Projects should have log metric filters and alerts configured for Custom Role changes, including undelete
Ensure that the log metric filter and alerts exist for Custom Role changes including undelete operations.
It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion, updating, and undeleting activities.
What this control checks
Projects have a log metric filter and alert for custom role changes, including undelete
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.logging_metric_alert_custom_role_changes_with_iam_admin_undelete_role.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...), GV.OV-01 (Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.), GV.OV-02 (The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements...) and 27 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
25 more clauses
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
- GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
- GV.SC-02
- GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
- ID.RA-05
- ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated.
- ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- PR.PS-04
- 2.6 Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_metric_alert_custom_role_changes_with_iam_admin_undelete_role - Powerpipe Control:
gcp_compliance.control.logging_metric_alert_custom_role_changes_with_iam_admin_undelete_role
Last reviewed: 2026-10-09