Compute Engine instances should not use the default service account

SOC 2

• CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
• CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives

PCI DSS v4.0

• 7.2.1: Access to system components and data is appropriately defined and assigned.
• 7.2.5: Access to system components and data is appropriately defined and assigned.
• 7.3.3: Access to system components and data is managed via an access control system(s).
• 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session

NIS2 Directive (EU 2022/2555)

• 5 Supply chain security

NIST SP 800-53 Rev 5

• IA-5: Authenticator Management

NIST Cybersecurity Framework v2.0

• ID.AM-01: Inventories of hardware managed by the organization are maintained.

CIS GCP Benchmark v3.0.0

• 4.1 Ensure That Instances Are Not Configured To Use the Default Service Account

CIS GCP Benchmark v4.0.0

• 4.1 Ensure That Instances Are Not Configured To Use the Default Service Account

CIS GCP Benchmark v1.2.0

• 4.1 Ensure that instances are not configured to use the default service account

CIS GCP Benchmark v1.3.0

• 4.1 Ensure that instances are not configured to use the default service account

CIS GCP Benchmark v2.0.0

• 4.1 Ensure that instances are not configured to use the default service account

NIST Cybersecurity Framework v1.0

• PR.AC-1: Identities and credentials are issued, managed, verified, revoked, andaudited for authorized devices, users and processes.