CIS GCP Benchmark v4.0.0

ActiveCommon framework

Best for: The CIS Benchmarks cover Google Cloud, Google Kubernetes Engine, and Google Workspace.

Controls by category

81 controls are Mapped to CIS GCP Benchmark v4.0.0.

1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days

Control	Status
Customer-managed encryption keys should be rotated within 100 days	Mapped
Cloud KMS encryption keys should have rotation configured within 90 days	Mapped

Control	Status
KMS keys should have separation of duties enforced for KMS-related roles	Mapped

1.12 Ensure API Keys Only Exist for Active Services

Control	Status
Projects should not use API keys	Mapped

1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps

Control	Status
API keys should allow use only by specified hosts and apps	Mapped

1.14 Ensure API Keys Are Restricted to Only APIs That Application Needs Access

Control	Status
API keys should allow access only to APIs needed by the application	Mapped

1.15 Ensure API Keys Are Rotated Every 90 Days

Control	Status
API keys should have rotation configured every 90 days	Mapped

1.16 Ensure Essential Contacts is Configured for Organization

Control	Status
Organizations should have Essential Contacts configured	Mapped

1.4 Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account

Control	Status
Service accounts should use only GCP-managed service account keys	Mapped

1.5 Ensure That Service Account Has No Admin Privileges

Control	Status
Service accounts should not have Admin privileges	Mapped

1.6 Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level

Control	Status
IAM users should not have Service Account User or Service Account Token Creator roles at project level	Mapped

1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer

Control	Status
Service account keys should limit age to 100 days	Mapped
User-managed or external service account keys should have rotation configured every 90 days or less	Mapped

Control	Status
IAM users should not hold both service account admin and service account user roles	Mapped
KMS keys should have separation of duties enforced for KMS-related roles	Mapped

1.9 Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible

Control	Status
Cloud KMS cryptokeys should prohibit anonymous and public access	Mapped

2.1 Ensure That Cloud Audit Logging Is Configured Properly

Control	Status
Projects should have Cloud Audit Logs properly configured across all services and all users	Mapped

2.10 Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes

Control	Status
Projects should have log metric filters and alerts configured for Cloud Storage IAM permission changes	Mapped

2.11 Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes

Control	Status
Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes	Mapped

2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks

Control	Status
VPC networks should all have Cloud DNS logging enabled	Mapped

2.13 Ensure Cloud Asset Inventory Is Enabled

Control	Status
Projects should have Cloud Asset Inventory enabled	Mapped

2.15 Ensure 'Access Approval' is 'Enabled'

Control	Status
Projects should have 'Access Approval' set to 'Enabled'	Mapped

2.16 Ensure Logging is enabled for HTTP(S) Load Balancer

Control	Status
HTTP(S) load balancers should have logging enabled	Mapped

2.2 Ensure That Sinks Are Configured for All Log Entries

Control	Status
Log buckets should have retention policies configured using Bucket Lock	Mapped
Projects should have log sinks configured for all log entries	Mapped
Cloud Storage buckets used for exporting logs should have retention policies enabled	Mapped
Cloud Storage buckets used for exporting logs should use Bucket Lock	Mapped

2.3 Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock

Control	Status
Log buckets should have retention policies configured using Bucket Lock	Mapped
Cloud Storage buckets used for exporting logs should have retention policies enabled	Mapped
Cloud Storage buckets used for exporting logs should use Bucket Lock	Mapped

2.4 Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes

Control	Status
Projects should have log metric filters and alerts configured for project ownership assignments and changes	Mapped

2.5 Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes

Control	Status
Projects should have log metric filters and alerts configured for Audit Configuration changes	Mapped

2.6 Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes

Control	Status
Projects should have log metric filters and alerts configured for Custom Role changes	Mapped
Projects should have log metric filters and alerts configured for Custom Role changes, including undelete	Mapped

2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes

Control	Status
Projects should have log metric filters and alerts configured for VPC Network Firewall rule changes	Mapped

2.8 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes

Control	Status
Projects should have log metric filters and alerts configured for VPC network route changes	Mapped

2.9 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes

Control	Status
Projects should have log metric filters and alerts configured for VPC network changes	Mapped

3.1 Ensure That the Default Network Does Not Exist in a Project

Control	Status
Projects should prohibit default networks	Mapped

3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'

Control	Status
Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)	Mapped

3.2 Ensure Legacy Networks Do Not Exist for Older Projects

Control	Status
Projects should prohibit legacy networks	Mapped

3.3 Ensure That DNSSEC Is Enabled for Cloud DNS

Control	Status
Cloud DNS managed zones should have DNSSEC enabled	Mapped

3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC

Control	Status
Cloud DNS managed zones should not use RSASHA1 for zone-signing keys	Mapped

3.6 Ensure That SSH Access Is Restricted From the Internet

Control	Status
Firewall rules should prohibit unrestricted SSH access from the internet	Mapped

3.7 Ensure That RDP Access Is Restricted From the Internet

Control	Status
Firewall rules should prohibit unrestricted RDP access from the internet	Mapped

3.8 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network

Control	Status
VPC subnets should all have VPC Flow Logs enabled	Mapped

3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites

Control	Status
HTTPS or SSL proxy load balancers should prohibit SSL policies with weak cipher suites	Mapped

4.1 Ensure That Instances Are Not Configured To Use the Default Service Account

Control	Status
Compute Engine instances should not use the default service account	Mapped
Compute Engine instances should not use the default service account with full access to all Cloud APIs	Mapped

4.11 Ensure That Compute Instances Have Confidential Computing Enabled

Control	Status
Compute Engine instances should have Confidential Computing enabled	Mapped

4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs

Control	Status
Compute Engine instances should not use the default service account with full access to all Cloud APIs	Mapped

4.3 Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances

Control	Status
Compute Engine instances should have 'Block Project-wide SSH keys' enabled	Mapped

4.4 Ensure Oslogin Is Enabled for a Project

Control	Status
Compute Engine instances should all have OS Login enabled in the project	Mapped
Projects should have OS Login enabled at project level	Mapped

4.5 Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance

Control	Status
Compute Engine instances should have 'Enable connecting to serial ports' disabled	Mapped

4.6 Ensure That IP Forwarding Is Not Enabled on Instances

Control	Status
Compute Engine instances should have IP forwarding disabled	Mapped

4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)

Control	Status
Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption	Mapped

4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled

Control	Status
Compute Engine instances should have Shielded VM enabled at launch	Mapped

4.9 Ensure That Compute Instances Do Not Have Public IP Addresses

Control	Status
Compute Engine instances should not have public IP addresses	Mapped

5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible

Control	Status
Cloud Storage buckets used for exporting logs should prohibit anonymous and public access	Mapped
Cloud Storage buckets should prohibit anonymous and public access	Mapped

5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled

Control	Status
Cloud Storage buckets should have Bucket Only Policy enabled	Mapped
Cloud Storage buckets should have uniform bucket-level access enabled	Mapped

6.1.2 Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'

Control	Status
Cloud SQL MySQL instances should have 'skip_show_database' set to 'on'	Mapped

6.1.3 Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'

Control	Status
Cloud SQL MySQL instances should have 'local_infile' set to 'off'	Mapped

6.2.1 Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter

Control	Status
Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter	Mapped

6.2.2 Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'

Control	Status
Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'	Mapped

6.2.3 Ensure That the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'

Control	Status
Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'	Mapped

6.2.4 Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately

Control	Status
Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'	Mapped

6.2.5 Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'

Control	Status
Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher	Mapped

6.2.6 Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter

Control	Status
Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter	Mapped

6.2.7 Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled)

Control	Status
Cloud SQL PostgreSQL instances should have 'log_min_duration_statement' set to '-1' (disabled)	Mapped

6.2.8 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging

Control	Status
Cloud SQL PostgreSQL instances should each have 'cloudsql.enable_pgaudit' set to 'on' for centralized logging	Mapped

6.3 Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'

Control	Status
Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'	Mapped

6.3 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'

Control	Status
Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'	Mapped

6.3.1 Ensure 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'

Control	Status
Cloud SQL SQL Server instances should have 'external scripts enabled' set to 'off'	Mapped

6.3.2 Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'

Control	Status
Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'	Mapped

6.3.3 Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value

Control	Status
Cloud SQL SQL Server instances should have 'user connections' configured	Mapped

6.3.4 Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured

Control	Status
Cloud SQL SQL Server instances should not have 'user options' configured	Mapped

6.3.5 Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'

Control	Status
Cloud SQL SQL Server instances should have 'remote access' set to 'off'	Mapped

6.3.6 Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'

Control	Status
Cloud SQL SQL Server instances should have '3625 (trace flag)' set to 'on'	Mapped

6.3.7 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'

Control	Status
Cloud SQL SQL Server instances should have 'contained database authentication' set to 'off'	Mapped

6.4 Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL

Control	Status
Cloud SQL instances should have SSL enabled	Mapped

6.5 Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses

Control	Status
Cloud SQL instances should prohibit world-readable access	Mapped

6.6 Ensure That Cloud SQL Database Instances Do Not Have Public IPs

Control	Status
Cloud SQL instances should prohibit world-readable access	Mapped

6.7 Ensure That Cloud SQL Database Instances Are Configured With Automated Backups

Control	Status
Cloud SQL instances should have automated backups configured	Mapped

7.1 Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible

Control	Status
BigQuery tables should not be publicly readable	Mapped

7.2 Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)

Control	Status
BigQuery tables should all use customer-managed encryption keys (CMEK) for encryption	Mapped

7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets

Control	Status
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configured	Mapped

8.1 Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key

Control	Status
Dataproc clusters should use customer-managed encryption keys for encryption	Mapped

Framework	Control overlap	Note
CIS GCP Benchmark v2.0.0	High 99%
CIS GCP Benchmark v3.0.0	High 99%
NIST SP 800-53 Rev 5	High 77%

Frequently asked questions

Who publishes the CIS Benchmarks?

The Center for Internet Security (CIS), a nonprofit that promotes best practices for securing IT systems and data, publishes the CIS Benchmarks along with a variety of other materials.

What do the CIS Benchmarks cover on Google's platforms?

CIS Benchmarks are available for the configuration of Google Cloud, Google Kubernetes Engine, and Google Workspace. They are accessed through the CIS website.

What is the purpose of a CIS Benchmark?

The CIS Benchmarks are security guidelines that institutions across industries can use to assist in the configuration of their environments.