FedRAMP Moderate
This page describes FedRAMP Moderate compliance controls in Databricks.
FedRAMP Moderate overview
FedRAMP Moderate is a U.S. federal program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services at the moderate impact level. It enables federal agencies to use cloud technologies while ensuring the protection of federal data.
Key points
- Applies to cloud services handling Controlled Unclassified Information (CUI).
- Requires compliance with NIST 800-53 moderate baseline controls.
- Emphasizes access control, incident response, continuous monitoring, and encryption.
- Databricks is a FedRAMP® Authorized Cloud Service Offering (CSO) at the moderate impact level in the AWS US East-1, US-East-2, US-West-1, US West-2 (commercial) regions.
- US Government agencies can access the Databricks on AWS FedRAMP® package on OMB Max by submitting a Package Access Request Form and submitting it to
package-access@fedramp.gov. - Additional information regarding Databricks and FedRAMP® compliance is located on the Databricks Security and Trust Center.
Enable FedRAMP Moderate compliance controls
To configure your workspace to support processing of data regulated by the FedRAMP Moderate standard, the workspace must have the compliance security profile enabled. Only specific preview features are supported for processing regulated data. For details on the compliance security profile, supported preview features, and supported regions see Compliance security profile.
You are solely responsible for verifying that sensitive information is never entered in customer-defined input fields, such as workspace names, compute resource names, tags, job names, job run names, network names, credential names, storage account names, and Git repository IDs or URLs. These fields might be stored, processed, or accessed outside the compliance boundary.
To enable FedRAMP Moderate compliance controls, see Configure enhanced security and compliance settings.
Serverless compute base environment version 5 or higher will soon be required for FedRAMP Moderate workloads on AWS. Databricks recommends upgrading to base environment version 5 now. To select a base environment for notebooks, see Select a base environment. To configure the environment for jobs, see Configure environment for job tasks.
Regional support for features
This table shows feature availability for the selected compliance standard across all supported Databricks regions. Some features may be listed as available before they are actually released.
Feature |
|
|
|
|
|---|---|---|---|---|
ABAC GRANT policies | ✓ | ✓ | ✓ | ✓ |
ABAC on Views | ✓ | ✓ | ✓ | ✓ |
AI Classify | ✓ | ✓ | ✓ | ✓ |
AI Diagnose | ✓ | ✓ | ✓ | ✓ |
AI Extract | ✓ | ✓ | ✓ | ✓ |
AI Extract Precision Mode | ✓ | ✓ | ✓ | ✓ |
AI Functions REST API | ✓ | ✓ | ✓ | ✓ |
AI ParseDocument | ✓ | ✓ | ✓ | ✓ |
AI Prep Search | ✓ | ✓ | ||
AI Query for Custom Models and External Models | ✓ | ✓ | ✓ | ✓ |
AI Search: Quality Evaluation | ||||
Access management privilege (‘MANAGE ACCESS CONTROL’) | ✓ | ✓ | ✓ | ✓ |
Advanced metadata viewing privilege ('READ METADATA') | ✓ | ✓ | ✓ | ✓ |
Agent Bricks - AI Functions | ✓ | ✓ | ✓ | ✓ |
Agent Framework: On-Behalf-Of-User Authorization | ✓ | ✓ | ✓ | ✓ |
Agent Mode APIs for Genie Agents | ✓ | ✓ | ||
Ai Enrich | ✓ | ✓ | ✓ | ✓ |
Alert Job Task | ✓ | ✓ | ✓ | ✓ |
Alerts System Table | ✓ | ✓ | ✓ | ✓ |
Anomaly Detection | ✓ | ✓ | ||
Apps Horizontal Scaling | ✓ | ✓ | ✓ | ✓ |
Attribute Based Access Control | ✓ | ✓ | ✓ | ✓ |
Auto-CDF (Change Data Feed) | ✓ | ✓ | ✓ | ✓ |
Backfills in Workflows | ✓ | ✓ | ✓ | ✓ |
Budget for Unity AI Gateway | ✓ | ✓ | ✓ | ✓ |
Chat in Genie One | ✓ | ✓ | ||
Classic Compute | ✓ | ✓ | ✓ | ✓ |
Clean Room JAR Task | ✓ | ✓ | ||
Clean Rooms | ✓ | ✓ | ||
Cleanroom Identity Resolution Partners creation | ✓ | ✓ | ||
Cluster Log Delivery to UC Volumes | ✓ | ✓ | ✓ | ✓ |
Collaborate on Databricks Asset Bundles from the workspace | ✓ | ✓ | ✓ | ✓ |
Comments on Foreign Tables | ✓ | ✓ | ✓ | ✓ |
Compute: Dedicated group clusters | ✓ | ✓ | ✓ | ✓ |
Context-based Ingress Control | ✓ | ✓ | ✓ | ✓ |
Continuous Declarative Pipelines: Standard mode and improved notifications | ✓ | ✓ | ✓ | ✓ |
Cross-Platform View Sharing | ✓ | ✓ | ✓ | ✓ |
Cross-engine ABAC | ✓ | ✓ | ||
Custom JDBC on UC Compute | ✓ | ✓ | ✓ | ✓ |
Custom LLM Serving for Databricks Model Serving | ✓ | ✓ | ✓ | ✓ |
Custom bundle templates in the workspace | ✓ | ✓ | ✓ | ✓ |
DCS-vNext | ✓ | ✓ | ✓ | ✓ |
DLT Direct Publishing Mode | ✓ | ✓ | ✓ | ✓ |
Dashboard Genie Default Enabled | ✓ | ✓ | ||
Data Classification | ✓ | ✓ | ||
Data Room (Govcloud) | ||||
Databricks Apps | ✓ | ✓ | ✓ | ✓ |
Databricks Apps - App Spaces | ✓ | ✓ | ✓ | ✓ |
Databricks Apps - Configure App Compute Size | ✓ | ✓ | ✓ | ✓ |
Databricks Apps - Install Apps from Git | ✓ | ✓ | ✓ | ✓ |
Databricks Apps - On-Behalf-Of User Authorization | ✓ | ✓ | ✓ | ✓ |
Databricks Apps - Webhook-Triggered Deployments (GitHub, Azure DevOps) | ✓ | ✓ | ✓ | ✓ |
Databricks Apps V2 | ✓ | ✓ | ✓ | ✓ |
Databricks Genie for Microsoft Teams | ✓ | ✓ | ✓ | ✓ |
Databricks Genie for Slack | ✓ | ✓ | ✓ | ✓ |
Default Python package repositories in Spark Declarative Pipelines | ✓ | ✓ | ✓ | ✓ |
Default Python package repositories in clusters created via API | ✓ | ✓ | ✓ | ✓ |
Default Python package repositories in clusters created via UI | ✓ | ✓ | ✓ | ✓ |
Default Storage | ✓ | ✓ | ✓ | ✓ |
Default warehouse setting | ✓ | ✓ | ✓ | ✓ |
Disabled tasks in Lakeflow Jobs | ✓ | ✓ | ✓ | ✓ |
Discover Page | ✓ | ✓ | ✓ | ✓ |
Domain Recommendations | ✓ | ✓ | ✓ | ✓ |
Domains and Discover | ✓ | ✓ | ✓ | ✓ |
Embed Genie as an iframe | ✓ | ✓ | ✓ | ✓ |
Enable Dashboard Local Metric Views in AI/BI Dashboards | ✓ | ✓ | ✓ | ✓ |
Enable Extended Models | ✓ | ✓ | ✓ | ✓ |
Enables remote query table-valued function (remote_query). | ✓ | ✓ | ✓ | ✓ |
Enhanced Python UDFs in Unity Catalog | ✓ | ✓ | ✓ | ✓ |
EventBridge support for file events | ✓ | ✓ | ✓ | ✓ |
Excel Add-In | ✓ | ✓ | ✓ | ✓ |
Excel File Format Support | ✓ | ✓ | ✓ | ✓ |
Expiring personal access token notifications | ✓ | ✓ | ✓ | ✓ |
Expiring service principal access token notifications | ✓ | ✓ | ✓ | ✓ |
Extend Data Classification with Custom Classifiers | ✓ | ✓ | ||
External Access to Unity Catalog Managed Delta Table | ✓ | ✓ | ✓ | ✓ |
External secrets for Unity Catalog | ✓ | ✓ | ✓ | ✓ |
Feature Store Streaming Feature Views | ✓ | ✓ | ✓ | ✓ |
Feature Views (Batch) | ✓ | ✓ | ✓ | ✓ |
File type | ✓ | ✓ | ||
Fine-Grained DML Privileges | ✓ | ✓ | ✓ | ✓ |
Focused notebook & file editor for Git folders | ✓ | ✓ | ✓ | ✓ |
Foreign Delta Table Sharing | ✓ | ✓ | ✓ | ✓ |
Full Page Genie Code | ✓ | ✓ | ✓ | ✓ |
Genie Agent Mode | ✓ | ✓ | ||
Genie Chat Sharing | ✓ | ✓ | ✓ | ✓ |
Genie Code | ✓ | ✓ | ✓ | ✓ |
Genie Code Agent Mode | ✓ | ✓ | ✓ | ✓ |
Genie Code Scheduled Tasks | ✓ | ✓ | ✓ | ✓ |
Genie Code for dashboard authoring | ✓ | ✓ | ✓ | ✓ |
Genie Data Sampling | ✓ | ✓ | ✓ | ✓ |
Genie Inspect Answer | ✓ | ✓ | ||
Genie One | ✓ | ✓ | ✓ | ✓ |
Genie One Mcp | ✓ | ✓ | ||
Genie One Memory | ✓ | ✓ | ✓ | ✓ |
Genie Space Manager Sharing | ✓ | ✓ | ✓ | ✓ |
Genie Spaces | ✓ | ✓ | ✓ | ✓ |
Git CLI support for Git folders | ✓ | ✓ | ✓ | ✓ |
Google Drive Permission Connector | ✓ | ✓ | ✓ | ✓ |
Hubspot Connector CRM Hub Objects | ✓ | ✓ | ||
Iceberg Rest Catalog Federation | ✓ | ✓ | ✓ | ✓ |
Iceberg V3 | ✓ | ✓ | ✓ | ✓ |
Import from External BI to AI/BI | ✓ | ✓ | ✓ | ✓ |
Ip Functions | ✓ | ✓ | ||
Join Pushdown for Federated Queries | ✓ | ✓ | ✓ | ✓ |
Knowledge Assistant | ✓ | ✓ | ✓ | ✓ |
LTAP Direct Writes | ||||
LakeFlow Connect for Integrated Cdc MySQL Connector | ✓ | ✓ | ✓ | ✓ |
LakeFlow Connect for Integrated Cdc Oracle Connector | ✓ | ✓ | ✓ | ✓ |
LakeFlow Connect for Integrated Cdc Sql Server Connector | ✓ | ✓ | ✓ | ✓ |
Lakebase | ||||
Lakebase CDF | ||||
Lakebase Search | ||||
Lakeflow Connect - Confluence | ✓ | ✓ | ||
Lakeflow Connect - GA4 | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect - Google Ads | ✓ | ✓ | ||
Lakeflow Connect - HubSpot | ✓ | ✓ | ||
Lakeflow Connect - Meta Ads | ✓ | ✓ | ||
Lakeflow Connect - MySQL | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect - PostgreSQL | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect - SFTP | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect - Salesforce | ✓ | ✓ | ||
Lakeflow Connect - ServiceNow | ✓ | ✓ | ||
Lakeflow Connect - TikTok Ads | ✓ | ✓ | ||
Lakeflow Connect - Workday HCM | ✓ | ✓ | ||
Lakeflow Connect - Workday Reports (RaaS) | ✓ | ✓ | ||
Lakeflow Connect - Zendesk Support | ✓ | ✓ | ||
Lakeflow Connect - Zerobus Ingest | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect API Source Connectors | ✓ | ✓ | ||
Lakeflow Connect Community Connectors | ✓ | ✓ | ||
Lakeflow Connect Query Based Connectors | ✓ | ✓ | ||
Lakeflow Connect Zerobus Ingest Govcloud | ||||
Lakeflow Connect for Aha! | ✓ | ✓ | ||
Lakeflow Connect for Akamai WAF | ✓ | ✓ | ||
Lakeflow Connect for Amplitude | ✓ | ✓ | ||
Lakeflow Connect for Anaplan | ✓ | ✓ | ||
Lakeflow Connect for Anthropic | ✓ | ✓ | ||
Lakeflow Connect for Anysphere Audit Logs | ✓ | ✓ | ||
Lakeflow Connect for Anysphere Org | ✓ | ✓ | ||
Lakeflow Connect for Atlassian Audit Logs | ✓ | ✓ | ||
Lakeflow Connect for Celigo | ✓ | ✓ | ||
Lakeflow Connect for Dynamics 365 | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect for Github | ✓ | ✓ | ||
Lakeflow Connect for Google Drive | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect for Google Search Console | ✓ | ✓ | ||
Lakeflow Connect for Google Workspace | ✓ | ✓ | ||
Lakeflow Connect for Ironclad | ✓ | ✓ | ||
Lakeflow Connect for Island Management Console | ✓ | ✓ | ||
Lakeflow Connect for Jira | ✓ | ✓ | ||
Lakeflow Connect for Kafka | ✓ | ✓ | ||
Lakeflow Connect for Microsoft 365 Unified Audit Logs | ✓ | ✓ | ||
Lakeflow Connect for Monday.com | ✓ | ✓ | ||
Lakeflow Connect for Netskope Logs | ✓ | ✓ | ||
Lakeflow Connect for Netsuite | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect for OpenAI | ✓ | ✓ | ||
Lakeflow Connect for Outlook | ✓ | ✓ | ||
Lakeflow Connect for PagerDuty | ✓ | ✓ | ||
Lakeflow Connect for Pendo | ✓ | ✓ | ||
Lakeflow Connect for Salesforce Marketing Cloud | ✓ | ✓ | ||
Lakeflow Connect for SendGrid | ✓ | ✓ | ||
Lakeflow Connect for Sharepoint | ✓ | ✓ | ✓ | ✓ |
Lakeflow Connect for Slack Access and Integration Logs | ✓ | ✓ | ||
Lakeflow Connect for Smartsheet | ✓ | ✓ | ||
Lakeflow Connect for Square | ✓ | ✓ | ||
Lakeflow Connect for Strac | ✓ | ✓ | ||
Lakeflow Connect for Verkada | ✓ | ✓ | ||
Lakeflow Connect for Vimeo | ✓ | ✓ | ||
Lakeflow Connect for Wiz Audit Logs | ✓ | ✓ | ||
Lakeflow Connect for Workiva | ✓ | ✓ | ||
Lakeflow Connect for Zip | ✓ | ✓ | ||
Lakeflow Connect for Zoho Books | ✓ | ✓ | ||
Lakeflow Connect for Zoom Logs | ✓ | ✓ | ||
Lakeflow Designer | ✓ | ✓ | ✓ | ✓ |
Lakeflow Integrations | ✓ | ✓ | ||
Lakeflow Jobs | ✓ | ✓ | ✓ | ✓ |
Lakeflow Jobs Health | ✓ | ✓ | ✓ | ✓ |
Lakeflow Pipeline Events System Table | ✓ | ✓ | ✓ | ✓ |
Lakeflow Pipelines Editor | ✓ | ✓ | ||
Lakehouse Federation Sharing | ✓ | ✓ | ||
Lakehouse Monitoring | ✓ | ✓ | ||
MLflow on Databricks | ✓ | ✓ | ✓ | ✓ |
MV and ST in Serverless Notebooks and Jobs | ✓ | ✓ | ||
Managed Disaster Recovery | ||||
Managed MCP Servers | ✓ | ✓ | ✓ | ✓ |
Managed MLflow Prompt Registry | ✓ | ✓ | ✓ | ✓ |
Marketplace - Install Databricks Apps | ✓ | ✓ | ||
Metric View Sharing | ✓ | ✓ | ✓ | ✓ |
Model Serving - AI Gateway (v1) | ✓ | ✓ | ✓ | ✓ |
Model Serving - AI Guardrail | ✓ | ✓ | ✓ | ✓ |
Model Serving - AI Playground | ✓ | ✓ | ✓ | ✓ |
Model Serving - Custom Models | ✓ | ✓ | ✓ | ✓ |
Model Serving - External Models | ✓ | ✓ | ✓ | ✓ |
Model Serving - Foundation Models AI Function (ai_query) | ✓ | ✓ | ✓ | ✓ |
Model Serving - Foundation Models Pay-Per-Token | ✓ | ✓ | ✓ | ✓ |
Model update job triggers | ✓ | ✓ | ✓ | ✓ |
Models in Unity Catalog: Deployment Jobs | ✓ | ✓ | ✓ | ✓ |
Multiple Git Credentials | ✓ | ✓ | ✓ | ✓ |
Network Accept Logs | ✓ | ✓ | ||
New compute policy form | ✓ | ✓ | ✓ | ✓ |
OAuth Custom Identity Claim | ✓ | ✓ | ||
OpenSharing | ✓ | ✓ | ✓ | ✓ |
OpenSharing SecureConnect | ✓ | ✓ | ✓ | ✓ |
OpenSharing for Default Storage – Expanded Access | ✓ | ✓ | ✓ | ✓ |
OpenTelemetry for Databricks Apps | ✓ | ✓ | ✓ | ✓ |
OpenTelemetry for Databricks Model Serving | ✓ | ✓ | ✓ | ✓ |
OpenTelemetry on Databricks | ✓ | ✓ | ✓ | ✓ |
Packaged Clean Rooms Mode | ✓ | ✓ | ||
Pages | ||||
Partial runs in Workflows | ✓ | ✓ | ✓ | ✓ |
Personal access tokens auto-scoping | ✓ | ✓ | ✓ | ✓ |
Power BI task type | ✓ | ✓ | ✓ | ✓ |
Predictive Optimization | ✓ | ✓ | ||
Private Connectivity for Performance-Intensive Services | ✓ | ✓ | ✓ | ✓ |
Production Monitoring for MLflow | ✓ | ✓ | ||
Query History & Profile for DLT | ✓ | ✓ | ✓ | ✓ |
Query performance insights | ✓ | ✓ | ✓ | ✓ |
Remote data sources write support on serverless compute | ✓ | ✓ | ✓ | ✓ |
Role-based access control (RBAC) | ✓ | ✓ | ✓ | ✓ |
Role-based access control (RBAC) account-level enablement | ✓ | ✓ | ✓ | ✓ |
SQL Alerts V2 | ✓ | ✓ | ✓ | ✓ |
Salesforce Data Cloud file sharing federation | ✓ | ✓ | ✓ | ✓ |
Sample Data Exploration with Assistant | ✓ | ✓ | ✓ | ✓ |
Scala and Java UDFs in Unity Catalog | ✓ | ✓ | ✓ | ✓ |
Scoped personal access tokens | ✓ | ✓ | ✓ | ✓ |
Secrets in Unity Catalog | ✓ | ✓ | ✓ | ✓ |
Serverless Compute Access Control | ✓ | ✓ | ||
Serverless Compute Rate Limit | ✓ | ✓ | ||
Serverless DLT/Lakeflow Workspace Preview | ✓ | ✓ | ||
Serverless Forecast Python SDK | ✓ | ✓ | ✓ | ✓ |
Serverless GPU Compute | ✓ | ✓ | ✓ | ✓ |
Serverless GPU Compute API Remote H100s | ✓ | ✓ | ✓ | ✓ |
Serverless JARs | ✓ | ✓ | ||
Serverless Jobs/Notebooks Workspace Preview | ✓ | ✓ | ||
Serverless Jobs/Workflows/Notebooks | ✓ | ✓ | ||
Serverless Lakeflow Pipelines | ✓ | ✓ | ||
Serverless Private Git | ✓ | ✓ | ||
Serverless SQL warehouses | ✓ | ✓ | ||
Serverless Workspace | ✓ | ✓ | ||
Sharepoint Permission Connector | ✓ | ✓ | ✓ | ✓ |
Sharing To Iceberg Clients | ✓ | ✓ | ✓ | ✓ |
Supervisor Agent | ✓ | ✓ | ||
System Tables Configurable Retention | ||||
Table Update Triggers on OpenSharing (Provider) | ✓ | ✓ | ✓ | ✓ |
Table Update Triggers on OpenSharing (Recipient) | ✓ | ✓ | ✓ | ✓ |
Tag Automations | ✓ | ✓ | ||
Tag Propagation | ✓ | ✓ | ✓ | ✓ |
Tag Propagation - Account Wide | ✓ | ✓ | ✓ | ✓ |
Tagging support for workspace scoped assets | ✓ | ✓ | ✓ | ✓ |
Third Party Connectors for Agents | ✓ | ✓ | ✓ | ✓ |
Time data type | ✓ | ✓ | ✓ | ✓ |
Transactions | ✓ | ✓ | ✓ | ✓ |
U2M For Service Principal | ✓ | ✓ | ✓ | ✓ |
Unified Runs List | ✓ | ✓ | ✓ | ✓ |
Unity AI Gateway | ✓ | ✓ | ✓ | ✓ |
Unity Ai Gateway Service Policies | ||||
Variant Shredding for Optimized Read Performance on Semi-Structured Data | ✓ | ✓ | ||
Vector Search (Standard) | ✓ | ✓ | ||
Vector Search (Storage Optimized) | ||||
Vector Search High QPS | ✓ | ✓ | ||
Vector Search Reranker | ✓ | ✓ | ||
Vector Search: Full-Text Search | ||||
Visual authoring: UI <> YAML Sync for DABs in the Workspace | ✓ | ✓ | ✓ | ✓ |
Warehouse Activity Details | ✓ | ✓ | ✓ | ✓ |
Warehouse Statement Timeout | ✓ | ✓ | ✓ | ✓ |
Widget Data Attachments for Dashboard Subscriptions | ✓ | ✓ | ✓ | ✓ |
Workspace base environments for serverless compute | ✓ | ✓ |