Cloud Storage buckets should have Bucket Only Policy enabled

SOC 2

• PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements

PCI DSS v4.0

• 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
• 2.2.7: System components are configured and managed securely.
• 3.5.1: Primary account number (PAN) is secured wherever it is stored.
• 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
• 7.2.1: Access to system components and data is appropriately defined and assigned.

NIST SP 800-53 Rev 5

• AC-5 Separation Of Duties
• AC-6: Least Privilege
• Access Enforcement (AC-3)
• Media Access (MP-2)

NIST Cybersecurity Framework v2.0

• GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated.
• GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.

CIS GCP Benchmark v3.0.0

• 5.2 Ensure That Cloud Storage Buckets Have Uniform BucketLevel Access Enabled

CIS GCP Benchmark v4.0.0

• 5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled

BSI C5:2025

• CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
• CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
• HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
• IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
• IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.

CIS GCP Benchmark v2.0.0

• 5.2 Ensure that Cloud Storage buckets have uniform bucket-level access enabled

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(B) Risk management
• 164.308(a)(3)(i) Workforce security
• 164.308(a)(3)(ii) Implementation specifications
• 164.312(a)(1) Access control

NIST Cybersecurity Framework v1.0

• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.