Google Cloud Compliance ControlsGoogle Cloud SQL
Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'
Checks that Cloud SQL for SQL Server instances have the `3625` trace flag database flag set to `on`. Without it enabled, SQL Server error messages can reveal parameters and object names to users who are not administrators.
What this control checks
Checks the 3625 database flag on Cloud SQL SQL Server instances
Framework mappings
The clauses this control is mapped to in each framework.
- CM-1 Configuration Management Policy and Procedures
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
3 more clauses
- SA-3 System Development Life Cycle
- SA-8 Security Engineering Principles
- SA-10 Developer Configuration Management
- 6.3.6 Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'
- 6.3 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
- 6.3.6 Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'
- 6.3.6 Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off'
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_instance_sql_3625_trace_database_flag_on - Powerpipe Control:
gcp_compliance.control.sql_instance_sql_3625_trace_database_flag_on - Prowler Check:
cloudsql_instance_sqlserver_trace_flag - KICS Query:
f5aff735-fd1c-4751-a5e9-98bfe4893fa2
Last reviewed: 2026-10-10