Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9160
Checks GCP Compute Engine firewall rules, which provide stateful filtering of ingress and egress network traffic to GCP resources, and flags any ingress rule that allows `0.0.0.0/0` to reach `TCP` port `9160`.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to TCP port 9160.
What this control checks
Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9160
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_9160.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9042
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 7199
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to port 10250
- VPC subnets should all have VPC Flow Logs enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_tcp_port_9160 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_9160
Last reviewed: 2026-10-09