Google Cloud Compliance ControlsGoogle Cloud VPC
Projects should prohibit default networks
This control assesses each project for the presence of a VPC network named `default`, the pre-created, auto-mode network. The Prowler check `compute_network_default_in_use` is titled "Project does not have a default VPC network".
What this control checks
Checks that compute networks in a project do not include a default network
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
- 3.1 Ensure That the Default Network Does Not Exist in a Project
- 3.1 Ensure That the Default Network Does Not Exist in a Project
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.1 Ensure that the default network does not exist in a project
- 3.1 Ensure that the default network does not exist in a project
- 3.1 Ensure that the default network does not exist in a project
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_network_contains_no_default_network - Powerpipe Control:
gcp_compliance.control.compute_network_contains_no_default_network - Prowler Check:
compute_network_default_in_use
Last reviewed: 2026-10-09