Google Cloud Compliance FrameworksSpecialized Frameworks
CIS GCP Benchmark v2.0.0
The Center for Internet Security (CIS) is a nonprofit that promotes best practices for securing IT systems and data. CIS publishes CIS Benchmarks. The CIS Benchmarks are security guidelines that institutions across industries can use to assist in the configuration of their environments.
Controls by Category
1.10 Ensure KMS encryption keys are rotated within a period of 90 days (1 control)
1.10 Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must... (1 control)
1.11 It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users. (1 control)
1.12 API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed... (1 control)
1.13 Ensure API keys are restricted to use by only specified Hosts and Apps (1 control)
1.14 API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API... (1 control)
1.15 API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days. (1 control)
1.16 It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information. (1 control)
1.17 When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK).... (1 control)
1.4 User managed service accounts should not have user-managed keys. (1 control)
1.5 A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for... (1 control)
1.6 It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level. (1 control)
1.7 Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated. (2 controls)
1.8 It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users. (1 control)
1.9 It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access. (1 control)
2.1 It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data. (1 control)
2.10 Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes (1 control)
2.11 It is recommended that a metric filter and alarm be established for SQL instance configuration changes. (1 control)
2.12 Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC. (1 control)
2.13 GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime... (1 control)
2.15 GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display... (1 control)
2.16 Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination. (1 control)
2.2 It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM). (1 control)
2.3 Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks. (3 controls)
2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes (1 control)
2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes (1 control)
2.6 It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities. (1 control)
2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes (1 control)
2.8 It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes. (1 control)
2.9 It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes. (1 control)
3.1 To prevent use of `default` network, a project should not have a `default` network. (1 control)
3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed' (1 control)
3.2 In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using... (1 control)
3.3 Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and... (1 control)
3.5 NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone... (1 control)
3.6 GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses,... (1 control)
3.7 GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses,... (1 control)
3.8 Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be... (1 control)
3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites (1 control)
4.1 It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project. (2 controls)
4.11 Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use--while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere... (1 control)
4.2 To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`. (1 control)
4.3 It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances. (1 control)
4.4 Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management. (1 control)
4.4 Ensure oslogin is enabled for a Project (1 control)
4.5 Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support. If you enable the interactive serial console on an instance, clients... (1 control)
4.6 Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both... (1 control)
4.7 Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all... (1 control)
4.8 To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled. (1 control)
4.9 Compute instances should not be configured to have external IP addresses. (1 control)
5.1 It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access. (2 controls)
5.2 Ensure that Cloud Storage buckets have uniform bucket-level access enabled (1 control)
5.2 It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets. (1 control)
6.1.2 It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on` (1 control)
6.1.3 It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`. (1 control)
6.2.1 The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are: - `TERSE` - `DEFAULT` - `VERBOSE` `TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information. `VERBOSE` output includes the `SQLSTATE` error code, source code... (1 control)
6.2.2 Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts. (1 control)
6.2.3 Enabling the `log_disconnections` setting logs the end of each session, including the session duration. (1 control)
6.2.4 The value of `log_statement` flag determined the SQL statements that are logged. Valid values are: - `none` - `ddl` - `mod` - `all` The value `ddl` logs all data definition statements. The value `mod` logs all ddl statements, plus data-modifying statements. The statements are logged after... (1 control)
6.2.5 The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`,... (1 control)
6.2.6 The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`,... (1 control)
6.2.7 The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set. (1 control)
6.2.8 Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging. (1 control)
6.2.9 Ensure Instance IP assignment is set to private (1 control)
6.2.9 Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. In contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC). Limiting... (1 control)
6.3.1 Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off' (1 control)
6.3.2 It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`. (1 control)
6.3.3 It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections. (1 control)
6.3.4 It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured. (1 control)
6.3.5 It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`. (1 control)
6.3.6 It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`. (1 control)
6.3.7 It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`. (1 control)
6.4 It is recommended to enforce all incoming connections to SQL database instance to use SSL. (1 control)
6.5 Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses. (1 control)
6.6 It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs. (1 control)
6.7 It is recommended to have all SQL database instances set to enable automated backups. (1 control)
7.1 It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access. (1 control)
7.2 BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not... (1 control)
7.3 BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not... (1 control)
Related Frameworks
CIS GCP Benchmark v3.0.0 — 🟢 High overlap (98%)
CIS GCP Benchmark v4.0.0 — 🟢 High overlap (98%)
NIST SP 800-53 Rev 5 — 🟢 High overlap (77%)