1.3 Ensure that Security Key Enforcement is Enabled for All Admin Accounts

800-53|IA-2(1)

800-53|IA-2(2)

CSCv7|16.3

1.8 Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users

800-53|AC-3

800-53|AC-5

800-53|AC-6

800-53|MP-2

CSCv7|14.6

1.11 Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users

1.12 Ensure API Keys Are Not Created for a Project

800-53|AC-2

CSCv7|16

1.17 Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key

800-53|IA-5(1)

800-53|SC-28

800-53|SC-28(1)

CSCv7|14.8

2.3 Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock

2.13 Ensure Cloud Asset Inventory Is Enabled

800-53|CM-8

800-53|CM-8(1)

800-53|PM-5

CSCv7|1.4

CSCv7|11.2

CSCv7|16.1

2.15 Ensure 'Access Approval' is 'Enabled'

3.1 Ensure That the Default Network Does Not Exist in a Project

800-53|AC-18

800-53|AC-18(1)

800-53|AC-18(3)

800-53|CM-2

800-53|CM-6

800-53|CM-7

800-53|CM-7(1)

800-53|CM-9

CSCv7|11.1

3.6 Ensure That SSH Access Is Restricted From the Internet

800-53|CA-9

800-53|SC-7

800-53|SC-7(5)

CSCv7|9.2

CSCv7|12.4

3.7 Ensure That RDP Access Is Restricted From the Internet

3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'

800-53|AC-2(1)

CSCv7|16.2

4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)

4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled

CSCv7|5.2

4.9 Ensure That Compute Instances Do Not Have Public IP Addresses

4.10 Ensure That App Engine Applications Enforce HTTPS Connections

800-53|AC-17(2)

800-53|IA-5

800-53|SA-15

800-53|SC-8

800-53|SC-8(1)

CSCv7|18.5

4.11 Ensure That Compute Instances Have Confidential Computing Enabled

4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects

800-53|SA-22

CSCv7|2.2

5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled

6.2.1 Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter

800-53|AU-3

800-53|AU-3(1)

800-53|AU-7

800-53|AU-12

CSCv7|6.3

6.6 Ensure That Cloud SQL Database Instances Do Not Have Public IPs

7.2 Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)

7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets

CIS Google Cloud Platform v1.3.0 L2

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous

CIS Google Cloud Platform v1.3.0 L2 Download File