BSI C5:2025

Best for: The C5 criteria catalogue is primarily intended for professional cloud service providers, their auditors and customers. Cloud service customers can use the C5 report to compare and control different cloud service providers regarding information security.

Controls by Category

AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service... (20 controls)

Projects should have Cloud Audit Logs properly configured across all services and all users HTTP(S) load balancers should have logging enabled VPC networks should all have Cloud DNS logging enabled VPC subnets should all have VPC Flow Logs enabled Log buckets should have retention policies configured using Bucket Lock Projects should have log metric filters and alerts configured for Custom Role changes Projects should have log metric filters and alerts configured for VPC network changes Projects should have log metric filters and alerts configured for VPC network route changes Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes Projects should have log sinks configured for all log entries Projects should have OS Login enabled at project level Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

AM-07.02B The decommissioning includes the complete and permanent deletion of all cloud service customer data, cloud service derived data, cloud service provider data and account data or proper destruction of the media. However, account data is only to be deleted if the data is located in the... (1 control)

Cloud Storage buckets should have soft delete enabled

AM-09.01B Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits. (1 control)

Cloud SQL instances should have automated backups configured

AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority. (20 controls)

AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules... (6 controls)

Projects should prohibit default networks VPC networks should all have Cloud DNS logging enabled Projects should have log metric filters and alerts configured for VPC network changes Projects should have log metric filters and alerts configured for VPC network route changes Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet

BCM-01.02B Policies and instructions for establishing the strategy and guidelines to ensure business continuity management for the cloud service are documented, communicated and provided in accordance with SP-01. (1 control)

Cloud SQL instances should have automated backups configured

COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be... (9 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured Projects should prohibit legacy networks VPC networks should all have Cloud DNS logging enabled Public IP addresses should not be listed in Shodan Cloud SQL instances should not have public IP addresses Cloud SQL instances should have SSL enabled Cloud SQL instances should prohibit world-readable access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements. (4 controls)

Cloud SQL instances should have SSL enabled Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configured

COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers. (4 controls)

Projects should prohibit legacy networks VPC networks should all have Cloud DNS logging enabled Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet

COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness. (1 control)

Cloud SQL instances should have SSL enabled

CRY-01.02AC The cloud provider's PQC strategy is aligned with cryptography policies and procedures and includes the following aspects: - Maintenance of an inventory of cryptographic mechanisms in use, including priority levels to each inventory item based on the impact and probabilities of the... (4 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption Dataproc clusters should use customer-managed encryption keys for encryption

CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents... (10 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption Compute Engine instances should not use the default service account with full access to all Cloud APIs Dataproc clusters should use customer-managed encryption keys for encryption Service account keys should limit age to 100 days User-managed or external service account keys should have rotation configured every 90 days or less Cloud KMS cryptokeys should prohibit anonymous and public access KMS keys should have separation of duties enforced for KMS-related roles Projects should have 'Access Approval' set to 'Enabled'

CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data. (15 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Compute Engine instances should not use the default service account with full access to all Cloud APIs Dataproc clusters should use customer-managed encryption keys for encryption Cloud KMS cryptokeys should prohibit anonymous and public access Projects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readable Cloud Storage buckets should have Bucket Only Policy enabled Cloud SQL instances should have SSL enabled Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud SQL instances should prohibit world-readable access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud... (15 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Compute Engine instances should not use the default service account with full access to all Cloud APIs Dataproc clusters should use customer-managed encryption keys for encryption Cloud KMS cryptokeys should prohibit anonymous and public access Projects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readable Cloud Storage buckets should have Bucket Only Policy enabled Cloud SQL instances should have SSL enabled Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud SQL instances should prohibit world-readable access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest). (4 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Dataproc clusters should use customer-managed encryption keys for encryption Cloud SQL instances should have automated backups configured

CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure. (6 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Dataproc clusters should use customer-managed encryption keys for encryption KMS keys should be rotated at least annually Service accounts should use only GCP-managed service account keys Cloud KMS cryptokeys should prohibit anonymous and public access

CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this... (4 controls)

KMS keys should be rotated at least annually API keys should have rotation configured every 90 days Service account keys should limit age to 100 days User-managed or external service account keys should have rotation configured every 90 days or less

CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited. (4 controls)

CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module. (3 controls)

Cloud KMS cryptokeys should prohibit anonymous and public access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and... (3 controls)

KMS keys should be rotated at least annually Cloud KMS cryptokeys should prohibit anonymous and public access KMS keys should have separation of duties enforced for KMS-related roles

CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to... (4 controls)

CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud... (4 controls)

KMS keys should be rotated at least annually Service account keys should limit age to 100 days User-managed or external service account keys should have rotation configured every 90 days or less Cloud KMS cryptokeys should prohibit anonymous and public access

DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation. (20 controls)

DEV-11.02B The cloud service provider includes the development environment as part of the backup plan in accordance with the backup concept (cf. OPS-06). (1 control)

Cloud SQL instances should have automated backups configured

DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and... (3 controls)

API keys should have rotation configured every 90 days Service account keys should limit age to 100 days User-managed or external service account keys should have rotation configured every 90 days or less

HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service... (11 controls)

Compute Engine instances should not use the default service account with full access to all Cloud APIs Service accounts should not have Admin privileges IAM users should not hold both service account admin and service account user roles Cloud KMS cryptokeys should prohibit anonymous and public access KMS keys should have separation of duties enforced for KMS-related roles Projects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readable Cloud Storage buckets should have Bucket Only Policy enabled Cloud SQL instances should prohibit world-readable access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures. (4 controls)

Projects should have log metric filters and alerts configured for Custom Role changes Projects should have log metric filters and alerts configured for VPC network changes Projects should have log metric filters and alerts configured for VPC network route changes Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes

IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and... (6 controls)

Compute Engine instances should not use the default service account with full access to all Cloud APIs Service accounts should not have Admin privileges IAM users should not hold both service account admin and service account user roles KMS keys should have separation of duties enforced for KMS-related roles Projects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readable

IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant. (20 controls)

IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy. (5 controls)

Service accounts should use only GCP-managed service account keys Service accounts should not have Admin privileges IAM users should not hold both service account admin and service account user roles KMS keys should have separation of duties enforced for KMS-related roles Projects should have 'Access Approval' set to 'Enabled'

IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle'). (5 controls)

Service accounts should be used within the configured maximum unused period Service accounts should use only GCP-managed service account keys IAM users should not hold both service account admin and service account user roles KMS keys should have separation of duties enforced for KMS-related roles Projects should have 'Access Approval' set to 'Enabled'

IAM-06.04B Activities of users with privileged access rights are logged in order to detect any misuse of privileged access in suspicious cases. (5 controls)

Projects should have Cloud Audit Logs properly configured across all services and all users Projects should have log metric filters and alerts configured for Custom Role changes Projects should have log metric filters and alerts configured for VPC network changes Projects should have log metric filters and alerts configured for VPC network route changes Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes

IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse. (4 controls)

IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action. (4 controls)

IAM-07.04B Unless contractually agreed otherwise, the information contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The... (20 controls)

IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect. (3 controls)

Service account keys should limit age to 100 days Service accounts should use only GCP-managed service account keys User-managed or external service account keys should have rotation configured every 90 days or less

IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-... (6 controls)

Compute Engine instances should have 'Block Project-wide SSH keys' enabled User-managed service account keys should be used within the allowed inactivity period API keys should have rotation configured every 90 days API keys should allow access only to APIs needed by the application Service account keys should limit age to 100 days User-managed or external service account keys should have rotation configured every 90 days or less

IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01. (4 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption Dataproc clusters should use customer-managed encryption keys for encryption

IAM-09.03B Within the production environment, user authentication takes place through passwords, digitally signed certificates or procedures that achieve at least an equivalent level of security. If digitally signed certificates are used, administration is carried out in accordance with the... (1 control)

Cloud SQL instances should have SSL enabled

IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel. (13 controls)

Compute Engine instances should not use the default service account with full access to all Cloud APIs IAM users should not hold both service account admin and service account user roles Cloud KMS cryptokeys should prohibit anonymous and public access KMS keys should have separation of duties enforced for KMS-related roles Projects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readable Cloud Storage buckets should have Bucket Only Policy enabled Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud SQL instances should prohibit world-readable access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems. (13 controls)

INQ-02.01B The cloud service provider informs the affected cloud service customer(s) without undue delay. Exceptions for this information of the customer need to be justified by the legal basis of this request or because there are clear indications of illegal actions of the customer in... (1 control)

Organizations should have Essential Contacts configured

INQ-04.01AC The cloud service provider monitors the access and activities performed by or on behalf of investigators as determined by the process described in INQ-01. (11 controls)

OIS-02.01B Top management of the cloud service provider has adopted an information security policy. (6 controls)

Service accounts should be used within the configured maximum unused period Service accounts should use only GCP-managed service account keys IAM users should not have Service Account User or Service Account Token Creator roles at project level IAM users should not hold both service account admin and service account user roles KMS keys should have separation of duties enforced for KMS-related roles Projects should have Cloud Asset Inventory enabled

OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment... (2 controls)

IAM users should not hold both service account admin and service account user roles KMS keys should have separation of duties enforced for KMS-related roles

OIS-04.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures. (4 controls)

OIS-04.03B If segregation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions. (4 controls)

OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks. (20 controls)

OIS-05.02B The collected information is correlated and analysed to identify its potential impact on the cloud service provider's organisation. (4 controls)

OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures. (6 controls)

OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud... (13 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption Compute Engine instances should have 'Block Project-wide SSH keys' enabled Compute Engine instances should have IP forwarding disabled Projects should prohibit default networks VPC networks should all have Cloud DNS logging enabled Dataproc clusters should use customer-managed encryption keys for encryption Cloud DNS managed zones should not use RSASHA1 for zone-signing keys Public IP addresses should not be listed in Shodan Cloud SQL instances should have SSL enabled Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet

Projects should have log metric filters and alerts configured for Custom Role changes Projects should have log metric filters and alerts configured for VPC network changes

OIS-08.09B The cloud service provider documents and implements a risk treatment plan based on the risk assessment (OIS-07). (5 controls)

OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware. (6 controls)

User-managed service account keys should be used within the allowed inactivity period Service accounts should be used within the configured maximum unused period Service accounts should use only GCP-managed service account keys Service accounts should not have Admin privileges IAM users should not have Service Account User or Service Account Token Creator roles at project level Projects should have 'Access Approval' set to 'Enabled'

OPS-05.03AC The configuration of the protection mechanisms is monitored automatically. (4 controls)

OPS-05.04AC Deviations from the specifications are automatically reported to the cloud service provider's subject matter experts so that they can be immediately assessed and the necessary measures taken. (4 controls)

OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the... (1 control)

Cloud SQL instances should have automated backups configured

OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06. (1 control)

Cloud SQL instances should have automated backups configured

OPS-08.01B Restore procedures are tested regularly, at least annually. The tests include cloud service customer data, cloud service derived data and cloud service provider data in accordance with the contractual agreements. (1 control)

Cloud SQL instances should have automated backups configured

OPS-08.03B Cloud service customer data is only restored in environments that are subject to the same access restrictions as the production environment. (1 control)

Cloud SQL instances should have automated backups configured

OPS-09.02B The data classification of the original data is applied to backups. (1 control)

Cloud SQL instances should have automated backups configured

OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments. (20 controls)

OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and... (12 controls)

OPS-13.01AC The cloud service provider validates that event detection processes operate as intended on appropriate assets as identified in the asset classification schema (cf. AM-09). (4 controls)

OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management. (6 controls)

OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential... (20 controls)

OPS-13.03AC Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay. (4 controls)

OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected. (3 controls)

Log buckets should have retention policies configured using Bucket Lock Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them. (1 control)

Projects should have log sinks configured for all log entries

OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident. (15 controls)

Projects should have Cloud Audit Logs properly configured across all services and all users HTTP(S) load balancers should have logging enabled VPC networks should all have Cloud DNS logging enabled VPC subnets should all have VPC Flow Logs enabled Log buckets should have retention policies configured using Bucket Lock Projects should have OS Login enabled at project level Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

OPS-15.02AC Such logs are collected in a way that allows their use as credible evidence. This includes: - Records are complete and have not been tampered with in any way;- Logging systems are clock synchronised, logs include accurate timestamps;- Copies of electronic evidence are provably... (1 control)

Projects should have log sinks configured for all log entries

OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records. (15 controls)

Projects should have Cloud Audit Logs properly configured across all services and all users HTTP(S) load balancers should have logging enabled VPC networks should all have Cloud DNS logging enabled VPC subnets should all have VPC Flow Logs enabled Log buckets should have retention policies configured using Bucket Lock Projects should have OS Login enabled at project level Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events. (16 controls)

Projects should have Cloud Audit Logs properly configured across all services and all users HTTP(S) load balancers should have logging enabled VPC networks should all have Cloud DNS logging enabled VPC subnets should all have VPC Flow Logs enabled Log buckets should have retention policies configured using Bucket Lock Projects should have log sinks configured for all log entries Projects should have OS Login enabled at project level Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

OPS-17.02B Failures are automatically and promptly reported to the cloud service provider's responsible departments so that these can assess the failures and take required action. (4 controls)

Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'

OPS-24.01B The cloud service provider periodically informs the cloud service customer on the status of incidents affecting the cloud service customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements. (1 control)

Organizations should have Essential Contacts configured

OPS-24.02B As soon as an incident has been resolved from the cloud service provider's perspective, the cloud service customer is informed about the actions taken according to the contractual agreements. (1 control)

Organizations should have Essential Contacts configured

OPS-25.01B System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a... (1 control)

Projects should have container vulnerability scanning enabled

OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications. (20 controls)

OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications. (20 controls)

OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action. (4 controls)

OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software. (6 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption Compute Engine instances should have Confidential Computing enabled Compute Engine instances should not use the default service account with full access to all Cloud APIs Dataproc clusters should use customer-managed encryption keys for encryption

OPS-32.02B The guidelines and instructions should describe measures along the life cycle of containers and address at least the following aspects: - Containers are inventoried according to a documented process (cf. AM-02, AM-03, AM-09);- The need for malware protection is assessed and, if... (8 controls)

HTTP(S) load balancers should have logging enabled VPC networks should all have Cloud DNS logging enabled VPC subnets should all have VPC Flow Logs enabled Cloud Storage buckets should have lifecycle management configured Log buckets should have retention policies configured using Bucket Lock Projects should have OS Login enabled at project level Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks. (2 controls)

Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet

PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means. (1 control)

Cloud Storage buckets should have soft delete enabled

PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised. (11 controls)

Compute Engine instances should not use the default service account with full access to all Cloud APIs Cloud KMS cryptokeys should prohibit anonymous and public access Projects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readable Cloud Storage buckets should have Bucket Only Policy enabled Firewall rules should prohibit unrestricted RDP access from the internet Firewall rules should prohibit unrestricted SSH access from the internet Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud SQL instances should prohibit world-readable access Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

PSS-04.05B If the cloud service customer is responsible for the activation or type and scope of logging, the cloud service provider has provide appropriate logging capabilities. (20 controls)

PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that... (5 controls)

Compute Engine instances should have 'Block Project-wide SSH keys' enabled API keys should have rotation configured every 90 days API keys should allow access only to APIs needed by the application Projects should not use API keys Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'

PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced. (1 control)

KMS keys should have separation of duties enforced for KMS-related roles

PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method). (4 controls)

PSS-11.01AC At startup and runtime of virtual machine or container images, an integrity check is performed that detects image manipulations and reports them to the cloud service customer. (1 control)

Projects should have container vulnerability scanning enabled

PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so... (1 control)

Projects should have container vulnerability scanning enabled

SIM-01.02AC In addition, there are analysis plans for typical security incidents and an evaluation methodology which ensures the collected information does not lose its evidential value in any subsequent legal assessment. (16 controls)

Projects should have Cloud Audit Logs properly configured across all services and all users HTTP(S) load balancers should have logging enabled VPC networks should all have Cloud DNS logging enabled VPC subnets should all have VPC Flow Logs enabled Log buckets should have retention policies configured using Bucket Lock Projects should have log sinks configured for all log entries Projects should have OS Login enabled at project level Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner. (1 control)

Organizations should have Essential Contacts configured

SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident. (4 controls)

Projects should have log sinks configured for all log entries

SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident. (1 control)

Projects should have log sinks configured for all log entries

SSO-05.01AC The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects: - Configuration of system components;- Performance and availability of system components;- Response time to malfunctions and security incidents;... (20 controls)

CIS GCP Benchmark v2.0.0 — 🟢 High overlap (89%)

CIS GCP Benchmark v3.0.0 — 🟢 High overlap (88%)

CIS GCP Benchmark v4.0.0 — 🟢 High overlap (88%)

BSI C5:2025

Controls by Category

AM-09.01B Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits. (1 control)

AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority. (20 controls)

BCM-01.02B Policies and instructions for establishing the strategy and guidelines to ensure business continuity management for the cloud service are documented, communicated and provided in accordance with SP-01. (1 control)

BCM-01.05B Policies and instructions related to business impact analyses and business continuity plans are documented, communicated and made available in accordance with SP-01. (1 control)

COS-03.02B Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements. (4 controls)

COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers. (4 controls)

COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness. (1 control)

CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data. (15 controls)

CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest). (4 controls)

CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure. (6 controls)

CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited. (4 controls)

CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module. (3 controls)

DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation. (20 controls)

DEV-11.02B The cloud service provider includes the development environment as part of the backup plan in accordance with the backup concept (cf. OPS-06). (1 control)

HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures. (4 controls)

IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant. (20 controls)

IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy. (5 controls)

IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle'). (5 controls)

IAM-06.04B Activities of users with privileged access rights are logged in order to detect any misuse of privileged access in suspicious cases. (5 controls)

IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse. (4 controls)

IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action. (4 controls)

IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect. (3 controls)

IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-... (6 controls)

IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01. (4 controls)

IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel. (13 controls)

IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems. (13 controls)

INQ-04.01AC The cloud service provider monitors the access and activities performed by or on behalf of investigators as determined by the process described in INQ-01. (11 controls)

OIS-02.01B Top management of the cloud service provider has adopted an information security policy. (6 controls)

OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles. (4 controls)

OIS-04.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures. (4 controls)

OIS-04.03B If segregation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions. (4 controls)

OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks. (20 controls)

OIS-05.02B The collected information is correlated and analysed to identify its potential impact on the cloud service provider's organisation. (4 controls)

OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures. (6 controls)

OIS-08.08B The cloud service provider prioritises the risk treatment according to the level of cyber risks related to the cloud service. (2 controls)

OIS-08.09B The cloud service provider documents and implements a risk treatment plan based on the risk assessment (OIS-07). (5 controls)

OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware. (6 controls)

OPS-05.03AC The configuration of the protection mechanisms is monitored automatically. (4 controls)

OPS-05.04AC Deviations from the specifications are automatically reported to the cloud service provider's subject matter experts so that they can be immediately assessed and the necessary measures taken. (4 controls)

OPS-07.01B The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06. (1 control)

OPS-08.01B Restore procedures are tested regularly, at least annually. The tests include cloud service customer data, cloud service derived data and cloud service provider data in accordance with the contractual agreements. (1 control)

OPS-08.03B Cloud service customer data is only restored in environments that are subject to the same access restrictions as the production environment. (1 control)

OPS-09.02B The data classification of the original data is applied to backups. (1 control)

OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments. (20 controls)

OPS-13.01AC The cloud service provider validates that event detection processes operate as intended on appropriate assets as identified in the asset classification schema (cf. AM-09). (4 controls)

OPS-13.03AC Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay. (4 controls)

OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected. (3 controls)

OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them. (1 control)

OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident. (15 controls)

OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records. (15 controls)

OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events. (16 controls)

OPS-17.02B Failures are automatically and promptly reported to the cloud service provider's responsible departments so that these can assess the failures and take required action. (4 controls)

OPS-24.01B The cloud service provider periodically informs the cloud service customer on the status of incidents affecting the cloud service customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements. (1 control)

OPS-24.02B As soon as an incident has been resolved from the cloud service provider's perspective, the cloud service customer is informed about the actions taken according to the contractual agreements. (1 control)

OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications. (20 controls)

OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications. (20 controls)

OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action. (4 controls)

OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software. (6 controls)

PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks. (2 controls)

PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means. (1 control)

PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised. (11 controls)

PSS-04.05B If the cloud service customer is responsible for the activation or type and scope of logging, the cloud service provider has provide appropriate logging capabilities. (20 controls)

PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced. (1 control)

PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method). (4 controls)

PSS-11.01AC At startup and runtime of virtual machine or container images, an integrity check is performed that detects image manipulations and reports them to the cloud service customer. (1 control)

SIM-01.02AC In addition, there are analysis plans for typical security incidents and an evaluation methodology which ensures the collected information does not lose its evidential value in any subsequent legal assessment. (16 controls)

SIM-01.03B Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner. (1 control)

SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident. (4 controls)

SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident. (1 control)

Related Frameworks

On this page