Google Cloud Compliance ControlsGoogle Cloud VPC
Public IP addresses should not be listed in Shodan
Compute Engine public IP addresses are cross-checked with Shodan to identify Internet-exposed hosts that have been indexed, including observed open ports and metadata. Only EXTERNAL addresses are evaluated.
What this control checks
Compute Engine EXTERNAL public IP addresses must not be listed in Shodan.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_compute_public_address_shodan - Prowler Check:
compute_public_address_shodan
Last reviewed: 2026-10-09