Compliance Gaps and Shared Responsibility
Parent: MongoDB Compliance and Regulatory · Published reference · snapshot 2026-10-24 · skill mongodb-cohort-d624439a89da
↓ Facts as markdownall context files
Source-anchored research for Compliance Gaps and Shared Responsibility. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Problems, failure modes and limitations
- Responsibility changes with the deployment model: AWS places guest-OS patching and security-group configuration on EC2 customers, whereas Atlas assigns platform maintenance and security patching to MongoDB. A self-hosted MongoDB control checklist cannot be transferred unchanged to Atlas. (high confidence) [source]
- Network isolation should complement database authentication. A firewall misconfiguration study scanned IPv4 addresses for 15 high-risk services, including MongoDB; it found that firewall rules allowing inbound connections from TCP source port 80 or UDP source port 53 can bypass firewall policy and identified unprotected MongoDB databases. Separately, Flare documented that deploying a default-configured MongoDB container with host networking or explicit port mapping can make the instance reachable over the network without authentication. (high confidence) [source]
- Secure defaults narrow the gap: Atlas provides encryption at rest and in transit, while customer configuration duties remain. HHS separately explains that encryption alone does not satisfy all HIPAA safeguards, including integrity, availability and administrative risk management. (high confidence) (verified as of 2022-12-23) [source]
- For HIPAA cloud services that create, receive, maintain, or transmit ePHI on behalf of a covered entity or business associate, HHS says the covered entity or business associate must enter a HIPAA-compliant BAA with the CSP, and both covered entities and business associates must conduct risk analyses. A CSP that maintains ePHI for them remains a business associate even if the data is encrypted and the CSP cannot decrypt it. HHS says the CSP and customer should confirm in writing how each party will address Security Rule requirements, in the BAA or other documents. (low confidence) (verified as of 2022-12-23) [source]
- Atlas customers configure network connectivity and IP access lists; MongoDB explicitly warns against allowing access from anywhere through 0.0.0.0/0 and recommends restrictive ranges or private connectivity. This is a configuration risk, not proof of an observed breach or a quantified compliance failure. (low confidence) (verified as of 2026-10-23) [source]
Comparisons and alternatives
- A practical compliance assessment should identify inherited provider controls and remaining customer controls, then verify the deployment configuration against workload requirements. This is a synthesis of AWS control-evaluation guidance and MongoDB deployment ownership, rather than evidence that a particular deployment is compliant. (high confidence) [source]
Facts and statements
- Atlas assigns platform security and operational integrity to MongoDB, while customers retain responsibility for deployment configuration, management and data policies; the availability of compliance features does not establish that a particular customer deployment satisfies its requirements. (high confidence) (verified as of 2026-10-14) [source]
- Atlas customers must select regions and manage data lifecycle, backup retention, and backup copy regions. Compliance review should check these configuration decisions against residency and retention requirements. (high confidence) [source]
- Atlas assigns customers responsibility for enabling and filtering granular database auditing and exporting logs for long-term analysis. Sumo Logic supplies an Atlas collector configuration; its BACKUP_COUNT setting concerns the collector's own logs, so it should not be mistaken for database audit retention. (medium confidence) [source]
- Restrictive network configuration remains a customer duty. Atlas guidance warns against 0.0.0.0/0, and its compliance guidance describes resource policies that can block wildcard access-list entries. (high confidence) [source]
- Flare's January 26, 2026 study distinguished more than 200,000 discoverable MongoDB servers from approximately 3,100 lacking access restrictions; it observed wiped databases and ransom notes on 1,416 of the latter. These are study observations, not current totals or an Atlas-specific population. (low confidence) (verified as of 2026-01-26) [source]
- Flare explicitly cautions that its example container configuration alone does not expose MongoDB to the internet; reachable networking combined with missing authentication creates the dangerous deployment. An image configuration alone does not prove public data exposure. (low confidence) [source]
- Responsibility must be mapped to the actual service model. AWS assigns guest operating-system and application patching to EC2 customers; Atlas assigns underlying OS and platform maintenance to MongoDB. Applying the EC2 boundary unchanged to Atlas would misassign operational duties. (high confidence) (verified as of 2026-10-23) [source]
- MongoDB assigns customers the tasks of enabling and filtering granular database auditing, monitoring administrative activity and exporting logs to external monitoring or SIEM systems for long-term retention and analysis. Access to platform logs alone does not establish that this evidence pipeline is configured. (low confidence) (verified as of 2026-10-23) [source]
- Atlas customers choose backup policy, retention and copy regions, while MongoDB operates backups according to that policy. Atlas also offers a configurable Backup Compliance Policy protecting snapshots and oplog data for a defined retention period. These features require workload-specific retention and location decisions. (high confidence) (verified as of 2026-10-14) [source]
Children
- No children recorded.