Google Cloud Compliance ControlsGoogle Cloud Logging
Projects should have log sinks configured for all log entries
Project has at least one logging sink exporting copies of all log entries. The sink sends a copy of all log entries to a destination for centralized retention or processing. Prowler rates the check medium severity.
What this control checks
Project contains at least one sink that exports a copy of all log entries
Framework mappings
The clauses this control is mapped to in each framework.
- CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
- CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- 10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis
- 11.5.2: A change-detection mechanism (for example, file integrity monitoring tools) is deployed
- 12.10.5: The security incident response plan includes monitoring and responding to alerts from security monitoring systems
- A3.5.1: Suspicious events are identified and responded to.
- A.8.15 Logging
- A.8.16 Monitoring activities
- 2 Risk management policy
- 3 Incident handling
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
- 11 Access control
- AU-2 Event Logging
- AU-7 Audit Record Reduction And Report Generation
- AU-12 Audit Record Generation
NIST Cybersecurity Framework v2.0
- DE.AE-03: Information is correlated from multiple sources.
- DE.AE-06: Information on adverse events is provided to authorized staff and tools.
- DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis.
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
9 more clauses
- GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
- GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
- GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
- GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
- GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- PR.PS-04
- 2.2 Ensure That Sinks Are Configured for All Log Entries
- 2.2 Ensure That Sinks Are Configured for All Log Entries
- AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- IAM-07.04B Unless contractually agreed otherwise, the information contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The...
17 more clauses
- INQ-04.01AC The cloud service provider monitors the access and activities performed by or on behalf of investigators as determined by the process described in INQ-01.
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
- OPS-15.02AC Such logs are collected in a way that allows their use as credible evidence. This includes: - Records are complete and have not been tampered with in any way;- Logging systems are clock synchronised, logs include accurate timestamps;- Copies of electronic evidence are provably...
- OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- PSS-04.05B If the cloud service customer is responsible for the activation or type and scope of logging, the cloud service provider has provide appropriate logging capabilities.
- SIM-01.02AC In addition, there are analysis plans for typical security incidents and an evaluation methodology which ensures the collected information does not lose its evidential value in any subsequent legal assessment.
- SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
- SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.
- SSO-05.01AC The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects: - Configuration of system components;- Performance and availability of system components;- Response time to malfunctions and security incidents;...
- 2.2 Ensure that sinks are configured for all log entries
- 2.2 Ensure that sinks are configured for all log entries
- 2.2 Ensure that sinks are configured for all log entries
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(5)(ii)(C) Log-in monitoring
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
NIST Cybersecurity Framework v1.0
- DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
- PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logging_sink_configured_for_all_resource - Powerpipe Control:
gcp_compliance.control.logging_sink_configured_for_all_resource - Prowler Check:
logging_sink_created
Last reviewed: 2026-10-09