Google Cloud Compliance FrameworksSpecialized Frameworks
NIST Cybersecurity Framework v1.0
Best for: The page describes the framework as voluntary. It is meant to help owners and operators of critical infrastructure and other interested entities to identify, assess, and manage cybersecurity-related risk.
| Mandatory? | Voluntary framework, as directed by Executive Order 13636 |
| Who validates? | |
| Renewal | |
| Scope | Owners and operators of critical infrastructure and other interested entities |
🏛 The Computer Security Division of the Information Technology Laboratory at NIST led the development of the Cybersecurity Framework. Official source →
Controls by Category
DE.AE-2: Detected events are analyzed to understand attack targets and methods. (2 controls)
DE.AE-3: Event data are collected and correlated from multiple sources and sensors. (20 controls)
AlloyDB instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterAlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricterAlloyDB instances should have 'log_min_messages' set to warning or higherHTTP(S) load balancers should have logging enabledProjects should have log metric filters and alerts configured for Audit Configuration changesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC Network Firewall rule changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for project ownership assignments and changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log metric filters and alerts configured for Cloud Storage IAM permission changesProjects should have log sinks configured for all log entriesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'
DE.CM-1: The network is monitored to detect potential cybersecurity events. (11 controls)
AlloyDB instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterAlloyDB instances should have 'log_min_error_statement' set to 'Error' or stricterAlloyDB instances should have 'log_min_messages' set to warning or higherVPC subnets should all have VPC Flow Logs enabledCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'
ID.AM-1: Physical devices and systems within the organization are inventoried. (1 control)
PR.AC-1: Identities and credentials are issued, managed, verified, revoked, andaudited for authorized devices, users and processes. (2 controls)
PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties. (15 controls)
Compute Engine instances should not have public IP addressesService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL instances should have IP assignment set to privateCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud Storage buckets used for exporting logs should use Bucket LockCloud Storage buckets should prohibit anonymous and public access
PR.DS-1: Data-at-rest is protected. (6 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionCompute Engine instances should have Confidential Computing enabledDataproc clusters should use customer-managed encryption keys for encryptionCloud KMS encryption keys should have rotation configured within 90 days
PR.DS-2: DData-in-transit is protected. (1 control)
PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition. (1 control)
PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality). (9 controls)
Projects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud SQL MySQL instances should have 'local_infile' set to 'off'Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configured
PR.IP-2: A System Development Life Cycle to manage systems is implemented. (3 controls)
PR.IP-4: Backups of information are conducted, maintained, and tested. (1 control)
PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy. (12 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for Audit Configuration changesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC Network Firewall rule changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for project ownership assignments and changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log metric filters and alerts configured for Cloud Storage IAM permission changesProjects should have log sinks configured for all log entries
PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities. (1 control)
RS.AN-1: Notifications from detection systems are investigated. (2 controls)
RS.CO-1: Personnel know their roles and order of operations when a response is needed. (1 control)
Related Frameworks
NIST SP 800-53 Rev 5 — 🟢 High overlap (97%)
CIS GCP Benchmark v2.0.0 — 🟢 High overlap (94%)
CIS GCP Benchmark v3.0.0 — 🟢 High overlap (90%)