compliance.tf
Google Cloud Compliance FrameworksCore Frameworks

NIST SP 800-53 Rev 5

The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5 provides a comprehensive catalog of security and privacy controls for information systems and organizations. Published by the U.S. Department of Commerce in September 2020, this framework supports risk management processes and compliance with federal legislation including FISMA. It is used by U.S. federal agencies and organizations globally seeking a risk-based approach to security and privacy controls.

Mandatory?Mandatory for U.S. federal agencies; voluntary for private sector
Who validates?Authorizing Official; 3PAO for FedRAMP overlays · No self-assessment
RenewalATO reauthorization every 3 years (federal)
ScopeFederal information systems; also used as private-sector baseline

Controls by Category

AC-17 Remote Access (1 control)

Compute Engine instances should have 'Block Project-wide SSH keys' enabled

AC-18 Wireless Access (4 controls)

Projects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keys

AC-2 Account Management (1 control)

Compute Engine instances should all have OS Login enabled in the project

AC-3 Account Management (14 controls)

Compute Engine instances should not have public IP addressesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should use Bucket LockCloud Storage buckets should prohibit anonymous and public access

AC-5 Separation Of Duties (14 controls)

Compute Engine instances should not have public IP addressesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should use Bucket LockCloud Storage buckets should prohibit anonymous and public access

AC-6 Least Privilege (15 controls)

Compute Engine instances should not have public IP addressesService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should use Bucket LockCloud Storage buckets should prohibit anonymous and public access

AU-12 Audit Record Generation (20 controls)

AlloyDB instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterAlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricterAlloyDB instances should have 'log_min_messages' set to warning or higherHTTP(S) load balancers should have logging enabledProjects should have log metric filters and alerts configured for Audit Configuration changesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC Network Firewall rule changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for project ownership assignments and changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log metric filters and alerts configured for Cloud Storage IAM permission changesProjects should have log sinks configured for all log entriesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'

AU-2 Event Logging (10 controls)

HTTP(S) load balancers should have logging enabledProjects should have log metric filters and alerts configured for Audit Configuration changesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC Network Firewall rule changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for project ownership assignments and changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log metric filters and alerts configured for Cloud Storage IAM permission changesProjects should have log sinks configured for all log entries

AU-3 Content of Audit Records (11 controls)

AlloyDB instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterAlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricterAlloyDB instances should have 'log_min_messages' set to warning or higherVPC networks should all have Cloud DNS logging enabledCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'

AU-6 Audit Record Review, Analysis And Reporting (2 controls)

Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabled

AU-7 Audit Record Reduction And Report Generation (21 controls)

AlloyDB instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterAlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricterAlloyDB instances should have 'log_min_messages' set to warning or higherProjects should have Cloud Audit Logs properly configured across all services and all usersVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for Audit Configuration changesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC Network Firewall rule changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for project ownership assignments and changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log metric filters and alerts configured for Cloud Storage IAM permission changesProjects should have log sinks configured for all log entriesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'

CA-9 Internal System Connections (3 controls)

Compute Engine instances should have IP forwarding disabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet

CM-1 Configuration Management Policy and Procedures (3 controls)

Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

CM-2 Baseline Configuration (7 controls)

Projects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

CM-6 Configuration Settings (10 controls)

Compute Engine instances should have 'Enable connecting to serial ports' disabledProjects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud SQL MySQL instances should have 'local_infile' set to 'off'Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

CM-7 Least Functionality (11 controls)

Compute Engine instances should have 'Enable connecting to serial ports' disabledProjects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud SQL MySQL instances should have 'local_infile' set to 'off'Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

CM-8 System Component Inventory (1 control)

Projects should have Cloud Asset Inventory enabled

CM-9 Configuration Management Plan (7 controls)

Projects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

IA-5 Authenticator Management (9 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionCompute Engine instances should have 'Block Project-wide SSH keys' enabledCompute Engine instances should have Confidential Computing enabledCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsDataproc clusters should use customer-managed encryption keys for encryptionCloud KMS encryption keys should have rotation configured within 90 days

IR-6 Incident Reporting (1 control)

Organizations should have Essential Contacts configured

MA-4 Nonlocal Maintenance (1 control)

Cloud SQL instances should not have public IP addresses

MP-2 Media Access (14 controls)

Compute Engine instances should not have public IP addressesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should use Bucket LockCloud Storage buckets should prohibit anonymous and public access

PL-8 Information Security Architecture (3 controls)

API keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationProjects should not use API keys

SA-10 Developer Configuration Management (3 controls)

Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

SA-3 System Development Life Cycle (3 controls)

Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

SA-8 Security Engineering Principles (6 controls)

API keys should have rotation configured every 90 daysAPI keys should allow access only to APIs needed by the applicationProjects should not use API keysCloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured

SC-28 Protection Of Information At Rest (6 controls)

BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionCompute Engine instances should have Confidential Computing enabledDataproc clusters should use customer-managed encryption keys for encryptionCloud KMS encryption keys should have rotation configured within 90 days

SC-7 Boundary Protection (3 controls)

Compute Engine instances should have IP forwarding disabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet

SC-8 Transmission Confidentiality And Integrity (1 control)

Compute Engine instances should have 'Block Project-wide SSH keys' enabled

SI-4 System Monitoring (1 control)

VPC subnets should all have VPC Flow Logs enabled

SI-7 Software, Firmware, and Information Integrity (1 control)

Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'

Related Frameworks

CIS GCP Benchmark v2.0.0 — 🟢 High overlap (94%)

CIS GCP Benchmark v3.0.0 — 🟢 High overlap (93%)

CIS GCP Benchmark v4.0.0 — 🟢 High overlap (93%)

NIS2 Directive (EU 2022/2555)

Previous Page

NIST Cybersecurity Framework v2.0

Next Page

On this page

Controls by CategoryAC-17 Remote Access (1)AC-18 Wireless Access (4)AC-2 Account Management (1)AC-3 Account Management (14)AC-5 Separation Of Duties (14)AC-6 Least Privilege (15)AU-12 Audit Record Generation (20)AU-2 Event Logging (10)AU-3 Content of Audit Records (11)AU-6 Audit Record Review, Analysis And Reporting (2)AU-7 Audit Record Reduction And Report Generation (21)CA-9 Internal System Connections (3)CM-1 Configuration Management Policy and Procedures (3)CM-2 Baseline Configuration (7)CM-6 Configuration Settings (10)CM-7 Least Functionality (11)CM-8 System Component Inventory (1)CM-9 Configuration Management Plan (7)IA-5 Authenticator Management (9)IR-6 Incident Reporting (1)MA-4 Nonlocal Maintenance (1)MP-2 Media Access (14)PL-8 Information Security Architecture (3)SA-10 Developer Configuration Management (3)SA-3 System Development Life Cycle (3)SA-8 Security Engineering Principles (6)SC-28 Protection Of Information At Rest (6)SC-7 Boundary Protection (3)SC-8 Transmission Confidentiality And Integrity (1)SI-4 System Monitoring (1)SI-7 Software, Firmware, and Information Integrity (1)Related Frameworks

Ask AI about this

Help improve this page