Google Cloud Compliance FrameworksCore Frameworks
NIS2 Directive (EU 2022/2555)
The NIS2 Directive (EU 2022/2555) is the European Union's updated cybersecurity legislation that strengthens security requirements for essential and important entities across critical sectors. It expands the scope of the original NIS Directive, introduces stricter supervisory measures, and harmonizes cybersecurity risk management and incident reporting obligations across EU member states. Effective from October 2024.
| Mandatory? | Mandatory for essential/important entities in 18 EU sectors |
| Who validates? | National competent authority (EU member state) · No self-assessment |
| Renewal | Ongoing; no fixed audit cycle |
| Scope | Essential and important entities in energy, transport, health, digital infrastructure, etc. |
Controls by Category
1.1.1.a set out the relevant entities approach to managing the security of their network and information systems; (1 control)
1.1.1.c set out network and information security objectives; (5 controls)
1.1.2 The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented. (4 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changes
1.2.1 As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities... (5 controls)
1.2.4 Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles. (2 controls)
11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network... (5 controls)
Compute Engine instances should have 'Block Project-wide SSH keys' enabledProjects should prohibit legacy networksVPC networks should all have Cloud DNS logging enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
11.1.2.c ensure that access is only granted to users that have been adequately authenticated. (7 controls)
Service accounts should be used within the configured maximum unused periodService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'
11.2.2.a assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties; (5 controls)
Service accounts should be used within the configured maximum unused periodService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related roles
11.2.2.d ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration; (6 controls)
Service accounts should be used within the configured maximum unused periodService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related roles
11.2.2.e maintain a register of access rights granted; (3 controls)
11.2.2.f apply logging to the management of access rights. (1 control)
11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1. (7 controls)
Service accounts should be used within the configured maximum unused periodService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'
11.3.2.a establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts; (3 controls)
11.3.2.b set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance; (4 controls)
Service accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related roles
11.3.2.c individualise and restrict system administration privileges to the highest extent possible, (5 controls)
Service accounts should be used within the configured maximum unused periodService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related roles
11.3.2.d provide that system administration accounts are only used to connect to system administration systems. (5 controls)
Service accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'
11.4.2.a only use system administration systems for system administration purposes, and not for any other operations; (2 controls)
11.4.2.b separate logically such systems from application software not used for system administrative purposes, (2 controls)
11.4.2.c protect access to system administration systems through authentication and encryption. (7 controls)
Service accounts should be used within the configured maximum unused periodKMS keys should be rotated at least annuallyService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related roles
11.5.2.d apply logging to the management of identities. (20 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entriesProjects should have OS Login enabled at project levelCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
11.5.4 The relevant entities shall regularly review the identities for network and information systems and their users and, if no longer needed, deactivate them without delay. (5 controls)
User-managed service account keys should be used within the allowed inactivity periodService accounts should be used within the configured maximum unused periodService account keys should limit age to 100 daysService accounts should use only GCP-managed service account keysUser-managed or external service account keys should have rotation configured every 90 days or less
11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control. (4 controls)
11.6.2.a ensure the strength of authentication is appropriate to the classification of the asset to be accessed; (4 controls)
11.6.2.c require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised; (4 controls)
11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed. (4 controls)
12.1.2.c align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans. (1 control)
12.2.2.a cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (4 controls)
12.2.2.b provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (7 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionKMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysService account keys should limit age to 100 daysUser-managed or external service account keys should have rotation configured every 90 days or less
12.2.2.c provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred. (7 controls)
VPC networks should all have Cloud DNS logging enabledCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for zone-signing keysCloud SQL instances should not have public IP addressesCloud SQL instances should have SSL enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
2.1.2.e analyse the risks posed to the security of network and information systems, including threat, likelihood, impact, and risk level, taking into account cyber threat intelligence and vulnerabilities; (7 controls)
Projects should prohibit default networksProjects should prohibit legacy networksVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
2.1.2.g identify and prioritise appropriate risk treatment options and measures; (7 controls)
Projects should prohibit default networksProjects should prohibit legacy networksVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
2.1.2.h continuously monitor the implementation of the risk treatment measures; (7 controls)
HTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entries
2.2.1 The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the... (10 controls)
Projects should prohibit default networksProjects should prohibit legacy networksVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have container vulnerability scanning enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
2.3.1 The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies. (7 controls)
Projects should prohibit default networksProjects should prohibit legacy networksVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
3.1.2.d documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates. (1 control)
3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks. (4 controls)
3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact. (20 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entriesProjects should have OS Login enabled at project levelCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
3.2.3.a relevant outbound and inbound network traffic; (5 controls)
3.2.3.b creation, modification or deletion of users of the relevant entities network and information systems and extension of the permissions; (4 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changes
3.2.3.c access to systems and applications; (5 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC subnets should all have VPC Flow Logs enabledProjects should have OS Login enabled at project levelCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'
3.2.3.d authentication-related events; (7 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for Custom Role changesProjects should have OS Login enabled at project levelCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'
3.2.3.e all privileged access to systems and applications, and activities performed by administrative accounts; (3 controls)
3.2.3.f access or changes to critical configuration and backup files; (4 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changes
3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically.... (4 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changes
3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes. (4 controls)
3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity. (4 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changes
3.5.3.a with the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to incident notification; (1 control)
3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures. (20 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entriesProjects should have OS Login enabled at project levelCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents. (1 control)
4.1.2.f recovery plans for specific operations, including recovery objectives; (1 control)
4.1.2.g required resources, including backups and redundancies; (1 control)
4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons... (4 controls)
4.2.2.b assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment; (1 control)
4.2.2.e restoring data from backup copies; (1 control)
4.2.2.f retention periods based on business and regulatory requirements. (3 controls)
5.1.2.a the cybersecurity practices of the suppliers and service providers, including their secure development procedures; (4 controls)
5.1.4.f an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities; (1 control)
5.1.7.d analyse the risks presented by changes related to ICT products and ICT services from suppliers and service providers and, where appropriate, take mitigating measures in a timely manner. (1 control)
6.1.2.b requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period; (3 controls)
6.2.1 Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of... (3 controls)
6.2.2.b apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures; (10 controls)
Compute Engine instances should have Shielded VM enabled at launchUser-managed service account keys should be used within the allowed inactivity periodService accounts should be used within the configured maximum unused periodAPI keys should allow access only to APIs needed by the applicationService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'
6.4.1 The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management. (4 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changes
6.6.1.a security patches are applied within a reasonable time after they become available; (2 controls)
6.7.2.b determine and apply controls to protect the relevant entities internal network domains from unauthorised access; (3 controls)
6.7.2.e not use systems used for administration of the security policy implementation for other purposes; (2 controls)
6.7.2.g where appropriate, exclusively allow access to the relevant entities network and information systems by devices authorised by those entities; (3 controls)
6.7.2.i establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from... (5 controls)
VPC networks should all have Cloud DNS logging enabledCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for zone-signing keysFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
6.7.2.l apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network. (3 controls)
6.9.2 For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response... (2 controls)
7.2.b the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results; (20 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entriesProjects should have OS Login enabled at project levelCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
9.2.a in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit; (9 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionVPC networks should all have Cloud DNS logging enabledDataproc clusters should use customer-managed encryption keys for encryptionCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for zone-signing keysAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the application
9.2.c the relevant entities approach to key management, including, where appropriate, methods for the following: (10 controls)
Compute Engine instances should have 'Block Project-wide SSH keys' enabledUser-managed service account keys should be used within the allowed inactivity periodKMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysService accounts should use only GCP-managed service account keysUser-managed or external service account keys should have rotation configured every 90 days or lessCloud KMS cryptokeys should prohibit anonymous and public accessProjects should not use API keys
9.2.c.i generating different keys for cryptographic systems and applications; (10 controls)
Compute Engine instances should have 'Block Project-wide SSH keys' enabledUser-managed service account keys should be used within the allowed inactivity periodKMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysService accounts should use only GCP-managed service account keysUser-managed or external service account keys should have rotation configured every 90 days or lessCloud KMS cryptokeys should prohibit anonymous and public accessProjects should not use API keys
9.2.c.ii issuing and obtaining public key certificates; (6 controls)
KMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysUser-managed or external service account keys should have rotation configured every 90 days or lessProjects should not use API keys
9.2.c.iv storing keys, including how authorised users obtain access to keys; (3 controls)
9.2.c.v changing or updating keys, including rules on when and how to change keys; (4 controls)
9.2.c.vi backing up or archiving keys; (6 controls)
KMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysUser-managed or external service account keys should have rotation configured every 90 days or lessCloud KMS cryptokeys should prohibit anonymous and public access
9.2.c.vii logging and auditing of key management-related activities; (4 controls)
User-managed service account keys should be used within the allowed inactivity periodAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysUser-managed or external service account keys should have rotation configured every 90 days or less
9.2.c.xii setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management. (10 controls)
Compute Engine instances should have 'Block Project-wide SSH keys' enabledUser-managed service account keys should be used within the allowed inactivity periodKMS keys should be rotated at least annuallyAPI keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationService account keys should limit age to 100 daysService accounts should use only GCP-managed service account keysUser-managed or external service account keys should have rotation configured every 90 days or lessCloud KMS cryptokeys should prohibit anonymous and public accessProjects should not use API keys
Related Frameworks
BSI C5:2025 — 🟢 High overlap (93%)
CIS GCP Benchmark v2.0.0 — 🟢 High overlap (92%)
CIS GCP Benchmark v3.0.0 — 🟢 High overlap (90%)