Google Cloud Compliance ControlsGoogle Cloud Storage
Cloud Storage buckets used for exporting logs should have object versioning enabled
Checks whether Cloud Storage buckets have `Object Versioning` turned on. Per Prowler, buckets with `Object Versioning` keep prior object generations. Per Trivy, versioning protects against accidental or malicious deletions of stored objects.
What this control checks
Checks whether versioning is turned on for Cloud Storage buckets that receive exported logs
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.
- PR.DS-01
- PR.DS-11: Backups of data are created, protected, maintained, and tested.
- PR.IR-02
4 more clauses
- PR.IR-03
- PR.IR-04
- PR.PS-04
- RC.RP-02
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.312(c)(1) Integrity
- 164.312(e)(2)(i) Integrity controls
- Interview system administrators and examine system configurations and permissions to verify that audit trails are secured so that they cannot be altered
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_bucket_log_object_versioning_enabled - Checkov Check:
CKV_GCP_78 - Powerpipe Control:
gcp_compliance.control.storage_bucket_log_object_versioning_enabled - Prowler Check:
cloudstorage_bucket_versioning_enabled - KICS Query:
e7e961ac-d17e-4413-84bc-8a1fbe242944 - Trivy Check:
GCP-0078
Last reviewed: 2026-10-10