ISO/IEC 27001:2022

ActiveCore framework

ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). The 2022 revision reorganizes Annex A controls into four themes: Organizational, People, Physical, and Technological, with 93 controls replacing the previous 114. It emphasizes risk-based security management, continuous improvement, and alignment with modern threats including cloud security and privacy.

Mandatory?	Voluntary — demanded by B2B contracts
Who validates?	Accredited certification body (IAF member). No self-assessment.
Renewal	3-year cert; annual surveillance
Observation period	Surveillance: years 1 and 2
Governing body	International Organization for Standardization (ISO), ISO/IEC 27001:2022. Official source

Controls by category

40 controls are Mapped to ISO/IEC 27001:2022.

Access Control

Control	Status
Service accounts should use only GCP-managed service account keys	Mapped
Service accounts should not have Admin privileges	Mapped
IAM users should not have Service Account User or Service Account Token Creator roles at project level	Mapped
IAM users should not hold both service account admin and service account user roles	Mapped
KMS keys should have separation of duties enforced for KMS-related roles	Mapped
Projects should have 'Access Approval' set to 'Enabled'	Mapped

Access Rights

Control	Status
Service accounts should not have Admin privileges	Mapped
IAM users should not hold both service account admin and service account user roles	Mapped

Collection Of Evidence

Control	Status
Projects should have Cloud Asset Inventory enabled	Mapped

Configuration Management

Control	Status
Projects should have Cloud Asset Inventory enabled	Mapped

Data Leakage Prevention

Control	Status
Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption	Mapped
API keys should allow access only to APIs needed by the application	Mapped
Cloud KMS cryptokeys should prohibit anonymous and public access	Mapped
Cloud SQL instances should have SSL enabled	Mapped
Cloud Storage buckets used for exporting logs should prohibit anonymous and public access	Mapped
Cloud Storage buckets should prohibit anonymous and public access	Mapped

Identity Management

Control	Status
API keys should have rotation configured every 90 days	Mapped
Service account keys should limit age to 100 days	Mapped
User-managed or external service account keys should have rotation configured every 90 days or less	Mapped

Information Access Restriction

Control	Status
Compute Engine instances should not use the default service account with full access to all Cloud APIs	Mapped
Service accounts should not have Admin privileges	Mapped
Projects should have 'Access Approval' set to 'Enabled'	Mapped

Information Backup

Control	Status
Cloud SQL instances should have automated backups configured	Mapped

Logging

Control	Status
Projects should have log metric filters and alerts configured for Custom Role changes	Mapped
Projects should have log metric filters and alerts configured for VPC network changes	Mapped
Projects should have log metric filters and alerts configured for VPC network route changes	Mapped
Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes	Mapped
Projects should have log sinks configured for all log entries	Mapped

Monitoring Activities

Control	Status
Projects should have Cloud Audit Logs properly configured across all services and all users	Mapped
HTTP(S) load balancers should have logging enabled	Mapped
VPC networks should all have Cloud DNS logging enabled	Mapped
VPC subnets should all have VPC Flow Logs enabled	Mapped
Log buckets should have retention policies configured using Bucket Lock	Mapped
Projects should have log metric filters and alerts configured for Custom Role changes	Mapped
Projects should have log metric filters and alerts configured for VPC network changes	Mapped
Projects should have log metric filters and alerts configured for VPC network route changes	Mapped
Projects should have log metric filters and alerts configured for Cloud SQL instance configuration changes	Mapped
Projects should have log sinks configured for all log entries	Mapped
Cloud SQL PostgreSQL instances should have 'log_connections' set to 'on'	Mapped
Cloud SQL PostgreSQL instances should have 'log_disconnections' set to 'on'	Mapped
Cloud SQL PostgreSQL instances should have 'log_error_verbosity' set to 'DEFAULT' or stricter	Mapped
Cloud SQL PostgreSQL instances should have 'log_min_error_statement' set to 'Error' or stricter	Mapped
Cloud SQL PostgreSQL instances should have 'log_min_messages' set to warning or higher	Mapped
Cloud SQL PostgreSQL instances should have 'log_statement' set to 'ddl'	Mapped
Cloud Storage buckets used for exporting logs should have retention policies enabled	Mapped

Network Security

Control	Status
Projects should prohibit default networks	Mapped
Projects should prohibit legacy networks	Mapped
VPC networks should all have Cloud DNS logging enabled	Mapped
VPC subnets should all have VPC Flow Logs enabled	Mapped
Projects should have log metric filters and alerts configured for VPC network changes	Mapped
Projects should have log metric filters and alerts configured for VPC network route changes	Mapped
Firewall rules should prohibit unrestricted RDP access from the internet	Mapped
Firewall rules should prohibit unrestricted SSH access from the internet	Mapped

Privileged Access Rights

Control	Status
Service accounts should use only GCP-managed service account keys	Mapped
Service accounts should not have Admin privileges	Mapped
IAM users should not have Service Account User or Service Account Token Creator roles at project level	Mapped
IAM users should not hold both service account admin and service account user roles	Mapped
KMS keys should have separation of duties enforced for KMS-related roles	Mapped
Projects should have 'Access Approval' set to 'Enabled'	Mapped

Security of Network Services

Control	Status
VPC networks should all have Cloud DNS logging enabled	Mapped
VPC subnets should all have VPC Flow Logs enabled	Mapped
Projects should have log metric filters and alerts configured for VPC network changes	Mapped

Segregation of Duties

Control	Status
IAM users should not have Service Account User or Service Account Token Creator roles at project level	Mapped
IAM users should not hold both service account admin and service account user roles	Mapped
KMS keys should have separation of duties enforced for KMS-related roles	Mapped

Use of Cryptography

Control	Status
KMS keys should be rotated at least annually	Mapped
Cloud KMS cryptokeys should prohibit anonymous and public access	Mapped

Framework	Control overlap	Note
BSI C5:2025	High 100%
CIS GCP Benchmark v2.0.0	High 98%
CIS GCP Benchmark v3.0.0	High 98%

Frequently asked questions

What does ISO/IEC 27001:2022 specify?

ISO/IEC 27001:2022 outlines and provides the requirements for an information security management system (ISMS). It specifies a set of best practices and details the security controls that can help manage information risks.

Does ISO/IEC 27001 mandate specific information security controls?

The 27001 standard does not mandate specific information security controls. The framework and checklist of controls it lays out allow an organization to build a comprehensive and continually improving model for security management.

How does an organization get its own ISO/IEC 27001 certification when using Google Cloud?

An organization has to seek out and obtain its own certification. It can use the Google Cloud certificate to understand how requirements were implemented for the products. It can then complete its own implementation and certification.

How can the Google Cloud ISO/IEC 27001 certificates be obtained?

Google Cloud, Google Workspace, and Apigee ISO/IEC 27001 certificates may be requested using the Compliance Reports Manager. Potential customers can reach out to sales for more information.