GCP CFT Scorecard v1
ActiveSpecialized framework
Controls by category
25 controls are Mapped to GCP CFT Scorecard v1.
Other
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST Cybersecurity Framework v2.0 | Medium 48% | |
| PCI DSS v3.2.1 | Medium 48% | |
| BSI C5:2025 | Medium 36% |
Frequently asked questions
What does the CFT Scorecard evaluate?
The CFT Scorecard prints a scorecard of a GCP environment, for resources and IAM policies in Cloud Asset Inventory (CAI) exports. The policies tested are based on constraints and constraint templates from the Config Validator policy library.
How is the scorecard-v1 bundle installed?
The scorecard-v1 bundle can be installed via kpt. The bundle is pulled from the policy-library repository and the get-policy-bundle function writes the constraints into policy-library/policies/constraints/.
Which control areas do the scorecard-v1 constraints fall under?
Nearly all constraints in the scorecard-v1 bundle are labeled security. They cover GKE clusters, Cloud DNS, VPC networks, Cloud SQL, BigQuery, Cloud Storage and firewall rules. One constraint, service_versions, is labeled operational-efficiency.