BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured
BigQuery datasets use Customer-Managed Encryption Keys (CMEK) rather than Google-managed encryption. The check identifies datasets configured to use a customer-managed key for data-at-rest protection.
Without CMEK, organizations lose cryptographic control of data at rest, weakening confidentiality and access governance. Lack of custom key rotation, revocation (kill switch), and location control hinders incident response and may conflict with data-sovereignty requirements.
What this control checks
Checks each BigQuery dataset for a default CMEK setting; datasets without one fail
Common pitfalls
Key location must align with dataset region
Align key location with dataset region.
Audit evidence
Evidence that deployed resources meet this control: Prowler check bigquery_dataset_cmk_encryption (prowler gcp --checks bigquery_dataset_cmk_encryption); PowerPipe control gcp_compliance.control.bigquery_dataset_encrypted_with_cmk.
Framework-specific interpretation
SOC 2: Mapped to C1.1 (The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality) and PI1.4 (System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's...).
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 6.1.2.b (requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or...) and 9.2.a (in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic...).
NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management) and SC-28 (Protection Of Information At Rest).
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- IA-5: Authenticator Management
- SC-28 Protection Of Information At Rest
- 7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets
- 7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- CRY-01.02AC The cloud provider's PQC strategy is aligned with cryptography policies and procedures and includes the following aspects: - Maintenance of an inventory of cryptographic mechanisms in use, including priority levels to each inventory item based on the impact and probabilities of the...
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
5 more clauses
- CRY-05.01B The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-08.06B If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 7.3 Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets
- 7.3 Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets
- 7.3 Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
NIST Cybersecurity Framework v1.0
- PR.DS-1: Data-at-rest is protected.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
bigquery_dataset_encrypted_with_cmk - Powerpipe Control:
gcp_compliance.control.bigquery_dataset_encrypted_with_cmk - Prowler Check:
bigquery_dataset_cmk_encryption
Last reviewed: 2026-10-09