Google Cloud Compliance ControlsGoogle Cloud Logging
Projects should have log metric filters and alerts configured for project ownership assignments and changes
Checks that log metric filters and alerts exist for project ownership assignments and changes. All roles/Owner assignments should be monitored. Members (users/Service-Accounts) with the primitive role roles/Owner are project owners.
What this control checks
Checks project ownership assignments and changes for log metric filters and alerts
Framework mappings
The clauses this control is mapped to in each framework.
- AU-2 Event Logging
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v2.0
- DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
- DE.AE-04: The estimated impact and scope of adverse events are understood.
- DE.AE-06: Information on adverse events is provided to authorized staff and tools.
- DE.AE-08
- DE.CM-03
38 more clauses
- DE.CM-09
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
- GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
- GV.RM-07: Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
- GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources.
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
- ID.RA-05
- ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated.
- ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- PR.PS-04
- RC.RP-04
- RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
- RS.AN-08
- RS.MA-02: Incident reports are triaged and validated.
- RS.MA-03: Incidents are categorized and prioritized.
- RS.MA-04
- RS.MA-05: The criteria for initiating incident recovery are applied.
- RS.MI-01: Incidents are contained.
- RS.MI-02
- 2.4 Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
- 2.4 Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
- 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
- 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
- 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
- 164.312(b) Audit controls
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_metric_alert_project_ownership_assignment - Powerpipe Control:
gcp_compliance.control.logging_metric_alert_project_ownership_assignment
Last reviewed: 2026-10-09