BigQuery datasets should require corporate-domain access and prohibit access by googlegroups.com addresses
Enforce corporate domain by banning googlegroups.com addresses access to BigQuery datasets. The check looks at the `userByEmail` entries in each dataset's `access` list. A dataset passes when no entry ends with googlegroups.com.
What this control checks
Dataset passes if no access entry has userByEmail like '%googlegroups.com'; otherwise alarm
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.restrict_googlegroups_bigquery_dataset.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-01 (The organizational mission is understood and informs cybersecurity risk management.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_googlegroups_bigquery_dataset - Powerpipe Control:
gcp_compliance.control.restrict_googlegroups_bigquery_dataset
Last reviewed: 2026-10-10