Google Cloud Compliance ControlsGoogle Cloud Logging
Projects should have log metric filters and alerts configured for VPC network changes
Prowler check logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled evaluates projects for a log-based metric with a linked Cloud Monitoring alert that targets VPC network changes on gce_network audit events.
What this control checks
Log-based metric for VPC network changes with a linked Cloud Monitoring alert
Framework mappings
The clauses this control is mapped to in each framework.
- CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
- CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
8 more clauses
- 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- A.8.15 Logging
- A.8.16 Monitoring activities
- A.8.20 Network security
- A.8.21 Security of network services
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
1 more clause
- 11 Access control
- AU-2 Event Logging
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v2.0
- DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
- DE.AE-04: The estimated impact and scope of adverse events are understood.
- DE.AE-06: Information on adverse events is provided to authorized staff and tools.
- DE.AE-08
- DE.CM-01
33 more clauses
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
- GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-03
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
- ID.RA-05
- ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated.
- ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- PR.IR-01
- PR.PS-04
- RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
- RS.AN-08
- RS.MA-02: Incident reports are triaged and validated.
- RS.MA-03: Incidents are categorized and prioritized.
- RS.MA-04
- RS.MA-05: The criteria for initiating incident recovery are applied.
- RS.MI-01: Incidents are contained.
- RS.MI-02
- 2.9 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
- 2.9 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
- AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
26 more clauses
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- IAM-06.04B Activities of users with privileged access rights are logged in order to detect any misuse of privileged access in suspicious cases.
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
- IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.
- IAM-07.04B Unless contractually agreed otherwise, the information contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The...
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- OIS-04.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- OIS-04.03B If segregation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions.
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-05.02B The collected information is correlated and analysed to identify its potential impact on the cloud service provider's organisation.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.08B The cloud service provider prioritises the risk treatment according to the level of cyber risks related to the cloud service.
- OIS-08.09B The cloud service provider documents and implements a risk treatment plan based on the risk assessment (OIS-07).
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-05.04AC Deviations from the specifications are automatically reported to the cloud service provider's subject matter experts so that they can be immediately assessed and the necessary measures taken.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-13.01AC The cloud service provider validates that event detection processes operate as intended on appropriate assets as identified in the asset classification schema (cf. AM-09).
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-13.03AC Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay.
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- PSS-04.05B If the cloud service customer is responsible for the activation or type and scope of logging, the cloud service provider has provide appropriate logging capabilities.
- SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident.
- SSO-05.01AC The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects: - Configuration of system components;- Performance and availability of system components;- Response time to malfunctions and security incidents;...
- 2.9 Ensure that the log metric filter and alerts exist for VPC network changes
- 2.9 Ensure that the log metric filter and alerts exist for VPC network changes
- 2.9 Ensure that the log metric filter and alerts exist for VPC network changes
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.312(b) Audit controls
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_metric_alert_network_changes - Powerpipe Control:
gcp_compliance.control.logging_metric_alert_network_changes - Prowler Check:
logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled
Last reviewed: 2026-10-09