Google Cloud Compliance FrameworksCore Frameworks
ISO/IEC 27001:2022
ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). The 2022 revision reorganizes Annex A controls into four themes: Organizational, People, Physical, and Technological, with 93 controls replacing the previous 114. It emphasizes risk-based security management, continuous improvement, and alignment with modern threats including cloud security and privacy.
| Mandatory? | Voluntary — demanded by B2B contracts |
| Who validates? | Accredited certification body (IAF member) · No self-assessment |
| Renewal | 3-year cert; annual surveillance |
| Observation period | Surveillance: years 1 and 2 |
Implemented Controls
The following controls are implemented as part of this framework.
Projects should have Cloud Audit Logs properly configured across all services and all usersDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionHTTP(S) load balancers should have logging enabledCompute Engine instances should not use the default service account with full access to all Cloud APIsProjects should prohibit default networksProjects should prohibit legacy networksVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledKMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysService accounts should use only GCP-managed service account keysUser-managed or external service account keys should have rotation configured every 90 days or lessService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entriesProjects should have 'Access Approval' set to 'Enabled'Projects should have Cloud Asset Inventory enabledCloud SQL instances should have SSL enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should have automated backups configuredCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets should prohibit anonymous and public access