Google Cloud Compliance ControlsGoogle Cloud KMS
KMS keys should have separation of duties enforced for KMS-related roles
Checks project IAM policy bindings to confirm that no project member holds both the `Cloud KMS Admin` role and the `CryptoKey Encrypter/Decrypter` role at the same time. It looks at the role assignments of each member in the project.
What this control checks
KMS key administration and key usage permissions are held by different principals
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 3.6.1: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
13 more clauses
- 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.3: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A.5.3 Segregation of duties
- A.5.15 Access control
- A.8.2 Privileged access rights
- 1 Policy on the security of network and information systems
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
NIST Cybersecurity Framework v2.0
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-04
- PR.DS-01
- 1.8 Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
- 1.11 Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
- 1.8 Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
- 1.11 Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
7 more clauses
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- 1.11 Ensure that Separation of duties is enforced while assigning KMS related roles to users
- 1.11 Ensure that Separation of duties is enforced while assigning KMS related roles to users
- 1.11 Ensure that Separation of duties is enforced while assigning KMS related roles to users
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kms_key_separation_of_duties_enforced - Powerpipe Controls:
gcp_compliance.control.iam_user_kms_separation_of_duty_enforced,gcp_compliance.control.kms_key_separation_of_duties_enforced - Prowler Check:
iam_role_kms_enforce_separation_of_duties
Last reviewed: 2026-10-09