Projects should prohibit default networks
This control assesses each project for the presence of a VPC network named `default`, the pre-created, auto-mode network. The Prowler check `compute_network_default_in_use` is titled "Project does not have a default VPC network".
Using the default VPC can weaken segmentation and expose services via permissive firewall rules (e.g., broad internal trust or public admin ports). This increases likelihood of unauthorized access, lateral movement, and data exfiltration, impacting confidentiality and integrity.
What this control checks
Checks that compute networks in a project do not include a default network
Common pitfalls
Remove or migrate resources before deleting default
If deletion is blocked, remove or migrate any resources using the default network, then retry Delete.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_network_default_in_use (prowler gcp --checks compute_network_default_in_use); PowerPipe control gcp_compliance.control.compute_network_contains_no_default_network.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
PCI DSS v4.0: Mapped to 1.4.2 (Network connections between trusted and untrusted networks are controlled.).
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security).
NIS2 Directive (EU 2022/2555): Mapped to 1.1.1.c (set out network and information security objectives;), 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 2.1.2.e (analyse the risks posed to the security of network and information systems, including threat, likelihood, impact, and...) and 5 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-18 (Wireless Access), CM-2 (Baseline Configuration), CM-6 (Configuration Settings) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
- 3.1 Ensure That the Default Network Does Not Exist in a Project
- 3.1 Ensure That the Default Network Does Not Exist in a Project
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.1 Ensure that the default network does not exist in a project
- 3.1 Ensure that the default network does not exist in a project
- 3.1 Ensure that the default network does not exist in a project
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_network_contains_no_default_network - Powerpipe Control:
gcp_compliance.control.compute_network_contains_no_default_network - Prowler Check:
compute_network_default_in_use
Last reviewed: 2026-10-09