Google Cloud Compliance ControlsGoogle Cloud Logging
Projects should have log metric filters and alerts configured for Custom Role changes, including undelete
It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion, updating, and undeleting activities.
What this control checks
Projects have a log metric filter and alert for custom role changes, including undelete
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
25 more clauses
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
- GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
- GV.SC-02
- GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
- ID.RA-05
- ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated.
- ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- PR.PS-04
- 2.6 Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_metric_alert_custom_role_changes_with_iam_admin_undelete_role - Powerpipe Control:
gcp_compliance.control.logging_metric_alert_custom_role_changes_with_iam_admin_undelete_role
Last reviewed: 2026-10-09