Google Cloud Compliance ControlsGoogle Cloud DNS
VPC networks should all have Cloud DNS logging enabled
Prowler assesses VPC networks for a DNS policy that enables Cloud DNS query logging. When present, resolvers record queries from VMs, GKE, peering, and inbound forwarding. Entries are written to Cloud Logging.
What this control checks
Checks the DNS logging setting on compute networks
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
6 more clauses
- 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- A.8.16 Monitoring activities
- A.8.20 Network security
- A.8.21 Security of network services
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
3 more clauses
- 9 Cryptography
- 11 Access control
- 12 Asset management
- AU-3 Content of Audit Records
- AU-7 Audit Record Reduction And Report Generation
NIST Cybersecurity Framework v2.0
- DE.CM-01
- ID.AM-03
- PR.IR-01
- PR.PS-04
- 2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks
- 2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks
- AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
20 more clauses
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- IAM-07.04B Unless contractually agreed otherwise, the information contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The...
- INQ-04.01AC The cloud service provider monitors the access and activities performed by or on behalf of investigators as determined by the process described in INQ-01.
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident.
- OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records.
- OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- OPS-32.02B The guidelines and instructions should describe measures along the life cycle of containers and address at least the following aspects: - Containers are inventoried according to a documented process (cf. AM-02, AM-03, AM-09);- The need for malware protection is assessed and, if...
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- PSS-04.05B If the cloud service customer is responsible for the activation or type and scope of logging, the cloud service provider has provide appropriate logging capabilities.
- SIM-01.02AC In addition, there are analysis plans for typical security incidents and an evaluation methodology which ensures the collected information does not lose its evidential value in any subsequent legal assessment.
- SSO-05.01AC The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects: - Configuration of system components;- Performance and availability of system components;- Response time to malfunctions and security incidents;...
- 2.12 Ensure that Cloud DNS logging is enabled for all VPC networks
- 2.12 Ensure that Cloud DNS logging is enabled for all VPC networks
- 2.12 Ensure that Cloud DNS logging is enabled for all VPC networks
- 164.308(a)(1)(ii) Implementation specifications
- 164.312(b) Audit controls
NIST Cybersecurity Framework v1.0
- DE.AE-2: Detected events are analyzed to understand attack targets and methods.
- PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
- RS.AN-1: Notifications from detection systems are investigated.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_network_dns_logging_enabled - Powerpipe Control:
gcp_compliance.control.compute_network_dns_logging_enabled - Prowler Check:
compute_network_dns_logging_enabled
Last reviewed: 2026-10-09