CIS GCP Benchmark v1.2.0 Deprecated
Best for: The CIS Benchmarks are security guidelines that institutions across industries can use to assist in the configuration of their environments. Google Cloud lists the offering as Global, for all industries.
Controls by category 65 controls are
1.10 Ensure KMS encryption keys are rotated within a period of 90 days 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps 1.14 Ensure API keys are restricted to only APIs that application needs access 1.15 Ensure API keys are rotated every 90 days 1.4 Ensure that there are only GCP-managed service account keys for each service account 1.5 Ensure that Service Account has no Admin privileges 1.6 Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level 1.7 Ensure user-managed/external keys for service accounts are rotated every 90 days or less 1.9 Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible 2.10 Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes 2.11 Ensure that the log metric filter and alerts exist for SQL instance configuration changes 2.12 Ensure that Cloud DNS logging is enabled for all VPC networks 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes 2.6 Ensure that the log metric filter and alerts exist for Custom Role changes 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes 2.8 Ensure that the log metric filter and alerts exist for VPC network route changes 2.9 Ensure that the log metric filter and alerts exist for VPC network changes 3.1 Ensure that the default network does not exist in a project 3.10 Ensure Firewall Rules for instances behind Identity Aware Proxy (IAP) only allow the traffic from Google Cloud Loadbalancer (GCLB) Health Check and Proxy Addresses 3.2 Ensure legacy networks do not exist for a project 3.3 Ensure that DNSSEC is enabled for Cloud DNS 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites 4.11 Ensure that Compute instances have Confidential Computing enabled 4.3 Ensure 'Block Project-wide SSH keys' is enabled for VM instances 4.4 Ensure oslogin is enabled for a Project 4.5 Ensure 'Enable connecting to serial ports' is not enabled for VM Instance 4.6 Ensure that IP forwarding is not enabled on Instances 4.7 Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK) 4.8 Ensure Compute instances are launched with Shielded VM enabled 4.9 Ensure that Compute instances do not have public IP addresses 5.1 Ensure that Cloud Storage bucket is not anonymously or publicly accessible 6.1.2 Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on' 6.1.3 Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off' 6.2.1 Ensure that the 'log_checkpoints' database flag for Cloud SQL PostgreSQL instance is set to 'on' 6.2.10 Ensure 'log_planner_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off' 6.2.11 Ensure 'log_executor_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off' 6.2.12 Ensure 'log_statement_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off' 6.2.14 Ensure 'log_min_error_statement' database flag for Cloud SQL PostgreSQL instance is set to 'Error' or stricter 6.2.15 Ensure that the 'log_temp_files' database flag for Cloud SQL PostgreSQL instance is set to '0' 6.2.16 Ensure that the 'log_min_duration_statement' database flag for Cloud SQL PostgreSQL instance is set to '-1' (disabled) 6.2.3 Ensure that the 'log_connections' database flag for Cloud SQL PostgreSQL instance is set to 'on' 6.2.4 Ensure that the 'log_disconnections' database flag for Cloud SQL PostgreSQL instance is set to 'on' 6.2.5 Ensure 'log_duration' database flag for Cloud SQL PostgreSQL instance is set to 'on' 6.2.6 Ensure that the 'log_lock_waits' database flag for Cloud SQL PostgreSQL instance is set to 'on' 6.2.8 Ensure 'log_hostname' database flag for Cloud SQL PostgreSQL instance is set appropriately 6.2.9 Ensure 'log_parser_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off' 6.3.1 Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off' 6.3.2 Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off' 6.3.3 Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate 6.3.5 Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off' 6.3.6 Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off' 6.3.7 Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off' 7.2 Ensure that all BigQuery Tables are encrypted with Customer-managed encryption key (CMEK) 7.3 Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets Framework Control overlap Note CIS GCP Benchmark v1.3.0 High 86%CIS GCP Benchmark v2.0.0 High 83%CIS GCP Benchmark v3.0.0 High 83%
Frequently asked questions Who publishes the CIS Benchmarks? The Center for Internet Security (CIS), a nonprofit that promotes best practices for securing IT systems and data. It publishes a variety of materials including the CIS Benchmarks.
Which Google products have CIS Benchmarks? CIS Benchmarks are available for configuration of Google Cloud, Google Kubernetes Engine, and Google Workspace. They are accessed on the CIS website.
What is the geographic and industry scope of the CIS offering on Google Cloud? Google Cloud lists the Center for Internet Security (CIS) Benchmarks offering as Global and for All Industries.
