Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption
Customer-Supplied Encryption Keys (CSEK) are a feature in Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data.
Without CSEK, encryption depends on provider-managed keys, reducing control over key lifecycle and access. This weakens confidentiality, impedes separation of duties, and can delay key revocation, increasing exposure to unauthorized data access and regulatory gaps.
What this control checks
Checks disk encryption settings for critical VMs
Common pitfalls
Default encryption is automatic, with no action needed
By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part.
Any attached disk without the customer key is flagged
The finding flags instances where any attached disk is not protected with the customer-provided key.
Recreate VMs to use CSEK on boot disks
You must recreate VMs to use CSEK on boot disks.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_encryption_with_csek_enabled (prowler gcp --checks compute_instance_encryption_with_csek_enabled); PowerPipe control gcp_compliance.control.compute_disk_encrypted_with_csk.
Framework-specific interpretation
SOC 2: Mapped to C1.1 (The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality).
PCI DSS v4.0: Mapped to 10.3.2 (Audit logs are protected from destruction and unauthorized modifications.), 10.3.4 (Audit logs are protected from destruction and unauthorized modifications.), 3.5.1 (Primary account number (PAN) is secured wherever it is stored.) and 1 more clause.
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...) and 9.2.a (in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic...).
NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management) and SC-28 (Protection Of Information At Rest).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.) and PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- 10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts
- A.8.12 Data leakage prevention
- 9 Cryptography
- 12 Asset management
- IA-5: Authenticator Management
- SC-28 Protection Of Information At Rest
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- PR.DS-01
- 4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys
- 4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)
- CRY-01.02AC The cloud provider's PQC strategy is aligned with cryptography policies and procedures and includes the following aspects: - Maintenance of an inventory of cryptographic mechanisms in use, including priority levels to each inventory item based on the impact and probabilities of the...
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.7 Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK)
- 4.7 Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK)
- 4.7 Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK)
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(d)(1) Device and media controls
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
NIST Cybersecurity Framework v1.0
- PR.DS-1: Data-at-rest is protected.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_disk_encrypted_with_csk - Powerpipe Control:
gcp_compliance.control.compute_disk_encrypted_with_csk - Prowler Check:
compute_instance_encryption_with_csek_enabled
Last reviewed: 2026-10-09