & Access > Identity governance |
High |
All |
| NET-01 |
Serverless egress control should be configured in dry-run mode or enforced for workspace |
Network Security > Egress controls |
Medium |
Enterprise |
| NET-02 |
Context-based ingress public access policy should be configured in dry-run mode or enforced for workspace |
Network Security > Ingress controls |
Informational |
Enterprise |
| NET-03 |
Context-based ingress public access policy should be configured in dry-run mode or enforced for account-level resources |
Network Security > Ingress controls |
Informational |
Enterprise |
| NET-04 |
Inbound network security should be configured in dry-run mode or enforced for workspace |
Network Security > Ingress controls |
High |
Enterprise |
| NET-05 |
Inbound network security should be configured in dry-run mode or enforced for account-level resources |
Network Security > Ingress controls |
High |
Enterprise |
| NET-06 |
IP access lists should be enforced for OpenSharing |
Network Security > Ingress controls |
Low |
All |
| NET-07 |
Secure Cluster Connectivity (No Public IP) should be enabled for classic compute |
Network Security > Ingress controls |
Medium |
All |
| NET-08 |
Front-end private connectivity should be configured for workspace |
Network Security > Ingress controls |
Low |
Enterprise |
| NET-09 |
Front-end private connectivity should be configured for account-level resources |
Network Security > Ingress controls |
Low |
Enterprise |
| NET-10 |
Serverless private connectivity should be configured to cloud resources |
Network Security > Egress controls |
Low |
Enterprise |