Google Cloud Compliance ControlsGoogle Cloud Logging
Projects should have log metric filters and alerts configured for VPC Network Firewall rule changes
Checks that each project has a `Cloud Logging` log-based metric whose filter matches VPC Network Firewall rule changes. The check examines the metric definitions configured in every project and looks for a filter that captures firewall rule events.
What this control checks
Projects must have a log metric filter and alert for VPC firewall rule changes
Framework mappings
The clauses this control is mapped to in each framework.
- AU-2 Event Logging
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v2.0
- DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
- DE.AE-04: The estimated impact and scope of adverse events are understood.
- DE.AE-06: Information on adverse events is provided to authorized staff and tools.
- DE.AE-08
- DE.CM-01
33 more clauses
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
- GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-03
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
- ID.RA-05
- ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated.
- ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- PR.IR-01
- PR.PS-04
- RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
- RS.AN-08
- RS.MA-02: Incident reports are triaged and validated.
- RS.MA-03: Incidents are categorized and prioritized.
- RS.MA-04
- RS.MA-05: The criteria for initiating incident recovery are applied.
- RS.MI-01: Incidents are contained.
- RS.MI-02
- 2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
- 2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
- 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- 164.312(b) Audit controls
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_metric_alert_firewall_rule_changes - Powerpipe Control:
gcp_compliance.control.logging_metric_alert_firewall_rule_changes
Last reviewed: 2026-10-09