Google Cloud Compliance ControlsGoogle Cloud Logging
Projects should have log metric filters and alerts configured for Audit Configuration changes
Checks that the log metric filter and alerts exist for Audit Configuration changes. Cloud audit logging records the identity of the API caller, the time of the API call, and the source IP address of the API caller.
What this control checks
Projects must have a log-based metric and alert policy for audit configuration changes
Framework mappings
The clauses this control is mapped to in each framework.
- AU-2 Event Logging
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v2.0
- DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
- DE.AE-04: The estimated impact and scope of adverse events are understood.
- DE.AE-06: Information on adverse events is provided to authorized staff and tools.
- DE.AE-08
- DE.CM-03
37 more clauses
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
- GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
- GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
- GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- ID.IM-01: Improvements are identified from evaluations.
- ID.IM-02
- ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities.
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
- ID.RA-05
- ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated.
- ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- PR.PS-01
- PR.PS-04
- RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
- RS.AN-08
- RS.MA-02: Incident reports are triaged and validated.
- RS.MA-03: Incidents are categorized and prioritized.
- RS.MA-04
- RS.MA-05: The criteria for initiating incident recovery are applied.
- RS.MI-01: Incidents are contained.
- RS.MI-02
- 2.5 Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
- 2.5 Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
- 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes
- 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes
- 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes
- 164.312(b) Audit controls
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_metric_alert_audit_configuration_changes - Powerpipe Control:
gcp_compliance.control.logging_metric_alert_audit_configuration_changes
Last reviewed: 2026-10-09