IAM users should not have Service Account User or Service Account Token Creator roles at project level

SOC 2

• CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
• CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives

PCI DSS v4.0

• 7.2.1: Access to system components and data is appropriately defined and assigned.
• 7.2.2: Access to system components and data is appropriately defined and assigned.
• 7.2.5: Access to system components and data is appropriately defined and assigned.
• 7.3.1: Access to system components and data is managed via an access control system(s).
• 7.3.2: Access to system components and data is managed via an access control system(s).

ISO/IEC 27001:2022

• A.5.3 Segregation of duties
• A.5.15 Access control
• A.8.2 Privileged access rights

NIS2 Directive (EU 2022/2555)

• 6 Security in network and information systems acquisition, development and maintenance
• 11 Access control

NIST SP 800-53 Rev 5

• AC-5 Separation Of Duties
• AC-6: Least Privilege
• Access Enforcement (AC-3)
• Media Access (MP-2)

NIST Cybersecurity Framework v2.0

• GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
• GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
• GV.RR-04: Cybersecurity is included in human resources practices.
• GV.SC-02
• GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.

CIS GCP Benchmark v3.0.0

• 1.6 Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level

CIS GCP Benchmark v4.0.0

• 1.6 Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level

BSI C5:2025

• OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
• OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.

CIS GCP Benchmark v1.2.0

• 1.6 Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level

CIS GCP Benchmark v1.3.0

• 1.6 Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level

CIS GCP Benchmark v2.0.0

• 1.6 Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(B) Risk management
• 164.308(a)(3)(i) Workforce security
• 164.308(a)(3)(ii) Implementation specifications
• 164.308(a)(4)(i) Information access management
• 164.312(a)(1) Access control

NIST Cybersecurity Framework v1.0

• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.

PCI DSS v3.2.1

• Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities