Compute Engine instances should have Confidential Computing enabled
Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing encrypts data in-use. Prowler checks whether Confidential Computing is enabled on each VM instance.
Absent Confidential Computing, plaintext data in RAM can be exposed via host introspection, hypervisor compromise, or cold-boot/DMA attacks, undermining confidentiality. It also enables in-memory tampering that impacts integrity of computations, models, and secrets.
What this control checks
Compute Engine instances and their Confidential Computing setting, as named in the control title
Common pitfalls
Switch to a supported Machine series such as N2D
If the option is unavailable, change Machine series to a supported one (e.g., N2D) and select a type.
Isolate or refactor workloads that lack support
If unsupported, isolate or refactor workloads to compatible options.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_confidential_computing_enabled (prowler gcp --checks compute_instance_confidential_computing_enabled); PowerPipe control gcp_compliance.control.compute_instance_confidential_computing_enabled.
Framework-specific interpretation
SOC 2: Mapped to C1.1 (The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality).
NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management) and SC-28 (Protection Of Information At Rest).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.) and PR.DS-10 (The confidentiality, integrity, and availability of data-in-use are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- IA-5: Authenticator Management
- SC-28 Protection Of Information At Rest
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected.
- 4.11 Ensure That Compute Instances Have Confidential Computing Enabled
- 4.11 Ensure That Compute Instances Have Confidential Computing Enabled
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 4.11 Ensure that Compute instances have Confidential Computing enabled
- 4.11 Ensure that Compute instances have Confidential Computing enabled
- 4.11 Ensure that Compute instances have Confidential Computing enabled
NIST Cybersecurity Framework v1.0
- PR.DS-1: Data-at-rest is protected.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_confidential_computing_enabled - Powerpipe Control:
gcp_compliance.control.compute_instance_confidential_computing_enabled - Prowler Check:
compute_instance_confidential_computing_enabled
Last reviewed: 2026-10-09