Google Cloud Compliance ControlsGoogle Cloud BigQuery
BigQuery tables should not be publicly readable
Checks that BigQuery datasets are not anonymously or publicly accessible. Datasets that grant any role to `allUsers` or `allAuthenticatedUsers` are flagged as publicly accessible.
What this control checks
BigQuery datasets must not grant access to allUsers or allAuthenticatedUsers.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 2.2.7: System components are configured and managed securely.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
1 more clause
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 11 Access control
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
- 7.1 Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
- 7.1 Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
2 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 7.1 It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- Limit access to system components and cardholder data to only those individuals whose job requires such access
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
require_bq_table_iam - Checkov Check:
CKV_GCP_15 - Powerpipe Control:
gcp_compliance.control.require_bq_table_iam - Prowler Check:
bigquery_dataset_public_access
Last reviewed: 2026-10-09