Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules should prohibit unrestricted RDP access from the internet
Inspects VPC firewall rules and verifies that the allowed ports do not include RDP port `3389`. Internet-exposed rules that permit inbound RDP (`TCP 3389`) from the source range `0.0.0.0/0` are flagged as failing.
What this control checks
Checks firewall rules for RDP access that is open to the internet
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
4 more clauses
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
- CA-9 Internal System Connections
- SC-7: Boundary Protection
- 3.7 Ensure That RDP Access Is Restricted From the Internet
- 3.7 Ensure That RDP Access Is Restricted From the Internet
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
5 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.7 GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses,...
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(a)(1) Facility access controls
- 164.312(e)(1) Transmission security
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 636
- Firewall rules should prohibit ingress from 0.0.0.0/0 to MySQL DB port 3306
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 9200 or 9300
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 7199
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 137-139
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_firewall_rule_rdp_world_open - Powerpipe Controls:
gcp_compliance.control.restrict_firewall_rule_rdp_world_open,gcp_compliance.control.restrict_firewall_rule_world_open_tcp_udp_all_ports - Prowler Check:
compute_firewall_rdp_access_from_the_internet_allowed - KICS Query:
678fd659-96f2-454a-a2a0-c2571f83a4a3
Last reviewed: 2026-10-10