Google Cloud Compliance ControlsGoogle Cloud VPC
Projects should prohibit legacy networks
Google Cloud networks are evaluated for legacy mode (`subnet_mode: legacy`). The Prowler check highlights networks using the older, non-subnetted design instead of VPC with regional subnets. A project should not have a legacy network.
What this control checks
Projects should not contain legacy networks
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
- 3.2 Ensure Legacy Networks Do Not Exist for Older Projects
- 3.2 Ensure Legacy Networks Do Not Exist for Older Projects
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
- 3.2 Ensure legacy networks do not exist for a project
- 3.2 Ensure legacy networks do not exist for a project
- 3.2 Ensure legacy networks do not exist for a project
- 164.308(a)(1)(ii)(B) Risk management
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_network_contains_no_legacy_network - Powerpipe Control:
gcp_compliance.control.compute_network_contains_no_legacy_network - Prowler Check:
compute_network_not_legacy
Last reviewed: 2026-10-09