Google Cloud Compliance FrameworksCore Frameworks
PCI DSS v4.0
The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 is an information security standard for organizations that handle branded credit cards from major card schemes. Released in March 2022 by the PCI Security Standards Council, this version modernizes requirements with enhanced flexibility through customized implementation and expanded multi-factor authentication requirements. It applies globally to all entities that store, process, or transmit cardholder data and became mandatory for compliance assessments after March 31, 2024.
| Mandatory? | Mandatory for any entity processing card data |
| Who validates? | QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4) |
| Renewal | Annual |
| Scope | Cardholder data environment (CDE) and connected systems |
Controls by Category
1.2.5: Network security controls (NSCs) are configured and maintained. (3 controls)
1.2.8: Network security controls (NSCs) are configured and maintained. (7 controls)
Compute Engine instances should not have public IP addressesCloud SQL instances should not have public IP addressesCloud SQL instances should have SSL enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public access
1.3.1: Network access to and from the cardholder data environment is restricted. (7 controls)
Cloud SQL instances should not have public IP addressesProjects should have 'Access Approval' set to 'Enabled'Firewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
1.3.2: Network access to and from the cardholder data environment is restricted. (6 controls)
Cloud SQL instances should not have public IP addressesProjects should have 'Access Approval' set to 'Enabled'Firewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public access
1.4.2: Network connections between trusted and untrusted networks are controlled. (7 controls)
Compute Engine instances should not have public IP addressesProjects should prohibit default networksCloud SQL instances should not have public IP addressesFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public access
1.4.5: Network connections between trusted and untrusted networks are controlled. (3 controls)
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. (8 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersService accounts should not have Admin privilegesProjects should have log metric filters and alerts configured for VPC network route changesCloud SQL instances should not have public IP addressesProjects should have 'Access Approval' set to 'Enabled'Firewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable access
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (15 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (15 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledAPI keys should allow access only to APIs needed by the applicationLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (13 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (15 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (13 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesCloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized loggingCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.3.1: Audit logs are protected from destruction and unauthorized modifications. (8 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.3.2: Audit logs are protected from destruction and unauthorized modifications. (9 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionLog buckets should have retention policies configured using Bucket LockProjects should have 'Access Approval' set to 'Enabled'Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.3.3: Audit logs are protected from destruction and unauthorized modifications. (6 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersLog buckets should have retention policies configured using Bucket LockCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.3.4: Audit logs are protected from destruction and unauthorized modifications. (7 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionLog buckets should have retention policies configured using Bucket LockCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. (1 control)
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. (1 control)
10.5.1: Audit log history is retained and available for analysis. (6 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersVPC networks should all have Cloud DNS logging enabledLog buckets should have retention policies configured using Bucket LockProjects should have log sinks configured for all log entriesCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. (5 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. (1 control)
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed. (1 control)
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. (1 control)
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. (1 control)
11.5.2: Network intrusions and unexpected file changes are detected and responded to. (2 controls)
11.6.1: Unauthorized changes on payment pages are detected and responded to. (1 control)
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. (2 controls)
2.2.5: System components are configured and managed securely. (7 controls)
HTTP(S) load balancers should have logging enabledCloud Storage buckets should have Bucket Only Policy enabledCloud SQL instances should have SSL enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
2.2.7: System components are configured and managed securely. (4 controls)
3.5.1.1: Primary account number (PAN) is secured wherever it is stored. (3 controls)
3.5.1.3: Primary account number (PAN) is secured wherever it is stored. (9 controls)
KMS keys should be rotated at least annuallyCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
3.5.1: Primary account number (PAN) is secured wherever it is stored. (9 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionDataproc clusters should use customer-managed encryption keys for encryptionKMS keys should be rotated at least annuallyCloud KMS cryptokeys should prohibit anonymous and public accessBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'
3.6.1.2: Cryptographic keys used to protect stored account data are secured. (3 controls)
3.6.1.3: Cryptographic keys used to protect stored account data are secured. (3 controls)
3.6.1.4: Cryptographic keys used to protect stored account data are secured. (3 controls)
3.6.1: Cryptographic keys used to protect stored account data are secured. (3 controls)
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (3 controls)
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (3 controls)
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (3 controls)
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (2 controls)
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (3 controls)
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. (3 controls)
4.2.1.1: PAN is protected with strong cryptography during transmission. (1 control)
4.2.1: PAN is protected with strong cryptography during transmission. (1 control)
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. (5 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher
7.2.1: Access to system components and data is appropriately defined and assigned. (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'Cloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
7.2.2: Access to system components and data is appropriately defined and assigned. (12 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'Cloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
7.2.3: Access to system components and data is appropriately defined and assigned. (3 controls)
7.2.5.1: Access to system components and data is appropriately defined and assigned. (2 controls)
7.2.5: Access to system components and data is appropriately defined and assigned. (13 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'Cloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
7.2.6: Access to system components and data is appropriately defined and assigned. (3 controls)
7.3.1: Access to system components and data is managed via an access control system(s). (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have 'Access Approval' set to 'Enabled'Cloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
7.3.2: Access to system components and data is managed via an access control system(s). (12 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have log metric filters and alerts configured for Custom Role changesCloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
7.3.3: Access to system components and data is managed via an access control system(s). (15 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'Cloud Storage buckets should have Bucket Only Policy enabledCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (2 controls)
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (3 controls)
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (3 controls)
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (5 controls)
Service accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL instances should prohibit world-readable access
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. (7 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelProjects should have 'Access Approval' set to 'Enabled'Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'
8.3.10.1: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.2: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.4: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.5: Strong authentication for users and administrators is established and managed. (3 controls)
8.3.7: Strong authentication for users and administrators is established and managed. (2 controls)
8.3.9: Strong authentication for users and administrators is established and managed. (2 controls)
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. (2 controls)
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. (9 controls)
Compute Engine instances should not have public IP addressesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. (9 controls)
Compute Engine instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. (14 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers. (1 control)
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. (2 controls)
A3.4.1: Logical access to the cardholder data environment is controlled and managed. (8 controls)
Compute Engine instances should not have public IP addressesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
A3.5.1: Suspicious events are identified and responded to. (2 controls)
Related Frameworks
CIS GCP Benchmark v2.0.0 — 🟢 High overlap (96%)
BSI C5:2025 — 🟢 High overlap (94%)
CIS GCP Benchmark v3.0.0 — 🟢 High overlap (94%)