Assured Workloads cloud controls

This page provides reference content for the built-in cloud controls that are included in Assured Workloads frameworks. Cloud controls can apply to folders or projects.

Google Cloud cloud controls

Activate Security Command Center

Activate Security Command Center to evaluate security and data attack surfaces and help mitigate and remediate risks related to misconfigurations, vulnerabilities, and threats.

Enforcement mode	Audit
Finding category	SCC_NOT_ACTIVATED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

To activate Security Command Center, see Overview of activating Security Command Center.

Activate Security Command Center for Continuous Monitoring

Use Security Command Center to define security policies and deploy and monitor them.

Enforcement mode	Audit
Finding category	SECURITY_COMMAND_CENTER_NOT_ACTIVATED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Activate Security Command Center.

• Create and deploy frameworks with cloud controls that align with your security policies.

• Review and resolve findings.

• Integrate with notification channels such as email and chat.

Allocate Audit Log Storage Capacity

Allocate sufficient audit log storage capacity to accommodate audit logs

Enforcement mode	Detective Audit
Severity	LOW
Finding category	INSUFFICIENT_AUDIT_LOG_STORAGE
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

• Verify that you can see audit logs.

• Verify that logs are being exported to the Cloud Storage bucket.

• Verify the retention period for your log buckets.

• Verify log storage capacity. In the console, got to Logging > Metrics and enter the following: custom.googleapis.com/log_storage_capacity

• Verify the alerting policy for low log storage in your bucket.

• Verify that storage capacity is sufficient for the Cloud Storage bucket (the usage is less than 90%).

• Review the bucket retention period to ensure that regular review and adjustment of log storage capacity is complete.

Allow Only IL5 Compliant APIs for Gemini Enterprise Agent Platform

Restrict your folder or project to permit only Gemini Enterprise Agent Platform APIs that are compliant with Impact Level 5 (IL5).

Enforcement mode	Preventive Detective
Severity	HIGH
Finding category	GEMINI_ENTERPRISE_AGENT_PLATFORM_ALLOW_IL5_COMPLIANT_APIS
Category name in the API	CC_CATEGORY_INFRASTRUCTURE
Revision number	1
Supported target resources	Folder Project

Rules

Organization policy constraint

constraints/vertexai.allowOnlyIL5CompliantAPIs

Remediation steps

• Remediation for organization policy violation: Set the vertexai.allowOnlyIL5CompliantAPIs constraint to true. See Updating policies with boolean rules.

Allow Only ITAR Compliant APIs for Gemini Enterprise Agent Platform

Restrict your folder or project to permit only Gemini Enterprise Agent Platform APIs that are compliant with International Traffic in Arms Regulations (ITAR).

Enforcement mode	Preventive Detective
Severity	HIGH
Finding category	GEMINI_ENTERPRISE_AGENT_PLATFORM_ALLOW_ITAR_COMPLIANT_APIS
Category name in the API	CC_CATEGORY_INFRASTRUCTURE
Revision number	1
Supported target resources	Folder Project

Rules

Organization policy constraint

constraints/vertexai.allowOnlyITARCompliantAPIs

Remediation steps

• Remediation for organization policy violation: Set the vertexai.allowOnlyITARCompliantAPIs constraint to true. See Updating policies with boolean rules.

Apply Security Engineering Principles

Apply system security and privacy engineering principles in the specification, design, development, implementation, and modification of the system components.

Enforcement mode	Audit
Finding category	MISSING_SECURITY_ENGINEERING_PRINCIPLES
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Address security requirements when building and applying security engineering principles to new development and operations of its data and information systems.

• Include defense in depth at every phase of your system development life cycle, secure coding, security control tailoring, threat modeling, and risk management of your data and information system.

Assess Actions that Don't Require Identification or Authentication

Allow specific user actions without identification or authentication if they are deemed unnecessary, such as accessing public websites. The exception applies when identification and authentication have not occurred, not when they are simply not repeated.

Enforcement mode	Audit
Finding category	ACTIONS_WITHOUT_IDENTIFICATION_AUTHENTICATION
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

• Review permissions assigned to service accounts, users, and roles.

• Monitor service accounts, especially those with elevated privileges.

• Review IAM allow policies to ensure only authorized entities have necessary permissions.

• Review external IP addresses and firewall rules to help prevent unauthorized access.

• Identify the user actions that don't require identification or authentication.

• Review system designs and use cases to understand the scenarios.

• Evaluate potential risks and impact for exemption.

• Document your rationale for exemptions.

• Identify the security controls to mitigate potential risks.

• Align exemptions with your organization's compliance requirements.

Assess the Availability of Compute and GKE Resources

Protect the availability of Compute VM instances and Google Kubernetes Engine (GKE) containers by allocating sufficient resources based on priority, quota, and security safeguards.

Enforcement mode	Audit
Finding category	MISSING_RESOURCE_ASSESSMENT
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Use Cloud Monitoring and other observability tools to monitor for demand and performance.

• In the Cloud Monitoring dashboard, review the VM configuration.

• Review deployment scripts and orchestration tools to confirm that they allocate resources as intended.

• Review GKE system metrics for resource allocations.

Assign Correct Bucket Label

Bucket labels let you create key:value pairs that are stored as part of the bucket's metadata. You can use these labels to help identify the purpose of the bucket to your organization.

Enforcement mode	Audit
Finding category	BUCKET_LABEL_INCORRECT
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Set correct label for Cloud Storage buckets. For more information, see Add, modify, or remove a bucket's labels.

Assign Redis Role at Project Level

Assign the Redis Identity and Access Management (IAM) roles at the project level. Redis IAM roles assigned at the organization or folder level are overly broad. This control checks the IAM allow policy in the resource metadata for principals that are assigned roles/redis.admin, roles/redis.editor, roles/redis.viewer at the organization or folder level.

Enforcement mode	Detective
Severity	MEDIUM
Finding category	REDIS_ROLE_USED_ON_ORG
Revision number	3
Supported target resources	Organization Folder Project

Remediation steps

In the Google Cloud console, go to the IAM page and remove Redis IAM roles from the organization or folder level and add them on individual projects. For more information, see Manage access to projects, folders, and organizations.

Authorize and Monitor Privileged Remote Access

Authorize the use of privileged commands execution and access to security information through remote access.

Enforcement mode	Audit
Finding category	PRIVILEGED_REMOTE_ACCESS_NOT_AUTHORIZED_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

• Create custom roles for privileged access or consider temporary elevated access.

• Grant only specific roles to service accounts for automated systems that require remote access.

• Use SSH for remote access to VMs.

• Enable audit logging for services that store sensitive data.

• Configure VPC Flow Logs to capture network traffic.

• Enable Binary Authorization to enforce policies when deploying images.

• Use Secret Manager to create and store secrets.

• Configure alerting policies for unusual or unauthorized activities.

Authorize Wireless Access to Production Systems

Authorize wireless access to applications in production environments.

Enforcement mode	Audit
Finding category	WIRELESS_ACCESS_PRODUCTION_SYSTEMS_NOT_AUTHORIZED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access to your systems. Authorize wireless access to your systems before you allow such connections.

Automate Account Management System

Ensure that you have IAM policy structures to automate IAM role assignments based on resources and context-specific conditions.

Enforcement mode	Audit
Finding category	ACCOUNT_MANAGEMENT_SYSTEMS_NOT_SUPPORTED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To retrieve log entries, see List log entries.

To get a ServiceAccount, see Get a ServiceAccount.

To get the definition of a role, see Get Role Definition.

Automate Integrity Verification

Employ integrity verification tools to detect unauthorized changes to your software, firmware, and information.

Enforcement mode	Audit
Finding category	IMPROPER_INTEGRITY_VERIFICATION_MECHANISMS
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Configure your OS Policy to perform integrity verification. For more information, see OS policy and OS policy assignment, Create an OS policy assignment, and Manage OS policy assignments.

• Create custom tools that regularly check the integrity of software and configurations.

Automate Near Real-time Event Analysis

Use automated tools to support near real-time analysis of events.

Enforcement mode	Audit
Finding category	REAL_TIME_EVENT_ANALYSIS_NOT_AUTOMATED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Implement automated real-time event analysis:

• Use Cloud Monitoring and Cloud Logging to collect, monitor, and analyze event data, such as system and application logs, performance metrics, and other relevant information.

• Create custom monitoring metrics in Cloud Monitoring to track specific parameters that are critical.

• Set up alerting policies in Cloud Monitoring to receive notifications when metrics or logs indicate unusual or unauthorized activities.

• Use Pub/Sub to create topics and subscriptions for real-time event processing. For more information, see Publish message overview and Subscription overview.

Avoid RSASHA1 for DNSSEC Signing

Don't use the RSASHA1 algorithm for key signing when enabling DNSSEC for Cloud DNS zones.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	RSASHA1_FOR_SIGNING
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Replace the algorithm. For more information, see Using advanced signing options.

BigQuery compliance settings

BigQuery compliance settings

Enforcement mode	Preventive
Severity	HIGH
Finding category	BIGQUERY_REGULATORY_SETTINGS_NON_COMPLIANT
Category name in the API	CC_CATEGORY_DATA_RESIDENCY
Revision number	2
Supported target resources	Organization Folder Project

Parameters

framework

STRING Required.

Block Administrator Roles from Service Accounts

A service account with Administrator, Owner, or Editor privileges has broad access to your Google Cloud environment, which can impact its security.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ADMIN_SERVICE_ACCOUNT
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Go to the IAM policy page in the Google Cloud console, click Edit principal, and remove the excessive role or roles.

Block Automatic IAM Grants to Default Service Accounts

Use the "Disable Automatic IAM Grants for Default Service Accounts" (iam.automaticIamGrantsForDefaultServiceAccounts) organization policy constraint to prevent automatic role grants to default service accounts.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ORG_POLICY_AUTOMATIC_IAM_GRANTS_TO_DEFAULT_SERVICE_ACCOUNTS_ENABLED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

To disable the automatic role grant, see Disable automatic role grants to default service accounts.

Block Default VPC Network for Agent Platform Workbench Instances

Don't create Gemini Enterprise Agent Platform Workbench Instances in the default VPC network to help prevent the use of its over-permissive default firewall rules.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	VERTEX_AI_WORKBENCH_DEFAULT_VPC_NETWORK_USED
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

You can't change the network on an Agent Platform Workbench Instance after it's created. Delete the existing instances, create another VPC network, and create new instances that use the new VPC network.

1. Delete the instances. For instructions to shut down the instance before deleting it, see Shut down an Agent Platform Workbench instance.

2. Create a VPC network and subnet for the project. For instructions, see Create and manage VPC networks. For information about Agent Platform Workbench networking requirements, see Network configuration options.

3. Create the instances. For instructions, see Create an Agent Platform Workbench Instance. In the Networking section, select the VPC network and subnet that you created.

Block External IP Address Access on Compute Engine VM Instances

Use the "Define allowed external IPs for VM instances" (compute.vmExternalIpAccess) organization policy constraint to block public access to your VMs.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	ORG_POLICY_EXTERNAL_IP_ACCESS_ALLOWED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To block external IP addresses on Compute Engine VM instances, see Restrict external IP addresses to specific instances.

Block File Downloading in JupyterLab Console

Don't permit file downloading from the JupyterLab console in Workbench instances to reduce data exfiltration risks and help prevent malware distribution.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	VERTEX_AI_JUPYTERLAB_FILE_DOWNLOADING_ENABLED
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Turn off file downloading for the instance.

1. In the Google Cloud console, go to the Instances page.

2. Click the instance that you want to configure.

3. In the Software and security tab, add the notebook-disable-downloads metadata key and set the value to TRUE.

For more information, see Update an instance's metadata.

Block Generic Access to Cassandra Ports

Block connections on TCP ports 7000, 70001, 7199, 8888, 9042, 9160, 61620, and 61621 from all IP addresses to help prevent unwanted traffic and attacks on Apache Cassandra services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_CASSANDRA_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:7000, tcp:70001, tcp:7199, tcp:8888, tcp:9042, tcp:9160, tcp:61620, and tcp:61621 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to CiscoSecure/WebSM Ports

Block incoming connections on TCP port 9090 from all IP addresses to help prevent undesired traffic and attacks on CiscoSecure/WebSM services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_CISCOSECURE_WEBSM_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:9090 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to Directory Service Ports

Block incoming connections on TCP port 445 or UDP port 445 from all IP addresses to help prevent undesired traffic and attacks on Directory Services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_DIRECTORY_SERVICES_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:445 and udp:445 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to DNS Ports from All IP Addresses

Block incoming connections on TCP port 53 or UDP port 53 from all IP addresses to help prevent undesired traffic and attacks on DNS services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_DNS_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:53 and udp:53 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to Elasticsearch Ports from All IP Addresses

Block incoming connections on TCP ports 9200 and 9300 from all IP addresses to help prevent undesired traffic and attacks on Elasticsearch services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_ELASTICSEARCH_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:9200 and tcp:9300 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to FTP Ports

Block incoming connections on TCP port 21 from all IP addresses to help prevent undesired traffic and attacks on FTP services. This control doesn't apply to GKE firewalls.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_FTP_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:21 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to HTTP Ports

Block incoming connections on TCP port 80 from all IP addresses to help prevent undesired traffic and attacks on HTTP services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_HTTP_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:80 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to LDAP Ports

Block incoming connections on TCP ports 389 and 636 and UDP port 389 from all IP addresses to help prevent undesired traffic and attacks on LDAP services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_LDAP_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:389, tcp:636, and udp:389 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to Memcached Ports

Block incoming connections on TCP ports 11211, 11214, and 11215 or UDP ports 11211, 11214, and 11215 from all IP addresses to help prevent undesired traffic and attacks on Memcached services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_MEMCACHED_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:11211, tcp:11214, tcp:11215, udp:11211, udp:11214, and udp:11215 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to MongoDB Ports

Block connections on TCP ports 27017, 27018, and 27019 from all IP addresses to help prevent undesired traffic and attacks on MongoDB services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_MONGODB_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:27017, tcp:27018 and tcp:27019 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to MySQL Ports

Block incoming connections on TCP port 3306 from all IP addresses to help prevent undesired traffic and attacks on MySQL services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_MYSQL_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:3306 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to NetBIOS Ports from All IP Addresses

Block incoming connections from all IP addresses to TCP and UDP ports 137, 138, and 139 to help prevent undesired traffic and attacks on NetBIOS services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_NETBIOS_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:137-139 and udp:137-139 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to Oracle Database Ports

Block incoming connections on TCP ports 1521, 2483, and 2484 or UDP ports 2483 and 2484 from all IP addresses to help prevent undesired traffic and attacks on Oracle databases.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_ORACLEDB_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:1521, tcp:2483, tcp:2484, udp:2483, and udp:2484 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to POP3 Server Ports

Block incoming connections on TCP port 110 from all IP addresses to help prevent undesired traffic and attacks on POP3 services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_POP3_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:110 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access this port instead. For more information, see Use VPC firewall rules.

Block Generic Access to PostgreSQL Server Ports from All IP Addresses

Block incoming connections on TCP port 5432 from all IP addresses to help prevent undesired traffic and attacks on PostgreSQL services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_POSTGRESQL_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:5432 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access this port instead. For more information, see Use VPC firewall rules.

Block Generic Access to RDP Ports

Block incoming connections on TCP port 3389 or UDP port 3389 from all IP addresses to help prevent undesired traffic and attacks on RDP server.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_RDP_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Remove public access from the RDP port. Go to the Firewall policies page in the Google Cloud console and edit the firewall rule. Under Source IP ranges; delete 0.0.0.0/0 and add specific IP addresses or IP ranges that you want to let connect to the instance. Select TCP and UDP, and enter port 3389 for both.

Block Generic Access to Redis Server Ports from All IP Addresses

Block incoming connections on TCP port 6379 from all IP addresses to help prevent undesired traffic and attacks on Redis services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_REDIS_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:6379 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access this port instead. For more information, see Use VPC firewall rules.

Block Generic Access to SMTP Server Ports

Block incoming connections on TCP port 25 from all IP addresses to help prevent undesired traffic and attacks on SMTP services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_SMTP_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:25 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access this port instead. For more information, see Use VPC firewall rules.

Block Generic Access to SSH Ports

Block incoming connections on TCP port 22 or SCTP port 22 from all IP addresses to help prevent undesired traffic and attacks on SSH server.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_SSH_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Remove public access from the SSH port. Go to the Firewall policies page in the Google Cloud console and edit the firewall rule. Under Source IP ranges; delete 0.0.0.0/0 and add specific IP addresses or IP ranges that you want to let connect to the instance. Select TCP and SCTP, and enter port 22 for both.

Block Generic Access to Telnet Servers

Block incoming connections on TCP port 23 from all IP addresses to help prevent undesired traffic and attacks on Telnet services.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_TELNET_PORT
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to port tcp:23 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access this port instead. For more information, see Use VPC firewall rules.

Block Internet Access for Runtime Templates in Agent Platform Colab Enterprise

Don't permit internet access in runtime templates in Colab Enterprise on Gemini Enterprise Agent Platform to reduce the external attack surface and help prevent potential data exfiltration.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	VERTEX_AI_RUNTIME_TEMPLATE_IDLE_SHUTDOWN_DISABLED
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	2.1
Supported target resources	Organization Folder Project

Remediation steps

You can't change this setting after the runtime template is created. Delete the existing runtime template and create a new one with internet access turned off.

1. Delete the runtime template. For instructions, see Delete a runtime template.

2. Create a runtime template. For instructions, see Create a runtime template. To turn off internet access, in the Networking and security section, clear Enable public internet access.

Block Internet Access for Runtime Templates in Agent Platform Colab Enterprise

Don't permit internet access in runtime templates in Colab Enterprise on Gemini Enterprise Agent Platform to reduce the external attack surface and help prevent potential data exfiltration.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	VERTEX_AI_RUNTIME_TEMPLATE_INTERNET_ACCESS_ENABLED
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

You can't change this setting after the runtime template is created. Delete the existing runtime template and create a new one with internet access turned off.

1. Delete the runtime template. For instructions, see Delete a runtime template.

2. Create a runtime template. For instructions, see Create a runtime template. To turn off internet access, in the Networking and security section, clear Enable public internet access.

Block Legacy Authorization on GKE Clusters

Disable Legacy Authorization to use role-based access control (RBAC). RBAC helps improve security by defining specific permissions at the cluster and namespace levels.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	LEGACY_AUTHORIZATION_ENABLED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Kubernetes Engine > Clusters page in the Google Cloud console. Select the cluster, click Edit and select Disabled from the Legacy Authorization dropdown list.

Block Overly Permissive Firewall Rules

Firewall rules that permit connections from all IP addresses, like 0.0.0.0/0, or from all ports expose resources to attacks from unintended sources. This control creates a violation for ingress firewall rules with "allow" actions if one of the following items are true: First, the source ranges includes 0.0.0.0/0 and allowed protocols don't specify ICMP and TCP protocols with port 443. Second, the allowed rule permits all protocols or permits TCP or UDP protocols without port restrictions.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	OPEN_FIREWALL
Revision number	3
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to update access from the source IP range 0.0.0.0/0 and add specific protocols and port ranges. For more information, see Use VPC firewall rules.

Block Project-Wide SSH Keys on Compute Engine Instances

Project-wide SSH keys provide access to all VM instances within the project, which might lead to unauthorized access. This control reads the metadata from Compute Engine. It checks the metadata.items object for the key-value pair 'block-project-ssh-keys' set to 'TRUE', or for the presence of the 'sshKeys' key. This control doesn't apply to GKE instances, Dataflow jobs, or Windows instances.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	COMPUTE_PROJECT_WIDE_SSH_KEYS_ALLOWED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Block SSH keys on the VM instance. Go to the Compute Engine > VM instances page in the Google Cloud console. Click the instance name in the finding. On the VM instance details page, click Edit. Under SSH Keys, select Block project-wide SSH keys. Note that you can't edit instances that are created using instance templates. To make changes to an instance template's configuration, see How to update instance templates.

Block Public IP Address for Agent Platform Workbench Instances

Don't permit external IP addresses for Gemini Enterprise Agent Platform Workbench Instances to reduce exposure to the internet and minimize the risk of unauthorized access.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	VERTEX_AI_WORKBENCH_PUBLIC_IP_ENABLED
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

You can't change this setting after the Agent Platform Workbench Instance is created. Delete the existing instance and create instances with the appropriate IP configuration.

1. Delete the instance. For instructions to shut down the instance before deleting it, see Shut down an Agent Platform Workbench instance.

2. In the Google Cloud console, go to the Instances page.

3. Create a new instance. In the Networking section, clear Assign external IP address.

4. Consider setting the Define allowed external IPs for VM instances (constraints/compute.vmExternalIpAccess) organization policy constraint at the organization level to prevent VM instances from using external IP addresses. For more information, see Restrict external IP addresses to specific instances.

Block Public IP Addresses for AlloyDB Cluster Instances

AlloyDB for PostgreSQL database instances with private IP addresses help to reduce your organization's attack surface and improve network security.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ALLOYDB_PUBLIC_IP
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Go to the AlloyDB > Clusters in the Google Cloud console. Click the cluster from the Resource Name column, and edit the instance. Go to Connectivity, and clear Enable Public IP.

Block Public IP Addresses for Cloud SQL Instances

Don't assign public IP addresses to Cloud SQL database instances.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	SQL_PUBLIC_IP
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Go to the SQL > Instances page in the Google Cloud console. Click Connections > Networking, and clear the Public IP checkbox for the instance. Use a private IP address instead. For more information, see Configuring private IP for an existing instance.

Block Root Access on Agent Platform Workbench Instances

Don't permit root access on Gemini Enterprise Agent Platform Workbench Instances to help prevent unauthorized modification of critical system files or installation of malicious software.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	VERTEX_AI_WORKBENCH_ROOT_ACCESS_ENABLED
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	2.1
Supported target resources	Organization Folder Project

Remediation steps

Turn off root access on the Agent Platform Workbench Instance.

1. In the Google Cloud console, go to the Instances page.

2. Click the instance that you want to configure.

3. In the Software and security tab, clear the Root access to the instance setting.

4. Click Submit.

Block Root Access on Agent Platform Workbench Instances

Use the "Disable root access on new Vertex AI Workbench user-managed notebooks and instances" ainotebooks.disableRootAccess organization policy constraint to help prevent newly created Gemini Enterprise Agent Platform Workbench user-managed notebooks and instances from enabling root access.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ORG_POLICY_ROOT_ACCESS_ON_VERTEXAI_ENABLED
Revision number	1.2
Supported target resources	Organization Folder Project

Remediation steps

Set the Disable root access on new Vertex AI Workbench user-managed notebooks and instances (ainotebooks.disableRootAccess) organization policy constraint to true to block root access on new Agent Platform Workbench user-managed notebooks and instances. For more information, see Updating policies with boolean rules.

Block Serial Ports for Compute Engine Instances

Serial console support on an instance poses a security risk as clients might connect from any IP address. Disabling serial ports helps protect from such exposures.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	COMPUTE_SERIAL_PORTS_ENABLED
Revision number	3
Supported target resources	Organization Folder Project

Remediation steps

Block serial ports. Go to the Compute Engine > VM instances page in the Google Cloud console. Click the VM instance name listed in the finding. On the VM instance details page, click Edit. Under Remote access, turn off Enable connecting to serial ports.

Block Service Account Key Creation

Use the "Disable service account key creation" (iam.disableServiceAccountKeyCreation) organization policy constraint to prevent the creation of service account external keys and Cloud Storage HMAC keys.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ORG_POLICY_SERVICE_ACCOUNT_KEY_CREATION_ENABLED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To enforce the organization policy, see Disable service account key creation.

Block Service Account Key Uploads

Use the "Disable Service Account Key Upload" (iam.disableServiceAccountKeyUpload) organization policy constraint to prevent the upload of public keys to service accounts.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ORG_POLICY_SERVICE_ACCOUNT_KEY_UPLOAD_ENABLED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To enforce the organization policy, see Disable service account key upload.

Block Terminal Access on Agent Platform Workbench Instances

Use the "Disable terminal on new Vertex AI Workbench instances" (ainotebooks.disableTerminal) organization policy constraint to help prevent the creation of Gemini Enterprise Agent Platform Workbench instances with the terminal enabled.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	TERMINAL_ACCESS_ON_VERTEXAI_ENABLED
Revision number	1.2
Supported target resources	Organization Folder Project

Remediation steps

Set the Disable terminal on new Vertex AI Workbench instances (ainotebooks.disableTerminal) organization policy constraint to true to block the terminal on new Agent Platform Workbench instances. For more information, see Updating policies with boolean rules.

Centrally Track Remediation of Vulnerabilities

Ensures a centralized system is in place for tracking the remediation of identified security vulnerabilities.

Enforcement mode	Audit
Severity	HIGH
Finding category	MISSING_CENTRALIZED_REMEDIATION_OF_VULNERABILITIES
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Implement a centralized system to track, prioritize, and manage the mitigation and remediation of identified vulnerabilities. This can be achieved by establishing a well-defined internal process that leverages Security Command Center for identification, prioritization, and verification. For more information about workflows, see the Security Command Center documentation.

Changes impacting CSC

Include provisions limiting changes directly impacting CSCs owned environments/tenants to explicitly authorized requests within service level agreements between CSPs and CSCs.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	MAINTENANCE_POLICY_NOT_CONFIGURED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Identify the resource type from the finding details. Go to the resource in Google Cloud Console and configure a maintenance policy or maintenance window. For guidance, refer to the maintenance documentation for Redis (https://cloud.google.com/memorystore/docs/redis/about-maintenance), Memcache (https://cloud.google.com/memorystore/docs/memcached/about-maintenance), GKE (https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions), Cloud SQL (https://cloud.google.com/sql/docs/mysql/set-maintenance-window), or Cloud Composer (https://cloud.google.com/composer/docs/composer-2/specify-maintenance-windows).

Cloud Databases Context Store Regulatory Settings

Enforces that the Cloud Databases Context Store Regulatory Settings are configured correctly.

Enforcement mode	Preventive
Severity	HIGH
Finding category	CLOUD_DATABASES_CONTEXT_STORE_ENABLED
Category name in the API	CC_CATEGORY_SERVICE_SPECIFIC
Revision number	1
Supported target resources	Folder Project

Rules

CSS name: Cloud Databases Context Store Regulatory Settings

CMEK Dedicated Project Restricted

Checking whether the Organization Policy constraints/gcp.restrictCmekCryptoKeyProjects is set.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	CMEK_PROJECT_NOT_RESTRICTED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To restrict which projects can be used for CMEK crypto keys, configure the constraints/gcp.restrictCmekCryptoKeyProjects organization policy and add the project, folder, or organization IDs that are approved to host CMEK crypto keys to the allowedValues list of the policy. See https://cloud.google.com/kms/docs/cmek-org-policy for details.

CMEK Keys Imported and Stored In HSM

Verify whether the CMEKs have been imported to GCP, noting that the exact origin of these keys cannot be technically checked; also, confirm if the CMEKs are kept in an HSM within Google Cloud

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	CMEK_KEY_NOT_IMPORTED_OR_NOT_HSM
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Ensure that CMEK keys are imported into Cloud KMS (https://cloud.google.com/kms/docs/key-import) and are stored in a Hardware Security Module (HSM) by setting the protection level to 'HSM' (https://cloud.google.com/kms/docs/protection-levels).

CMEK Usage

Many Google Cloud services protect various types of data with Customer-Managed Encryption Keys (CMEKs) or offer encryption at rest, including: Vertex AI services such as Datasets, Models, Endpoints, CustomJobs, HyperparameterTuningJobs, TrainingPipelines, BatchPredictionJobs, ModelDeploymentMonitoringJobs, PipelineJobs, MetadataStore, TensorBoard, Featurestore, Index, IndexEndpoint, NotebookRuntimes, and NotebookExecutionJobs; Artifact Registry data in repositories; BigQuery data at rest; Bigtable data at rest and backups; Cloud Composer environment data; GCE instances, persistent regional disks, persistent disks, snapshots, custom images, and machine images; Google Kubernetes Engine data on VM disks and data in GKE backups; Dataflow pipeline state data; Dataproc Metastore data at rest; Document AI data at rest and in use; Cloud Logging data in the Log Router and Logging storage; Pub/Sub data associated with topics; Cloud Run functions (1st and 2nd gen, and 1st gen specifically); Secret Manager secrets and secret versions; Spanner data at rest and backups; Cloud SQL data written to databases, backups, and BackupRun configurations; data in storage buckets; AlloyDB clusters and backups; Apigee Instances, Organization Runtime, Organization Consumer Data, and Organization Control Plane; Cloud Data Fusion environment data; Dataform repositories; Datastream data in transit; Filestore data at rest and backups; Memorystore for Redis data at rest in Clusters; Speech-to-Text Config Data and Recogniser Data at rest; Workflows data at rest; Google Cloud NetApp Storage Pools and Volumes; and Cloud Workstations data on VM disks.

Enforcement mode	Detective Audit
Severity	HIGH
Finding category	CMEK_NOT_USED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

The resource is not encrypted with a Customer-Managed Encryption Key (CMEK). Configure CMEK encryption for the resource to meet compliance requirements. See https://cloud.google.com/kms/docs/cmek for more details on CMEK.

Conduct Role-specific Training

Ensure role-specific training is provided for high-risk roles.

Enforcement mode	Audit
Severity	LOW
Finding category	MISSING_ROLE_SPECIFIC_TRAINING
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Mandate role-specific training for high-risk roles, in particular for roles with privileged access. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Conduct Security Awareness Training

Ensure employees receive security awareness training.

Enforcement mode	Audit
Severity	LOW
Finding category	MISSING_SECURITY_AWARENESS_TRAINING
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Continuously educate your employees on cybersecurity measures, testing them regularly to ensure their knowledge is satisfactory.

Configure a Wireless Intrusion Detection Mechanism

Employ a wireless intrusion detection system to identify rogue wireless devices and detect attack attempts and potential system breaches.

Enforcement mode	Audit
Finding category	WIRELESS_INTRUSION_DETECTION_MECHANISM_NOT_CONFIGURED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

This control doesn't apply to Google Cloud as Google doesn't use or permit wireless networks in our production environment. Additionally, access to Google's data centers is highly restricted and all unused ports are disabled on switches. During the inspection process for unauthorized wireless devices, the Google Security Team walks through data centers to ensure connected devices are authorized and meet Google configuration management requirements. Verify that you have set up appropriate wireless intrusion detection systems in your environment, if applicable.

Configure Access Controls for the Network Boundary

Control external communication over the network using firewall rules.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	MISSING_ACCESS_CONTROLS_NETWORK_BOUNDARY
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

• Verify these ports are blocked:

Cassandra: TCP 7000, 7001, 7199, 8888, 9042, 9160, 61620, 61621

CiscoSecure/WebSM: TCP 9090

Directory Services: TCP 445; UDP 445

DNS services: TCP 53; UDP 53

Elasticsearch: TCP 9200, 9300

FTP: TCP 21

HTTP: TCP 80

LDAP: TCP 389, 636; UDP 389

Memcached: TCP 11211, 11214, 11215; UDP 11211, 11214, 11215

MongoDB: TCP 27017-27019

MySQL: TCP 3306

NetBIOS13: TCP 137-139; UDP 137-139

OracleDB: TCP 1521, 2483, 2484; UDP 2483, 2484

POP3: TCP 110

PostgreSQL: TCP 5432

RDP: TCP 3389; UDP 3389

Redis: TCP 6379

SMTP: TCP 25

SSH: TCP 22; SCTP 22

Telnet: TCP 23

• Verify SSL.

• Verify NAT to instances without public IPs.

• Configure logging and VPC Flow Logs.

• Verify GKE network policy and Dataplane V2.

• Verify VMs don’t have public IPs. For stopped instances, ensure network doesn’t permit external access.

• Verify Compute Engine default service account isn’t used.

Configure Dataplex to Support Data Boundaries

Configure Dataplex to support data boundaries that help you meet your regulatory requirements.

Enforcement mode	Preventive
Severity	HIGH
Finding category	DATAPLEX_REGULATORY_SETTINGS_NON_COMPLIANT
Category name in the API	CC_CATEGORY_SERVICE_SPECIFIC
Revision number	3
Supported target resources	Folder Project

Rules

CSS name: Dataplex Compliance Settings

Parameters

framework

STRING Required. Ensures additional compliance setting for the underlying services are correctly configured to meet the compliance level of the selected framework.

Configure Dataproc to Support Data Boundaries

Configure Dataproc to support data boundaries that help you meet your regulatory requirements.

Enforcement mode	Preventive
Severity	HIGH
Finding category	DATAPROC_REGULATORY_SETTINGS_NON_COMPLIANT
Category name in the API	CC_CATEGORY_SERVICE_SPECIFIC
Revision number	1.1
Supported target resources	Folder Project

Rules

CSS name: Dataproc Compliance Settings

Configure DLP API for Gemini on Agent Platform

Configure Data Loss Prevention (DLP) filters when using Gemini on Gemini Enterprise Agent Platform. DLP helps address sensitive data leakage, in case the Gemini on Agent Platform model has access to sensitive data. DLP also lets you create custom block lists.

Enforcement mode	Audit
Severity	MEDIUM
Finding category	DLP_DATA_FILTERS_NOT_CONFIGURED_IN_VERTEX_AI
Revision number	2.1
Supported target resources	Organization Folder Project

Remediation steps

For more information about using DLP for generative AI models like Gemini on Agent Platform, see Safety in Agent Platform.

Configure Google Agent Platform to Support Data Boundaries

Configure Google Agent Platform to support data boundaries that help you meet your regulatory requirements.

Enforcement mode	Preventive
Severity	HIGH
Finding category	AGENT_PLATFORM_REGULATORY_SETTINGS_NON_COMPLIANT
Category name in the API	CC_CATEGORY_SERVICE_SPECIFIC
Revision number	1.1
Supported target resources	Folder Project

Rules

CSS name: Vertex AI Compliance Settings

Configure Google Cloud Serverless for Apache Spark to Support Data Boundaries

Configure Google Cloud Serverless for Apache Spark to support data boundaries that help you meet your regulatory requirements.

Enforcement mode	Preventive
Severity	HIGH
Finding category	SERVERLESS_REGULATORY_SETTINGS_NON_COMPLIANT
Category name in the API	CC_CATEGORY_SERVICE_SPECIFIC
Revision number	1.1
Supported target resources	Folder Project

Rules

CSS name: Serverless Compliance Settings

Configure Log Metrics and Alerts for Audit Logging Changes

Configure log metrics and alerts to monitor changes to IAM allow policies. Log metrics and alerts configured to monitor IAM allow policy changes helps to identify over-privileged users or suspicious activity.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	AUDIT_CONFIG_NOT_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to Logs-based Metrics within the Logging page in the Google Cloud console. Click Create metric. In the User-defined metrics section, click inside the Filter box, select Filter, and paste the following text, replacing the existing text: resource.type=global AND protoPayload.methodName=SetIamPolicy AND protoPayload.serviceData.policyDelta.auditConfigDeltas:* Click Create metric and set the alert policy.

Configure Log Metrics and Alerts for Cloud SQL Configuration Changes

Configure log metrics and alerts to monitor configuration changes for Cloud SQL instances. Monitoring changes helps detect misconfigurations.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	SQL_INSTANCE_NOT_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to Logs-based Metrics within the Logging page in the Google Cloud console. Click Create metric. In the User-defined metrics section, click inside the Filter box, select Filter, and paste the following text, replacing the existing text: protoPayload.methodName=cloudsql.instances.update Click Create metric and set the alert policy.

Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes

Log metrics and alerts configured to monitor Cloud Storage IAM permission changes helps to identify over-privileged users or suspicious activity.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	BUCKET_IAM_NOT_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to the Log-based Metrics page within Logging in the Google Cloud console. Click Create metric in the User-defined metrics section. In the User-defined metrics section, click inside the Filter box, select Filter, and paste the following text, replacing the existing text: resource.type=gcs_bucket AND protoPayload.methodName=storage.setIamPermissions After you create the metric, go to the Actions menu and click Create alert from metric to set alert policies. For more information, see Log-based metrics overview.

Configure Log Metrics and Alerts for Custom Role Changes

Configure log metrics and alerts to monitor custom role changes. Monitoring role creation, deletion, and update activities helps to identify over-privileged roles at early stages.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	CUSTOM_ROLE_NOT_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to Logs-based Metrics within the Logging page in the Google Cloud console. Click Create metric. In the User-defined metrics section, click inside the Filter box, select Filter, and paste the following text, replacing the existing text: resource.type=iam_role AND protoPayload.methodName=google.iam.admin.v1.CreateRole OR protoPayload.methodName=google.iam.admin.v1.DeleteRole OR protoPayload.methodName=google.iam.admin.v1.UpdateRole Click Create metric and set the alert policy.

Configure Log Metrics and Alerts for VPC Network Changes

Configure log metrics and alerts to monitor VPC network changes. Monitoring network changes helps detect incorrect or unauthorized changes to your network setup.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	NETWORK_NOT_MONITORED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Logs-based Metrics page within Logging in the Google Cloud console. Click Create metric. In the Metric type field, select Counter. In the Details section, set Units to 1. In the Builder filter box, copy and paste the following text, replacing the existing text: resource.type=\"gce_network\" AND (protoPayload.methodName:\"compute.networks.insert\" OR protoPayload.methodName:\"compute.networks.patch\" OR protoPayload.methodName:\"compute.networks.delete\" OR protoPayload.methodName:\"compute.networks.removePeering\" OR protoPayload.methodName:\"compute.networks.addPeering\")
Click Create metric and set the alert policy.

Configure Log Metrics and Alerts for VPC Network Firewall Changes

Configure log metrics and alerts to monitor VPC network firewall rule changes. Monitoring VPC network firewall rule changes helps detect suspicious activity and helps to provide better insight into network access changes.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	FIREWALL_NOT_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to Logs-based Metrics within the Logging page in the Google Cloud console. Click Create metric. In the Metric type field, select Counter. In the Details section, set Units to 1. In the Builder filter box, copy and paste the following text, replacing the existing text: resource.type=\"gce_firewall_rule\" AND (protoPayload.methodName:\"compute.firewalls.insert\" OR protoPayload.methodName:\"compute.firewalls.patch\" OR protoPayload.methodName:\"compute.firewalls.delete\") Click Create metric and set the alert policy.

Configure Log Metrics and Alerts for VPC Route Changes

Configure log metrics and alerts to monitor VPC network route changes. Monitoring VPC route changes is important for smooth VPC traffic flow.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	ROUTE_NOT_MONITORED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to Logs-based Metrics within the Logging page in the Google Cloud console. Click Create metric. In the User-defined metrics section, click inside the Filter box, select Filter, and paste the following text, replacing the existing text: resource.type="gce_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert") Click Create metric and set the alert policy.

Configure Log Sinks

Configure log sinks and export the log entries to extend storage periods.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	LOG_NOT_EXPORTED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

See Overview of log exports and Create a log sink.

Configure Model Armor to Detect PII on Model Outputs

Model Armor filters both input (prompts) and output (responses) to help prevent from exposure to or generation of malicious or sensitive content.

Enforcement mode	Audit
Severity	MEDIUM
Finding category	MODEL_ARMOR_PII_IN_OUTPUTS_DETECTION_DISABLED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Configure Model Armor to help detect personal data in output types such as audio and video. For more information, see Model Armor overview.

Configure Model Armor with Harmful Data Filters

Enable Model Armor to filter harmful data in prompts such as obscenity, extremism, or violence. Model Armor offers filters for content safety, addressing content that is sexually explicit or dangerous or that contains harassment or hate speech content.

Enforcement mode	Audit
Severity	MEDIUM
Finding category	MODEL_ARMOR_HARMFUL_DATA_FILTERS_DISABLED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

For more information, see Model Armor overview.

Configure Model Armor with Sensitive Data Filters

Enable Model Armor to filter personally identifiable information (PII) or sensitive data in AI applications. To prevent unauthorized exposure in an LLM, Model Armor can discover, classify, and protect sensitive data.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	MODEL_ARMOR_SENSITIVE_DATA_FILTERS_DISABLED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

For more information, see Model Armor overview.

Configure Network Devices to Fail in a Secure State

Configure all your managed boundary protection devices and systems to fail in a secure state.

Enforcement mode	Audit
Finding category	NETWORK_DEVICES_NOT_CONFIGURED_SECURE_FAILURE
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Configure all boundary protection devices such as VPC Service Controls, VPCs, firewalls, load balancers, proxy servers, and other security mechanisms that control traffic to and from your cloud resources to fail in a secure state.

Configure Network Traffic Monitoring

To best monitor network traffic, use separate subnetworks with managed interfaces to physically separate security tools, mechanisms, and support components from other internal system components.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	SECURITY_TOOLS_MECHANISMA_NOT_SEPARATED_PHYSICALLY
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Review firewall rules and allowed and denied ports.

• Verify SSL certificates.

• Verify NAT configurations are set to provide outbound connectivity to instances without public IPs.

• Verify logging.

• Verify VPC Flow Logs.

Configure Remote Access Inactivity Timeout

Set the inactivity timeout for remote access sessions to 15 minutes or less. You can use the HTTP Keep Alive Timeout configuration to disconnect or disable remote access to your system.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	REMOTE_ACCESS_INACTIVITY_TIMEOUT_NOT_CONFIGURED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Set the httpKeepAliveTimeoutSec for Compute Engine instance's target HTTP proxies to less than or equal to 900 seconds. For more information, see Target proxies overview.

Configure Security Logging Policies for Google Cloud Services

Define and deploy a security logging policy.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	UNDEFINED_AUDIT_LOGGING_POLICY
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Enable audit logging.

• Create a security alerting policy file in YAML or JSON format. For example: logging: auditLog: LOGS_BUCKET_NAME retentionPeriod: 30d

• Apply the policy using Deployment Manager. For example: gcloud deployment-manager deployments create POLICY_DEPLOYMENT_NAME --config=POLICY_FILE.yaml

• Configure Cloud Storage bucket logging and retention policies.

• Automate policy checks and enforcement using organization policy constraints.

Configure Spanner to Support Data Boundaries

Configure Spanner to support data boundaries that help you meet your regulatory requirements

Enforcement mode	Preventive
Severity	HIGH
Finding category	CLOUD_SPANNER_REGULATORY_SETTINGS_NON_COMPLIANT
Category name in the API	CC_CATEGORY_SERVICE_SPECIFIC
Revision number	1.1
Supported target resources	Folder Project

Rules

CSS name: Cloud Spanner AW Control

Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint

Configure the permitted ingress settings for Cloud Run using the "Allowed Ingress Settings (Cloud Run)" (constraints/run.allowedIngress) organization policy. When this constraint is enforced, services are required to have ingress settings that match one of the allowed values.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ALLOWED_INGRESS_ORG_POLICY
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Configure the the Allowed Ingress Settings (Cloud Run) constraint to ensure that Cloud Run services comply with the allowed ingress settings. For more information, see Constraints for specific services.

Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint

Configure the permitted VPC egress settings for Cloud Run using the "Allowed VPC Egress Settings (Cloud Run)" (constraints/run.allowedVPCEgress) organization policy constraint. When this constraint is enforced, services are required to have VPC egress settings that match one of the allowed values.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ALLOWED_VPC_EGRESS_ORG_POLICY
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Configure the Allowed VPC Egress Settings (Cloud Run) constraint to ensure that Cloud Run services comply with the allowed VPC egress settings. For more information, see Constraints for specific services.

Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy

Configure the Disable VM serial port logging to Stackdriver (constraints/compute.disableSerialPortLogging) organization policy to block serial port logging to Cloud Logging from Compute Engine VMs.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	DISABLED_SERIAL_PORT_ACCESS_ORG_POLICY
Revision number	3
Supported target resources	Organization Folder Project

Remediation steps

Set the Disable VM serial port logging to Stackdriver organization policy to True and ensure that serial port logging to Cloud Logging from Compute Engine VMs is blocked. For more information, see Constraints for specific services.

Configure the Disable VPC External IPv6 Usage Organization Policy

Configure the Disable VPC External IPv6 usage (constraints/compute.disableVpcExternalIpv6) organization policy to block VPC subnetworks from using external IPv6 addresses.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	DISABLE_VPC_EXTERNAL_IP_V6_ORG_POLICY
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Set the Disable VPC External IPv6 Usage organization policy to True and ensure that all VPC subnetworks don't use external IPv6 addresses. For more information, see Constraints for specific services.

Configure the Disable VPC Internal IPv6 Usage Organization Policy

Configure the Disable VPC Internal IPv6 usage (constraints/compute.disableVpcInternalIpv6) organization policy to block VPC subnetworks from using internal IPv6 addresses. A subnetwork with an internal IPv6 address might be exposed to potential risks due to its current limited support.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	COMPUTE_INTERNAL_IP_V6_ORG_POLICY_ENABLED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Set the Disable VPC Internal IPv6 Usage organization policy to True and ensure that all VPC subnetworks don't use internal IPv6 addresses. For more information, see Constraints for specific services.

Configure VPC Firewall Rules, Subnets, and VPN Gateway

Manage the flow of data by verifying VPC firewall rules, subnet configurations, and VPN gateway configuration.

Enforcement mode	Audit
Finding category	VPC_FIREWALL_SUBNET_VPNGATEWAY_NOT_SETUP
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

• Create isolated networks using VPC.

• Define granular IPv4 subnet ranges and IPv6 subnet ranges.

• Define routes and firewall rules.

• Configure a VPN gateway to your on-premises network.

• Configure a global load balancer for your Google-managed services.

• Configure Cloud NAT to connect to your API backend servers and clients.

• Tune Cloud NAT and the backend services for the load balancer to control the flow of traffic between your backend services and your users.

• Configure VPC Network Peering or another inter-VPC communication method to enable communication between VPC networks and your projects.

Confirm FedRAMP Authorization of Services

Services must be FedRAMP authorized and securely configured.

Enforcement mode	Audit
Severity	MEDIUM
Finding category	NON_FEDRAMP_AUTHORIZED_SERVICE
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Conduct regular evaluations to confirm that services which handle or impact federal information are FedRAMP authorized and securely configured.

Control Integrations with External Systems

Establish policies to integrate applications on your system with external products and services.

Enforcement mode	Audit
Finding category	INTEGRATIONS_EXTERNAL_SYSTEMS_NOT_CONTROLLED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

You must configure your applications to meet your compliance obligations.

Control Remote Device Connections

Prevent remote devices from simultaneously establishing non-remote connections with your system and accessing external networks through other connections.

Enforcement mode	Audit
Finding category	REMOTE_DEVICE_CONNECTION_CONTROL_MISSING
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Use firewall and border router ACLs to implement managed network interfaces and control inbound and outbound traffic. For more information, see VPC firewall rules.

Correlate Audit Records

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

Enforcement mode	Audit
Finding category	UNCORRELATED_AUDIT_LOG_RECORDS
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Correlate logs and review them in Log Explorer.

• Create log-based metrics to capture trends and patterns.

• Configure labels on log-based metrics to add additional information to the entries.

Create Alerts for Monitoring Security Command Center Errors

Alerts about Security Command Center provide visibility into your organization and notify you about issues with Security Command Center so you can take appropriate action.

Enforcement mode	Audit
Finding category	SCC_MONITORING_ALERTS_NOT_SET
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Create an alerting policy in Cloud Logging to alert on errors related to the Security Command Center service agent. For instructions, see Configure alerts through Cloud Logging.

Create and Manage Asymmetric Keys

Manage asymmetric keys using NSA-approved key management, either through Public Key Infrastructure (PKI) or pre-positioned keying material protected by hardware security tokens.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	NONCOMPLIANT_ASYMMETRIC_KEY_MANAGEMENT
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Consider the Certificate Authority Service for hardware-protected private keys which are FIPS 140-2 Level 3 validated.

Create Artifact Registry Cleanup Policies

Artifact Registry cleanup policies define criteria for automatically deleting artifact versions that you no longer need or keeping artifacts that you want to store indefinitely.

Enforcement mode	Audit
Finding category	ARTIFACT_REGISTRY_CLEANUP_POLICY_MISSING
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Define clear policies to maintain specific versions of policies and implement a cleanup policy to clear other artifacts. For more information, see Configure cleanup policies and Enabling service.

Create CMEK Project and Key Ring

Create a new key management project and key ring to store customer managed encryption keys (CMEKs). If the target deployment resource is a project, the target deployment project is used as the key management project and only a new key ring is created.

Enforcement mode	Preventive
Severity	HIGH
Category name in the API	CC_CATEGORY_ENCRYPTION
Revision number	2
Supported target resources	Folder Project

Parameters

cmek_project_key_ring_id	STRING Required. The ID of the Cloud KMS key ring to create in the CMEK project. The key ring is created in the location that you selected when you deployed the framework.
cmek_project_name	STRING Optional. Name of the key management project to create. When the target deployment resource is a project, this field must be left empty because the target project is automatically used for key management. In this scenario, specifying a project name results in an error. Specify a project name when the target deployment resource is not a project.
cmek_project_id	STRING Optional. ID of the project to create that will contain encryption keys. Avoid using PII identifiers or other customer data as this information is visible within the logs. When the target deployment resource is a project, leave this this field empty because the target project is automatically used for key management. In this scenario, specifying a project ID results in an error. When the target deployment resource is not a project and you don't specify a project ID, a project ID is generated automatically.
cmek_project_billing_account	STRING Optional. The billing account to link to the new CMEK project. Any charges incurred for this project are billed to this account. When the target deployment resource is a project, leave this field empty because the target project is automatically used for key management. In this scenario, specifying a billing account results in an error. Specify a billing account when the target deployment resource is not a project.

Create GKE Clusters with Limited Privileges

Avoid broad access scopes for a Google Kubernetes Engine (GKE) node service account. This control checks node pools to determine whether they're using custom service accounts or, if the default service account is used, that all the OAuth scopes are part of the allowed list, which consists of https://www.googleapis.com/auth/devstorage.read_only, https://www.googleapis.com/auth/logging.write, and https://www.googleapis.com/auth/monitoring.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	OVER_PRIVILEGED_SCOPES
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Use custom service accounts or limit the OAuth access scope for GKE nodes. For more information, see Use a least privileged service account and Access scopes in GKE.

Create Inventory of Security Data Assets

Ensure security-relevant information (sensitive data, APIs, services, databases, and infrastructure components) are clearly documented and classified.

Enforcement mode	Audit
Finding category	DATA_CLASSIFICATION_MISSING
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Find and classify security-relevant data in Google Cloud, such as sensitive data and configuration data.

• Create an inventory of the resources that aren’t publicly available. For example, APIs, services, databases, and infrastructure components.

Create Super Admin Login Alerts

Create alerts to receive notifications when a super administrator logs into their account.

Enforcement mode	Audit
Finding category	SUPERADMIN_LOGIN_ALERT_NOT_FOUND
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Create alerts when a super administrator logs into their account. For instructions, see Configure log-based alerting policies.

Define a Security Policy to Mitigate for DDoS Events

Create a security policy using Google Cloud Web Armor to mitigate DDoS risks to your applications.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	MISSING_SECURITY_POLICY_DDOS_EVENTS
Revision number	3
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

• Configure a security policy for backend services.

• Enable advanced network DDoS protection.

• Verify the load balancing scheme.

• Review firewall rules and allowed and denied ports.

*Verify the autoscaling policy for autoscalers.

Define Agent Platform Workbench Instance Access Mode

Use the "Define access mode for Vertex AI Workbench notebooks and instances" (ainotebooks.accessMode) organization policy constraint to define the modes of access that are allowed for Agent Gemini Enterprise Platform Workbench Instances.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	ORG_POLICY_VERTEXAI_ACCESSMODE_NOT_DEFINED
Revision number	2.1
Supported target resources	Organization Folder Project

Remediation steps

Define an allow or deny list using the Define access mode for Vertex AI Workbench notebooks and instances (ainotebooks.accessMode) constraint. The allow or deny list can specify multiple users with the service-account mode or single-user access with the single-user mode. For more information, see Updating policies with list rules.

Define Allowed Services for Service Perimeter

Define which services are available within the service perimeter to limit the set of services that are accessible from network endpoints inside your service perimeter.

Enforcement mode	Audit
Finding category	SERVICE_PERIMETER_ALLOWED_SERVICES_NOT_SET
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Add a list of services to your service perimeter. For more information, see Add a service to the VPC accessible services.

Define an Acquisition Contract

Define an acquisition contract for information systems, system components, or information system services.

Enforcement mode	Audit
Finding category	UNDEFINED_ACQUISITION_CONTRACT
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Meet all the requirements and criteria that apply to your regulatory frameworks when creating an acquisition contract. For example, outline comprehensive security and privacy requirements; and include functional needs, mechanism strength, necessary controls, and documentation. List needs for safeguarding documents, detailing system setups, and assigning security, privacy, and supply chain risk management duties. Specify acceptance criteria for the system in the contract.

Define Change Management Procedures

Document the change management procedures and ensure that they align with the regulatory guidelines.

Enforcement mode	Audit
Severity	LOW
Finding category	MISSING_CHANGE_MANAGEMENT_PROCEDURE
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Clearly define and outline the change management procedures for your applications and services.

Define Cloud Billing Budget Threshold

Budgets let you track your actual Google Cloud project costs against your planned costs. Set a budget amount and budget alert threshold rules that trigger email notifications.

Enforcement mode	Audit
Finding category	CLOUD_BILLING_BUDGET_THRESHOLD_NOT_SET
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Set alerts and thresholds on your cloud project bills. See Set budget threshold rules and actions.

Define Cloud KMS Crypto Keys Protection Level

Set the protection level for Cloud KMS keys to SOFTWARE, HSM, EXTERNAL, or EXTERNAL_VPC.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	CRYPTOKEY_PROTECTION_LEVEL_DENIED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To set the protection level, see Protection levels.

Define Cloud KMS Crypto Keys Purpose

Set the purpose of Cloud KMS keys to ENCRYPT_DECRYPT. The key's purpose defines its allowed cryptographic operations.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	CRYPTOKEY_PURPOSE_RESTRICTED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

For information on the key purpose, see Key purposes and algorithms and CryptoKeyPurpose.

Define Essential Contacts

Essential Contacts are individuals or groups designated to receive crucial Google Cloud notifications, ensuring personnel who are informed about critical events like security attacks, vulnerabilities, and data incidents.

Enforcement mode	Detective Audit
Severity	LOW
Finding category	ESSENTIAL_CONTACTS_NOT_CONFIGURED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Go to the IAM & Admin > Essential Contacts page in the Google Cloud console. Click +Add contact and enter all the details of the contact to designate essential contacts.

Define External Build Integrations for Cloud Build

Use the "Allowed Integrations (Cloud Build)" (cloudbuild.allowedIntegrations) organization policy constraint to define the external services (for example, GitHub) that can invoke build triggers for Cloud Build.

Enforcement mode	Audit
Finding category	EXTERNAL_BUILD_INTEGRATION_NOT_DEFINED
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

To configure allowed webhooks for Cloud Build integrations of the project, see Setting up organization policy for allowed integrations.

Define IsLive Attribute for Delete Action Lifestyle Rule on Bucket

A lifecycle rule defines actions based on object conditions. The isLive attribute is used with Object Versioning and applies to the live object version. Without versioning, all objects are live and match isLive:true.

Enforcement mode	Audit
Finding category	LIFESTYLE_CONDITION_MISSING_ON_LIFESTYLE_BUCKET_ACTION
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Set the isLive attribute to true for a lifecycle rule with a Delete action on Cloud Storage buckets. See isLive.

Define Locations for Cloud Logging Buckets

Define the regions where log buckets for Cloud Logging can be located. Restrict the location to regions that are supported by your regulatory framework

Enforcement mode	Preventive
Severity	HIGH
Finding category	CLOUD_LOGGING_STORAGE_LOCATION_NOT_RESTRICTED
Category name in the API	CC_CATEGORY_DATA_RESIDENCY
Revision number	2.1
Supported target resources	Folder Project

Parameters

cloudLoggingStorageLocations

STRINGLIST Required. A list of Google Cloud regions (e.g., 'us-central1', 'europe-west1') where Cloud Logging buckets are permitted to be created. Attempts to create buckets in any other region will be blocked by this control.

Define Locations for Technical Support Services

Define the regions where your Customer Care support cases are routed and where Google personnel can access your audit logs. To define these regions, you must set the regulatory framework that your service supports.

Enforcement mode	Preventive
Severity	HIGH
Finding category	ENABLE_RESTRICT_TECHNICAL_SUPPORT_SERVICES
Category name in the API	CC_CATEGORY_ADMIN_ACCESS
Revision number	3
Supported target resources	Folder Project

Rules

CSS name: Assurant Settings

Parameters

framework

STRING Required. Ensures additional compliance setting for the underlying services are correctly configured to meet the compliance level of the selected framework.

Define Mobile Code Policies and Controls

Establish and enforce policies for mobile code usage that align with your compliance obligations.

Enforcement mode	Audit
Finding category	UNDEFINED_MOBILE_CODE_POLICIES_CONTROLS
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Consider the following:

• Create a mobile code policy that defines what technologies are acceptable and unacceptable.

• Use IAM allow policies to control access to your mobile code resources.

• Use organization policy constraints to restrict resource deployments. For example, create a custom constraint that restricts the use of specific programming languages or libraries.

• Configure firewall rules that control communication. For example, restrict outbound traffic from mobile code to specific allowlisted destinations only.

Define Owner Labels for Cloud Storage Buckets

Verify the labels for the bucket owner and assign the right owner.

Enforcement mode	Audit
Finding category	BUCKET_LABEL_OWNER_NOT_SET
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Verify that the right owner is defined for the bucket and that the bucket has a label.

Define Recovery Time and Recovery Point Objectives

Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) to ensure minimal service disruption and data loss during incidents and contingencies.

Enforcement mode	Audit
Severity	HIGH
Finding category	MISSING_RTO_AND_RPO
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

To remediate this finding, establish and document the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for the affected application or system.\n1. Conduct a Business Impact Analysis (BIA) to identify critical systems and the business impact of an outage.\n2. Based on the BIA, define the maximum acceptable downtime (RTO) and data loss (RPO) for the application.\n3. Document these RTO and RPO values in your organization's business continuity or disaster recovery plan.

Define Retention Period for Cloud Storage Buckets

Set a bucket retention policy to ensure objects are deleted after 90 days.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	STORAGE_BUCKET_RETENTION_PERIOD_NOT_SET
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

For Cloud Storage buckets, set the retention period greater than or equal to 90 days or 7776000.0 seconds. For more information, see Retention periods.

Define Rotation Period for Cloud KMS Keys

Rotate the keys regularly to enhance security. Set the rotation period for Cloud KMS keys to 90 days.

Enforcement mode	Audit
Finding category	KMS_KEY_NOT_ROTATED
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

For instructions, see Configure automatic rotation.

Define Secret Manager Replication Policy

Configure an automated replication policy to ensure that you back up secrets without a restriction on location.

Enforcement mode	Audit
Finding category	SECRET_MANAGER_REPLICATION_POLICY_NOT_SET
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To set a replication policy, see Choose a replication policy.

Define Secret Manager Replication Policy

Configure an automated replication policy to ensure that you back up secrets without a restriction on location.

Enforcement mode	Audit Detective
Severity	HIGH
Finding category	SECRET_MANAGER_REPLICATION_POLICY_NOT_SET
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

To set a replication policy, see Choose a replication policy.

Define Secret Manager Rotation Schedule

Secret Manager lets you schedule periodic rotations of your secrets by sending notifications to Pub/Sub topics associated with your secrets, based on the rotation frequency and time that you specify.

Enforcement mode	Detective Audit
Severity	MEDIUM
Finding category	SECRET_MANAGER_ROTATION_SCHEDULE_NOT_SET
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

For Secret Manager secrets, configure a rotation schedule. For more information, see Create rotation schedules in Secret Manager.

Define Security Policies

Ensure that security policies are documented.

Enforcement mode	Audit
Severity	LOW
Finding category	MISSING_SECURITY_POLICIES
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Create a detailed document that defines the security objectives and policies of all information resources for applications and services.

Define Service Perimeters in VPC Service Controls

Configure service perimeters at the organization level to help protect Google Cloud services and mitigate the risk of data exfiltration.

Enforcement mode	Audit
Finding category	SERVICE_PERIMETER_NOT_DEFINED
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

You can't change the perimeter type after you create a service perimeter. Delete the existing perimeter, and create a new one with the perimeter type set to Regular. See Create a service perimeter.

Define Set Storage Class Lifestyle Action on Bucket

Use the SetStorageClass action to change the storage class of an object and update the object's modification time when the object meets all conditions specified in the lifecycle rule. This action helps you optimize your storage costs.

Enforcement mode	Detective Audit
Severity