| 4.1.8 Avoid binding RBAC roles to unauthenticated users and groups | ACCESS CONTROL |
| 4.3.2 Define default deny NetworkPolicies for each workload namespace | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.1 Prefer using secrets as files over secrets as environment variables | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.2 Use Secret Manager for external workload secret storage | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.1 Enforce image provenance using Binary Authorization for GKE | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 4.6.2 Require RuntimeDefault seccomp or approved custom profiles for workload pods | CONFIGURATION MANAGEMENT |
| 4.6.3 Require hardened security contexts for all workload Pods and containers | CONFIGURATION MANAGEMENT |
| 4.6.4 Avoid deploying workloads in the default namespace | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.1 Enable Artifact Analysis scanning for Artifact Registry container images | RISK ASSESSMENT |
| 5.1.2 Grant least privilege IAM access to Artifact Registry repositories | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.3 Enforce Binary Authorization for trusted GKE container image deployments | CONFIGURATION MANAGEMENT |
| 5.2.2 Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1 Enable application-layer Secrets encryption with Cloud KMS keys | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.1 Enable GKE metadata server on Standard node pools | CONFIGURATION MANAGEMENT |
| 5.5.2 Verify node auto-repair is enabled for GKE node pools | RISK ASSESSMENT |
| 5.5.3 Verify node auto-upgrade is enabled for GKE node pools | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.5.7 Ensure Secure Boot is enabled for Shielded GKE node pools | RISK ASSESSMENT |
| 5.6.1 Enable VPC Flow Logs and Intranode Visibility | AUDIT AND ACCOUNTABILITY, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.6.3 Restrict GKE control plane access with authorized networks | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6.4 Use DNS based access or private GKE control plane endpoints | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6.6 Apply least privilege firewall rules to GKE worker nodes | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6.7 Use Google managed SSL certificates for GKE Ingress TLS | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7.2 Enable Linux auditd logging for Container Optimized OS GKE nodes | AUDIT AND ACCOUNTABILITY |
| 5.8.2 Use Google Groups to centrally manage Kubernetes RBAC access for GKE clusters | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.9.1 Use CMEK protected StorageClasses for GKE Persistent Disk volumes | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.9.2 Use CMEK protected boot disks for GKE node pools | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10.2 Use GKE Sandbox for untrusted or high risk workloads | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10.3 Enable the GKE security posture dashboard for cluster security insights | CONFIGURATION MANAGEMENT |
