CIS GCP Benchmark v3.0.0

The CIS Benchmarks are security guidelines that institutions across industries can use to assist in the configuration of their environments. They are published by the Center for Internet Security (CIS), a nonprofit that promotes best practices for securing IT systems and data.

Controls by Category

1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days (2 controls)

Customer-managed encryption keys should be rotated within 100 days Cloud KMS encryption keys should have rotation configured within 90 days

KMS keys should have separation of duties enforced for KMS-related roles

1.12 Ensure API Keys Only Exist for Active Services (1 control)

Projects should not use API keys

1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps (1 control)

API keys should allow use only by specified hosts and apps

1.14 Ensure API Keys Are Restricted to Only APIs That Application Needs Access (1 control)

API keys should allow access only to APIs needed by the application

1.15 Ensure API Keys Are Rotated Every 90 Days (1 control)

API keys should have rotation configured every 90 days

1.16 Ensure Essential Contacts is Configured for Organization (1 control)

Organizations should have Essential Contacts configured

1.4 Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account (1 control)

Service accounts should use only GCP-managed service account keys

1.5 Ensure That Service Account Has No Admin Privileges (1 control)

Service accounts should not have Admin privileges

1.6 Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level (1 control)

IAM users should not have Service Account User or Service Account Token Creator roles at project level

1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer (2 controls)

Service account keys should limit age to 100 days User-managed or external service account keys should have rotation configured every 90 days or less

IAM users should not hold both service account admin and service account user roles KMS keys should have separation of duties enforced for KMS-related roles

1.9 Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible (1 control)

Cloud KMS cryptokeys should prohibit anonymous and public access

2.1 Ensure That Cloud Audit Logging Is Configured Properly (1 control)

Projects should have Cloud Audit Logs properly configured across all services and all users

2.10 Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes (1 control)

Projects should have log metric filters and alerts configured for Cloud Storage IAM permission changes

2.11 Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes (1 control)

Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes

2.3 Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock (3 controls)

Log buckets should have retention policies configured using Bucket Lock Cloud Storage buckets used for exporting logs should have retention policies enabled Cloud Storage buckets used for exporting logs should use Bucket Lock

2.4 Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes (1 control)

Projects should have log metric filters and alerts configured for project ownership assignments and changes

2.5 Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes (1 control)

Projects should have log metric filters and alerts configured for Audit Configuration changes

2.6 Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes (1 control)

Projects should have log metric filters and alerts configured for Custom Role changes

2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes (1 control)

Projects should have log metric filters and alerts configured for VPC Network Firewall rule changes

2.8 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes (1 control)

Projects should have log metric filters and alerts configured for VPC network route changes

2.9 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes (1 control)

Projects should have log metric filters and alerts configured for VPC network changes

3.1 Ensure That the Default Network Does Not Exist in a Project (1 control)

Projects should prohibit default networks

3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed' (1 control)

Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)

3.2 Ensure Legacy Networks Do Not Exist for Older Projects (1 control)

Projects should prohibit legacy networks

3.3 Ensure That DNSSEC Is Enabled for Cloud DNS (1 control)

Cloud DNS managed zones should have DNSSEC enabled

3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC (1 control)

Cloud DNS managed zones should not use RSASHA1 for zone-signing keys

3.6 Ensure That SSH Access Is Restricted From the Internet (1 control)

Firewall rules should prohibit unrestricted SSH access from the internet

3.7 Ensure That RDP Access Is Restricted From the Internet (1 control)

Firewall rules should prohibit unrestricted RDP access from the internet

3.8 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network (1 control)

VPC subnets should all have VPC Flow Logs enabled

3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites (1 control)

HTTPS or SSL proxy load balancers should prohibit SSL policies with weak cipher suites

4.1 Ensure That Instances Are Not Configured To Use the Default Service Account (2 controls)

Compute Engine instances should not use the default service account Compute Engine instances should not use the default service account with full access to all Cloud APIs

4.11 Ensure That Compute Instances Have Confidential Computing Enabled (1 control)

Compute Engine instances should have Confidential Computing enabled

4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs (1 control)

Compute Engine instances should not use the default service account with full access to all Cloud APIs

4.3 Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances (1 control)

Compute Engine instances should have 'Block Project-wide SSH keys' enabled

4.4 Ensure Oslogin Is Enabled for a Project (2 controls)

Compute Engine instances should all have OS Login enabled in the project Projects should have OS Login enabled at project level

4.5 Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance (1 control)

Compute Engine instances should have 'Enable connecting to serial ports' disabled

4.6 Ensure That IP Forwarding Is Not Enabled on Instances (1 control)

Compute Engine instances should have IP forwarding disabled

4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK) (1 control)

Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption

4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled (1 control)

Compute Engine instances should have Shielded VM enabled at launch

4.9 Ensure That Compute Instances Do Not Have Public IP Addresses (1 control)

Compute Engine instances should not have public IP addresses

5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible (2 controls)

Cloud Storage buckets used for exporting logs should prohibit anonymous and public access Cloud Storage buckets should prohibit anonymous and public access

5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled (1 control)

Cloud Storage buckets should have Bucket Only Policy enabled

5.2 Ensure That Cloud Storage Buckets Have Uniform BucketLevel Access Enabled (1 control)

Cloud Storage buckets should have uniform bucket-level access enabled

6.1.2 Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On' (1 control)

Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'

6.1.3 Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off' (1 control)

Cloud SQL MySQL instances should have 'local_infile' set to 'off'

6.2.1 Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter (1 control)

Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter

6.2.2 Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On' (1 control)

Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'

6.2.3 Ensure That the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On' (1 control)

Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'

6.2.4 Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately (1 control)

Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'

6.2.5 Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning' (1 control)

Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher

6.2.6 Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter (1 control)

Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter

6.2.7 Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled) (1 control)

Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)

6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging (1 control)

Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging

6.3.1 Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off (1 control)

Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'

6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off' (1 control)

Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'

6.3.3 Ensure 'user Connections' Database Flag for Cloud Sql Sql Server Instance Is Set to a Non-limiting Value (1 control)

Cloud SQL SQL Server instances should have 'user connections' configured

6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured (1 control)

Cloud SQL SQL Server instances should not have 'user options' configured

6.3.5 Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off' (1 control)

Cloud SQL SQL Server instances should have 'remote access' set to 'off'

6.3.6 Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on' (1 control)

Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'

6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is not set to 'on' (1 control)

Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'

6.4 Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL (1 control)

Cloud SQL instances should have SSL enabled

6.5 Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses (1 control)

Cloud SQL instances should prohibit world-readable access

6.6 Ensure That Cloud SQL Database Instances Do Not Have Public IPs (1 control)