Google Cloud Compliance FrameworksCore Frameworks
SOC 2
Service Organization Control 2 (SOC 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA) for evaluating service organizations' security, availability, processing integrity, confidentiality, and privacy controls. Based on the Trust Services Criteria, SOC 2 reports provide assurance to customers about a service provider's internal controls. It is primarily used by technology and cloud service providers globally to demonstrate security practices to customers and stakeholders.
| Mandatory? | Voluntary — required by enterprise procurement |
| Who validates? | Licensed CPA firm (SSAE 18) · No self-assessment |
| Renewal | Typically annual |
| Observation period | Type II: 3–12 months |
Controls by Category
C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality (7 controls)
AlloyDB clusters should use customer-managed encryption keys (CMEK) for encryptionBigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionCompute Engine instances should have Confidential Computing enabledDataproc clusters should use customer-managed encryption keys for encryptionCloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)
CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control (5 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entries
CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed (1 control)
CC3.4 COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control (1 control)
CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives (5 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entries
CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives (17 controls)
AlloyDB clusters should use customer-managed encryption keys (CMEK) for encryptionCompute Engine instances should all have OS Login enabled in the projectCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsProjects should prohibit default networksProjects should prohibit legacy networksIAM users should not have Service Account User or Service Account Token Creator roles at project levelCloud KMS cryptokeys should prohibit anonymous and public accessCloud KMS encryption keys should have rotation configured within 90 daysBigQuery tables should not be publicly readableCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL instances should have IP assignment set to privateCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud SQL SQL Server instances should have 'remote access' set to 'off'Cloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
CC6.2 Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity (1 control)
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives (15 controls)
Compute Engine instances should all have OS Login enabled in the projectCompute Engine instances should not use the default service accountCompute Engine instances should not use the default service account with full access to all Cloud APIsUser-managed service account keys should be used within the allowed inactivity periodService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesProjects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readableCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'
CC6.6 The entity implements logical access security measures to protect against threats from sources outside its system boundaries (7 controls)
Compute Engine instances should have 'Block Project-wide SSH keys' enabledCompute Engine instances should have IP forwarding disabledCompute Engine instances should have 'Enable connecting to serial ports' disabledCompute Engine instances should not have public IP addressesPublic IP addresses should not be listed in ShodanFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries. (7 controls)
Projects should prohibit default networksProjects should prohibit legacy networksCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud KMS cryptokeys should prohibit anonymous and public accessBigQuery tables should not be publicly readableCloud SQL instances should have IP assignment set to privateCloud SQL SQL Server instances should have 'remote access' set to 'off'
CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives (6 controls)
Cloud DNS managed zones should have DNSSEC enabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud DNS managed zones should not use RSASHA1 for zone-signing keysCloud SQL instances should have SSL enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internet
CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives. (1 control)
CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities (1 control)
CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events (17 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entriesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricterCloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricterCloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higherCloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled
CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. (3 controls)
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures (9 controls)
HTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledVPC subnets should all have VPC Flow Logs enabledLog buckets should have retention policies configured using Bucket LockProjects should have log metric filters and alerts configured for VPC network route changesCloud SQL PostgreSQL instances should have 'log_connections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'Cloud Storage buckets used for exporting logs should have retention policies enabled
CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents (1 control)
CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives (1 control)
Other (5 controls)
Organizations should have Essential Contacts configuredCloud SQL SQL Server instances should have '3625 (trace flag)' set to 'off'Cloud SQL SQL Server instances should have 'user connections' configuredCloud SQL SQL Server instances should not have 'user options' configuredCloud SQL instances should prohibit world-readable access
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements (3 controls)
PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements (6 controls)
Dataproc clusters should use customer-managed encryption keys for encryptionKMS keys should be rotated at least annuallyLog buckets should have retention policies configured using Bucket LockCloud SQL instances should have automated backups configuredCloud Storage buckets used for exporting logs should have retention policies enabledCloud Storage buckets used for exporting logs should use Bucket Lock
Related Frameworks
CIS GCP Benchmark v2.0.0 — 🟢 High overlap (86%)
CIS GCP Benchmark v3.0.0 — 🟢 High overlap (85%)
CIS GCP Benchmark v4.0.0 — 🟢 High overlap (85%)