MongoDB Compliance and Regulatory
Parent: MongoDB Expert Knowledge · researched 2026-05-28T15:33:10.531Z· 1 source · 12 concepts · skill mongodb-compliance
| Framework | Status | Notes |
Shared Responsibility Model
- MongoDB manages: physical security, host OS patching, database process, network isolation, encryption at rest (default), TLS in transit, automated backups, availability zones. [source]
- Customer manages: database users and access control, application-layer authorization, network access lists, audit log configuration, data classification, application-level encryption (CSFLE/QE). [source]
BAA (Business Associate Agreement)
- A BAA is required for any covered entity or business associate storing PHI in Atlas. MongoDB offers a BAA for Atlas. The BAA covers Atlas-managed clusters only. [source]
PHI Protection Patterns
- Encryption at rest: Default AES-256 (MongoDB-managed) or BYOK (AWS/Azure/GCP KMS) for additional control [source]
- Encryption in transit: TLS 1.2+ required; TLS 1.3 supported [source]
- Field-level encryption: Use Client-Side Field Level Encryption (CSFLE) or Queryable Encryption (QE) for PHI fields that need column-level protection [source]
- Access control: Dedicated database users per application component; minimal roles (principle of least privilege) [source]
- Audit logging: Enable Atlas database auditing - log all authenticate, authCheck, createCollection, dropDatabase events [source]
- Backup compliance: Enable Backup Compliance Policy (BCP) to prevent backup deletion [source]
HIPAA-Required Cluster Features
Applicable Atlas Requirements
- Requirement 2 (Secure Configuration): Use private endpoints or VPC peering; no default/test database users; rename admin user. [source]
- Requirement 3 (Cardholder Data Protection): [source]
- Never store full PAN in plaintext - use Queryable Encryption or CSFLE with AES-256 for PAN fields [source]
- Use $regex on QE fields to verify card data format without decrypting [source]
- Purge SAD (Sensitive Authentication Data) after authorization - TTL index on SAD fields [source]
- Requirement 4 (Encryption in Transit): TLS 1.2+ for all client connections. Atlas enforces TLS by default. [source]
- Requirement 7 (Restrict Access): Principle of least privilege for database users. Custom roles scoped to specific databases and collections. [source]
- Requirement 8 (Authentication): MFA on Atlas UI and API; SCRAM-SHA-256 or X.509 for database access; no shared credentials. [source]
- Requirement 10 (Audit Logging): Atlas database auditing must be enabled. Audit: authenticate, authCheck, createUser, dropUser, createCollection, dropCollection, createIndex. [source]
FedRAMP High (AtlasGov)
- AtlasGov is a separate deployment of MongoDB Atlas on Azure Government regions designed to meet FedRAMP High, DoD IL2/IL4/IL5 requirements. [source]
- Control plane: cloud.mongodbgov.com (separate from cloud.mongodb.com) [source]
- Supported regions: AZURE_US_GOV_VIRGINIA, AZURE_US_GOV_ARIZONA [source]
- Terraform: Set MONGODB_ATLAS_GOV_BASE_URL=https://cloud.mongodbgov.com/ or use mongodbatlas_cluster with government_region_name [source]
- AtlasGov is not accessible from standard Atlas accounts - requires a separate Atlas for Government account. [source]
Key Obligations
- Data Residency: Data must stay in the EU jurisdiction. Options: [source]
- Single-region Atlas cluster in EU: Simplest; all data in EU regions (e.g., EU_WEST_1, EU_CENTRAL_1) [source]
- Atlas Global Clusters with EU zone: Data with EU location prefix physically stored in EU regions only; cross-zone scatter-gather queries blocked at app layer [source]
- Right to Erasure (Right to be Forgotten): [source]
- Data Processing Agreement (DPA): MongoDB offers a DPA for Atlas. Required for EU data controllers. [source]
- Data Portability: Use mongoexport or Atlas Data Federation $out to S3 to generate user data exports. [source]
Backup Compliance Policy (BCP)
- BCP locks backup settings across all clusters in a project - prevents backup deletion and modification without multi-party authorization. Recommended for HIPAA, PCI DSS, and SOC 2. [source]
- Once enabled, BCP cannot be disabled without contacting MongoDB Support and verifying the authorized contact. [source]
Database Auditing for Compliance
- Enable Atlas database auditing (M10+) to capture: [source]
- SIEM Integration: [source]
- Atlas → S3 → AWS Security Hub / Splunk / Sumo Logic [source]
- Atlas audit log export via Admin API (hourly pull) [source]
- Atlas Sentinel integration (see mongodb-atlas-azure) [source]
- MongoDB Atlas Datadog integration → Datadog SIEM [source]
Queryable Encryption for Compliance-Sensitive Fields
Compliance-Specific Feature Gating
- Key implication: Any regulated workload (HIPAA, PCI, FedRAMP, SOC 2 with database scope) requires M10+ dedicated clusters. [source]
Anti-Patterns
- Storing PHI or PAN on M0/Flex: Non-compliant; shared infrastructure; no auditing or BYOK [source]
- Not enabling database auditing: Cannot demonstrate access controls to auditors without audit logs [source]
- Miscounting GDPR backup scope: Atlas backups retain deleted data for the configured retention period; DPA must account for this [source]
- Using 0.0.0.0/0 access list in production for any regulated workload: PCI Req 1, HIPAA, FedRAMP all require network restriction [source]
- Not setting up Backup Compliance Policy before going live: Once live data exists, BCP requires additional authorization steps; set it up pre-launch [source]
References
Children
- Atlas Compliance Certifications (frontier)
- FedRAMP and AtlasGov (frontier)
- HIPAA BAA and ePHI Configuration (frontier)
- PCI DSS Scoping and Tokenization (frontier)
- Data Residency and EU Sovereignty (frontier)
- Atlas Audit Logging (frontier)
- Encryption Requirements (At-Rest, In-Transit, Field-Level) (frontier)
- BYOK Key Management (frontier)
- Atlas Access Control and RBAC (frontier)
- Compliance Gaps and Shared Responsibility (frontier)
- Audit-Ready Architecture and Evidence Collection (frontier)
- Common Audit Findings and Remediation (frontier)
Frontier under this node: Atlas Access Control and RBAC, Atlas Compliance Certifications, Audit-Ready Architecture and Evidence Collection, BYOK Key Management, Common Audit Findings and Remediation, Compliance Gaps and Shared Responsibility, Data Residency and EU Sovereignty, Encryption Requirements (At-Rest, In-Transit, Field-Level), FedRAMP and AtlasGov, HIPAA BAA and ePHI Configuration, PCI DSS Scoping and Tokenization