Google Cloud Compliance ControlsGoogle Cloud Access Approval
Projects should have 'Access Approval' set to 'Enabled'
GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. The Prowler check looks for Access Approval settings associated with the project.
What this control checks
Project has Access Approval settings with notificationEmails configured; otherwise it fails.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
6 more clauses
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.
- A.5.15 Access control
- A.8.2 Privileged access rights
- A.8.3 Information access restriction
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
NIST Cybersecurity Framework v2.0
- DE.CM-02
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
- GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
- GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
6 more clauses
- GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk.
- 2.15 Ensure 'Access Approval' is 'Enabled'
- 2.15 Ensure 'Access Approval' is 'Enabled'
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
7 more clauses
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- 2.15 Ensure 'Access Approval' is 'Enabled'
- 2.15 Ensure 'Access Approval' is 'Enabled'
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
project_access_approval_settings_enabled - Powerpipe Control:
gcp_compliance.control.project_access_approval_settings_enabled - Prowler Check:
iam_account_access_approval_enabled
Last reviewed: 2026-10-09