Projects should prohibit legacy networks
Google Cloud networks are evaluated for legacy mode (`subnet_mode: legacy`). The Prowler check highlights networks using the older, non-subnetted design instead of VPC with regional subnets. A project should not have a legacy network.
Legacy networks lack subnets, peering, and private access. This reduces isolation and forces public IP paths, weakening confidentiality and enabling lateral movement/data exfiltration. A single global range and gateway create contention that can degrade availability.
What this control checks
Projects should not contain legacy networks
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_network_not_legacy (prowler gcp --checks compute_network_not_legacy); PowerPipe control gcp_compliance.control.compute_network_contains_no_legacy_network.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security).
NIS2 Directive (EU 2022/2555): Mapped to 1.1.1.c (set out network and information security objectives;), 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...) and 5 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-18 (Wireless Access), CM-2 (Baseline Configuration), CM-6 (Configuration Settings) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
- 3.2 Ensure Legacy Networks Do Not Exist for Older Projects
- 3.2 Ensure Legacy Networks Do Not Exist for Older Projects
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
- 3.2 Ensure legacy networks do not exist for a project
- 3.2 Ensure legacy networks do not exist for a project
- 3.2 Ensure legacy networks do not exist for a project
- 164.308(a)(1)(ii)(B) Risk management
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_network_contains_no_legacy_network - Powerpipe Control:
gcp_compliance.control.compute_network_contains_no_legacy_network - Prowler Check:
compute_network_not_legacy
Last reviewed: 2026-10-09