| 4.1.1 Ensure the cluster-admin ClusterRole is only used when required | ACCESS CONTROL |
| 4.1.2 Ensure access to Secrets is minimized and granted only where required | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.1.3 Minimize wildcard use in Roles and ClusterRoles | IDENTIFICATION AND AUTHENTICATION |
| 4.1.4 Ensure that default service accounts are not actively used | ACCESS CONTROL |
| 4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access | CONFIGURATION MANAGEMENT |
| 4.1.6 Avoid granting cluster admin level access through the system:masters group | ACCESS CONTROL |
| 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster | ACCESS CONTROL |
| 4.1.9 Avoid binding RBAC roles to all authenticated users | ACCESS CONTROL |
| 4.2.1 Enforce baseline or restricted Pod Security Standards on workload namespaces | CONFIGURATION MANAGEMENT |
| 4.3.1 Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.1 Use namespaces to separate workload administration and resource governance | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.1 Use custom least privilege service accounts for GKE node pools | IDENTIFICATION AND AUTHENTICATION |
| 5.5.1 Use COS_CONTAINERD node images for GKE node pools | CONFIGURATION MANAGEMENT |
| 5.5.4 Enroll GKE clusters in release channels for automated version management | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.5.5 Verify Shielded GKE Nodes are enabled for GKE clusters | CONFIGURATION MANAGEMENT |
| 5.5.6 Verify Shielded GKE Node integrity monitoring is enabled | RISK ASSESSMENT |
| 5.6.2 Use VPC native GKE clusters with alias IP address ranges | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6.5 Ensure private GKE nodes are configured without external IP addresses | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7.1 Enable Cloud Logging and Cloud Monitoring for GKE clusters | AUDIT AND ACCOUNTABILITY |
| 5.8.1 Disable legacy client certificate authentication for the GKE API server | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.8.3 Ensure Legacy Authorization (ABAC) is Disabled | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.10.1 Do not use GKE alpha clusters for production workloads | SYSTEM AND COMMUNICATIONS PROTECTION |
