Security controls reference
This feature is in Private Preview. See Enable Governance Hub Security Posture Management.
This page lists the security controls that the Security page in Governance Hub evaluates. Each control name links to guidance for remediating it. For how controls are organized and how to customize them, see Security overview.
Every control is scanned regardless of your account's platform tier. However, to remediate Enterprise controls, your account must be on the Enterprise tier. To remediate ESC controls, your account must have the Enhanced Security and Compliance (ESC) add-on.
Control ID | Control name | Category and subcategory | Default severity | |
|---|---|---|---|---|
DP-01 | Data Protection > UC readiness | Medium | All | |
DP-02 | Data Protection > UC readiness | High | All | |
DP-03 | UC metastore storage credentials should not be used directly in workspace | Data Protection > UC readiness | Medium | All |
DP-04 | Customer-managed keys should be configured for managed services in workspace | Data Protection > Encryption | Low | Enterprise |
DP-05 | Customer-managed keys should be configured for storage in workspace | Data Protection > Encryption | Low | Enterprise |
DP-06 | Local disk encryption should be enabled in all workspace clusters | Data Protection > Encryption | Low | All |
DP-07 | Data Protection > Data export | Informational | All | |
DP-08 | Data Protection > Data export | Informational | All | |
DP-09 | Data Protection > Data export | Informational | All | |
DP-10 | Copy results table to clipboard should be disabled in workspace | Data Protection > Data export | Informational | All |
HYG-01 | Platform Hygiene > Platform baseline | High | All | |
HYG-02 | Deprecated Databricks runtimes should not be used in workspace clusters | Platform Hygiene > Compute hardening | High | All |
HYG-03 | Platform Hygiene > Compute hardening | High | All | |
HYG-04 | AWS Instance Metadata Service v2 should be enforced in workspace | Platform Hygiene > Compute hardening | Low | All |
HYG-05 | Platform Hygiene > Compute hardening | Medium | ESC | |
HYG-06 | Workspace clusters should not run longer than the configured threshold | Platform Hygiene > Compute hardening | Medium | All |
HYG-07 | Platform Hygiene > Software supply chain | Medium | All | |
HYG-08 | Platform Hygiene > Software supply chain | Medium | All | |
HYG-09 | Platform Hygiene > Software supply chain | Medium | All | |
HYG-10 | Git repository allowlist should be enabled and enforced in workspace | Platform Hygiene > Software supply chain | Medium | All |
HYG-11 | Compliance Security Profile should be automatically applied to new workspaces | Platform Hygiene > Platform baseline | High | ESC |
HYG-12 | Platform Hygiene > Platform baseline | High | ESC | |
HYG-13 | Platform Hygiene > Platform baseline | High | ESC | |
IAM-01 | Identity & Access > Authentication | Medium | All | |
IAM-02 | Personal access tokens should not have a lifetime above the configured threshold | Identity & Access > Authentication | Medium | All |
IAM-03 | Personal access tokens should not have a lifetime above the maximum lifetime workspace setting | Identity & Access > Authentication | Medium | All |
IAM-04 | Personal access tokens should not be nearing expiration within the configured threshold | Identity & Access > Authentication | High | All |
IAM-06 | Identity & Access > Authentication | High | All | |
IAM-07 | OpenSharing recipient tokens should not have a lifetime above the configured threshold | Identity & Access > Authentication | Medium | All |
IAM-08 | Service principal client secrets should not have a lifetime above the configured threshold | Identity & Access > Authentication | Medium | All |
IAM-09 | Single sign-on (SSO) should be enabled for the account and all workspaces | Identity & Access > Authentication | High | All |
IAM-10 | Identity & Access > Authentication | Low | All | |
IAM-11 | Users and groups should be synchronized with your identity provider | Identity & Access > Identity governance | High | All |
IAM-12 | Automatic Identity Management (AIM) should be enabled for the account | Identity & Access > Identity governance | Informational | All |
IAM-13 | Number of workspace admins should be at or below the configured threshold | Identity & Access > Identity governance | Medium | All |
IAM-14 | Number of metastore admins should be at or below the configured threshold | Identity & Access > Identity governance | Medium | All |
IAM-15 | Number of account admins should be at or below the configured threshold | Identity & Access > Identity governance | Medium | All |
IAM-16 | Restrict Workspace Admins setting should be enabled in workspace | Identity & Access > Identity governance | Medium | All |
IAM-17 | UC metastore admin should only be granted to non-account-admin groups | Identity & Access > Identity governance | High | All |
NET-01 | Serverless egress control should be configured in dry-run mode or enforced for workspace | Network Security > Egress controls | Medium | Enterprise |
NET-02 | Network Security > Ingress controls | Informational | Enterprise | |
NET-03 | Network Security > Ingress controls | Informational | Enterprise | |
NET-04 | Inbound network security should be configured in dry-run mode or enforced for workspace | Network Security > Ingress controls | High | Enterprise |
NET-05 | Network Security > Ingress controls | High | Enterprise | |
NET-06 | Network Security > Ingress controls | Low | All | |
NET-08 | Front-end private connectivity should be configured for workspace | Network Security > Ingress controls | Low | Enterprise |
NET-09 | Front-end private connectivity should be configured for account-level resources | Network Security > Ingress controls | Low | Enterprise |
NET-10 | Serverless private connectivity should be configured to cloud resources | Network Security > Egress controls | Low | Enterprise |