Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'

SOC 2

• CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
• CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives

NIST SP 800-53 Rev 5

• AC-5 Separation Of Duties
• AC-6: Least Privilege
• Access Enforcement (AC-3)
• Media Access (MP-2)

CIS GCP Benchmark v3.0.0

• 6.1.2 Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'

CIS GCP Benchmark v4.0.0

• 6.1.2 Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'

CIS GCP Benchmark v1.2.0

• 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'

CIS GCP Benchmark v1.3.0

• 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'

CIS GCP Benchmark v2.0.0

• 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'

HIPAA Security Rule 2003

• 164.308(a)(3)(i) Workforce security
• 164.308(a)(3)(ii) Implementation specifications
• 164.312(a)(1) Access control

NIST Cybersecurity Framework v1.0

• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.