Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'off'
Checks that the `3625` trace flag database flag on each Cloud SQL SQL Server instance is set to `off`. The control reads the database flag settings of every Cloud SQL SQL Server instance and looks at the value of the `3625` flag.
What this control checks
Checks the 3625 trace flag setting on Cloud SQL SQL Server instances
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.sql_instance_sql_3625_trace_database_flag_off.
Framework-specific interpretation
CIS GCP Benchmark v1.2.0: Mapped to 6.3.6 (Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off').
CIS GCP Benchmark v1.3.0: Mapped to 6.3.6 (Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off').
Framework mappings
The clauses this control is mapped to in each framework.
- 6.3.6 Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off'
- 6.3.6 Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_3625_trace_database_flag_off - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_3625_trace_database_flag_off
Last reviewed: 2026-10-10