Databricks subnets should have network security groups configured
Checks that Network Security Groups (`NSGs`) are implemented on Azure Databricks subnets to control inbound and outbound traffic. The check ensures only authorized communication is allowed to and from the workspace subnets.
Network Security Groups (NSGs) should be implemented to control inbound and outbound traffic to Azure Databricks subnets, ensuring only authorized communication.
What this control checks
Checks Databricks workspace subnets for an associated network security group
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.databricks_workspace_subnet_with_nsg_configured.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 3.1.2 (Ensure that network security groups are configured for Databricks subnets).
CIS Azure Benchmark v5.0.0: Mapped to 2.1.2 (Ensure that network security groups are configured for Databricks subnets).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.2 Ensure that network security groups are configured for Databricks subnets
- 2.1.2 Ensure that network security groups are configured for Databricks subnets
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databricks_workspace_subnet_with_nsg_configured - Powerpipe Control:
azure_compliance.control.databricks_workspace_subnet_with_nsg_configured
Last reviewed: 2026-10-11