Compute Engine instances should not have public IP addresses

SOC 2

• CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

PCI DSS v4.0

• 1.2.8: Network security controls (NSCs) are configured and maintained.
• 1.4.2: Network connections between trusted and untrusted networks are controlled.
• 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties
• A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
• A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.

NIST SP 800-53 Rev 5

• AC-5 Separation Of Duties
• AC-6: Least Privilege
• Access Enforcement (AC-3)
• Media Access (MP-2)

NIST Cybersecurity Framework v2.0

• ID.AM-01: Inventories of hardware managed by the organization are maintained.

CIS GCP Benchmark v3.0.0

• 4.9 Ensure That Compute Instances Do Not Have Public IP Addresses

CIS GCP Benchmark v4.0.0

• 4.9 Ensure That Compute Instances Do Not Have Public IP Addresses

CIS GCP Benchmark v1.2.0

• 4.9 Ensure that Compute instances do not have public IP addresses

CIS GCP Benchmark v1.3.0

• 4.9 Ensure that Compute instances do not have public IP addresses

CIS GCP Benchmark v2.0.0

• 4.9 Ensure that Compute instances do not have public IP addresses

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(B) Risk management
• 164.308(a)(3)(i) Workforce security
• 164.308(a)(3)(ii) Implementation specifications
• 164.312(a)(1) Access control

NIST Cybersecurity Framework v1.0

• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.

PCI DSS v3.2.1

• Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic