Projects should have container vulnerability scanning enabled
Container vulnerability scanning is designed to identify known security vulnerabilities in your container images. This control relates to projects having container vulnerability scanning enabled, so that known vulnerabilities in container images can be identified.
Without image scanning, vulnerable packages can reach production unchecked, enabling:
Remote code execution or privilege escalation (integrity/availability). Supply chain compromise via unvetted base images.
What this control checks
Projects should have container vulnerability scanning enabled
Audit evidence
Evidence that deployed resources meet this control: Prowler check gcr_container_scanning_enabled (prowler gcp --checks gcr_container_scanning_enabled); PowerPipe control gcp_compliance.control.project_service_container_scanning_api_enabled.
Framework-specific interpretation
SOC 2: Mapped to CC3.2 (COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks...).
PCI DSS v4.0: Mapped to 11.3.1 (External and internal vulnerabilities are regularly identified, prioritized, and addressed.), 11.3.1.2 (External and internal vulnerabilities are regularly identified, prioritized, and addressed.) and 11.3.1.3 (External and internal vulnerabilities are regularly identified, prioritized, and addressed.).
NIS2 Directive (EU 2022/2555): Mapped to 2.2.1 (The relevant entities shall regularly review the compliance with their policies on network and information system...), 5.1.4.f (an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the...), 5.1.7.d (analyse the risks presented by changes related to ICT products and ICT services from suppliers and service providers...) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded.), ID.RA-08 (Processes for receiving, analyzing, and responding to vulnerability disclosures are established.), ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use.) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
- 11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- 11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- 11.3.1.3: 3 Internal vulnerability scans are performed after any significant change
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
NIST Cybersecurity Framework v2.0
- ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
- ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
- ID.RA-09
- PR.PS-06
- OPS-25.01B System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a...
- PSS-11.01AC At startup and runtime of virtual machine or container images, an integrity check is performed that detects image manipulations and reports them to the cloud service customer.
- PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
project_service_container_scanning_api_enabled - Powerpipe Control:
gcp_compliance.control.project_service_container_scanning_api_enabled - Prowler Check:
gcr_container_scanning_enabled
Last reviewed: 2026-10-09