Projects should have Cloud Asset Inventory enabled
Cloud Asset Inventory provides a historical view of GCP resources and IAM policies through a time-series database. This control checks that the Cloud Asset Inventory API (`cloudasset.googleapis.com`) is enabled in the project.
Without Cloud Asset Inventory, gaps in asset and IAM visibility hinder detection of drift and unauthorized changes, weakening access control integrity and risking data confidentiality. Shadow assets and silent privilege escalation can persist, delaying incident response.
What this control checks
Project service cloudasset.googleapis.com must have state ENABLED; any other state fails.
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_cloud_asset_inventory_enabled (prowler gcp --checks iam_cloud_asset_inventory_enabled); PowerPipe control gcp_compliance.control.project_service_cloudasset_api_enabled.
Framework-specific interpretation
SOC 2: Mapped to CC3.4 (COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal...), CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...) and CC8.1 (The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to...).
ISO/IEC 27001:2022: Mapped to A.5.28 (Collection Of Evidence) and A.8.9 (Configuration Management).
NIS2 Directive (EU 2022/2555): Mapped to 3.1.3 (The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate...).
NIST SP 800-53 Rev 5: Mapped to CM-8 (System Component Inventory).
NIST Cybersecurity Framework v2.0: Mapped to DE.CM-06 (External service provider activities and services are monitored to find potentially adverse events.), GV.OC-01 (The organizational mission is understood and informs cybersecurity risk management.), GV.OC-04 (Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization...) and 13 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC3.4 COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives
- A.5.28 Collection of evidence
- A.8.9 Configuration management
- 3 Incident handling
- CM-8 System Component Inventory
NIST Cybersecurity Framework v2.0
- DE.CM-06
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
- GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated.
- GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated.
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
11 more clauses
- GV.SC-04: Suppliers are known and prioritized by criticality.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- ID.AM-02
- ID.AM-04: Inventories of services provided by suppliers are maintained.
- ID.AM-05
- ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.
- ID.AM-08
- ID.RA-10: Critical suppliers are assessed prior to acquisition.
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- 164.308(a)(1)(ii)(A) Risk analysis
- 164.310(d)(2)(iii) Media re-use
NIST Cybersecurity Framework v1.0
- ID.AM-1: Physical devices and systems within the organization are inventoried.
- PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
project_service_cloudasset_api_enabled - Powerpipe Control:
gcp_compliance.control.project_service_cloudasset_api_enabled - Prowler Check:
iam_cloud_asset_inventory_enabled
Last reviewed: 2026-10-09