Google Cloud Compliance ControlsGoogle Cloud Asset Inventory
Projects should have Cloud Asset Inventory enabled
Cloud Asset Inventory provides a historical view of GCP resources and IAM policies through a time-series database. This control checks that the Cloud Asset Inventory API (`cloudasset.googleapis.com`) is enabled in the project.
What this control checks
Project service cloudasset.googleapis.com must have state ENABLED; any other state fails.
Framework mappings
The clauses this control is mapped to in each framework.
- CC3.4 COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives
- A.5.28 Collection of evidence
- A.8.9 Configuration management
- 3 Incident handling
- CM-8 System Component Inventory
NIST Cybersecurity Framework v2.0
- DE.CM-06
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
- GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated.
- GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated.
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
11 more clauses
- GV.SC-04: Suppliers are known and prioritized by criticality.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- ID.AM-02
- ID.AM-04: Inventories of services provided by suppliers are maintained.
- ID.AM-05
- ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.
- ID.AM-08
- ID.RA-10: Critical suppliers are assessed prior to acquisition.
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- 2.13 Ensure Cloud Asset Inventory Is Enabled
- 164.308(a)(1)(ii)(A) Risk analysis
- 164.310(d)(2)(iii) Media re-use
NIST Cybersecurity Framework v1.0
- ID.AM-1: Physical devices and systems within the organization are inventoried.
- PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
project_service_cloudasset_api_enabled - Powerpipe Control:
gcp_compliance.control.project_service_cloudasset_api_enabled - Prowler Check:
iam_cloud_asset_inventory_enabled
Last reviewed: 2026-10-09