Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have Confidential Computing enabled
Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing encrypts data in-use. Prowler checks whether Confidential Computing is enabled on each VM instance.
What this control checks
Compute Engine instances and their Confidential Computing setting, as named in the control title
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- IA-5: Authenticator Management
- SC-28 Protection Of Information At Rest
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected.
- 4.11 Ensure That Compute Instances Have Confidential Computing Enabled
- 4.11 Ensure That Compute Instances Have Confidential Computing Enabled
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.11 Ensure that Compute instances have Confidential Computing enabled
- 4.11 Ensure that Compute instances have Confidential Computing enabled
- 4.11 Ensure that Compute instances have Confidential Computing enabled
NIST Cybersecurity Framework v1.0
- PR.DS-1: Data-at-rest is protected.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_confidential_computing_enabled - Powerpipe Control:
gcp_compliance.control.compute_instance_confidential_computing_enabled - Prowler Check:
compute_instance_confidential_computing_enabled
Last reviewed: 2026-10-09