Detections
Analytics

1.1.4 Ensure Organization Policies Are Configured For Centralized Constraints

Information

Ensure that one or more baseline Organization Policies are configured at the organization or folder level in accordance with enterprise security requirements. Organization Policies act as preventive guardrails that set centralized constraints on how resources can be configured across all projects within the organization hierarchy. These policies can enforce security invariants such as preventing public IP addresses on compute instances, requiring OS Login for SSH access, restricting resource locations to approved regions, enforcing uniform bucket-level access on Cloud Storage, or limiting IAM policy member domains to prevent external sharing.

Organization Policies do not grant permissions but instead set organization-wide limits on resource configurations and service usage, regardless of local project-level IAM policies. Without baseline guardrail Organization Policies, each project can configure resources inconsistently, disable security features, use unapproved regions, allow public access to resources, or share data with external domains. Configuring standard Organization Policies at the organization or folder level enforces preventive, centralized control over high-risk configurations, supports consistent security posture at scale, and helps ensure that all projects operate within the organization's defined security baseline. Organization Policies are inherited down the resource hierarchy (organization -> folder -> project), making them an effective mechanism for enforcing security controls across large numbers of projects.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

IMPORTANT: Before enforcing Organization Policies, it is strongly recommended to use dry run mode to test policies without blocking any operations. Dry run mode allows you to preview what resources would be blocked and review violations in Cloud Asset Inventory before actual enforcement. This prevents unintended disruption to existing workloads.

From Google Cloud Admin Console

 -

Design or confirm baseline Organization policies

 - Navigate to Google Cloud Console at https://console.cloud.google.com
 - Select your organization from the organization dropdown
 - Go to IAM & Admin -> Organization Policies
 - Review existing policies and identify gaps based on your security requirements
 - Document which constraints need to be configured

 -

Configure organization policies at Organization level for each baseline security constraint identified in Step 1:

 - In the Organization Policies page, search for the constraint (e.g., compute.requireOsLogin )
 - Click Manage policy for that constraint
 - Select Override parent's policy to configure the policy
 - Configure the policy based on the constraint type:

 - For boolean constraints (e.g., require OS Login, skip default network):

 - Click on Add a rule
 - Select Enforcement On to enable the constraint
 - Add Condition for any exclusions as needed

 - For list constraints (e.g., resource locations, allowed domains):

 - For Policy enforcement select Merge with Parent or Replace
 - Click on Add a rule
 - Under Policy values, select how to enforce:

 - Deny all or Allow all
 - Custom - add specific allowed or denied values (e.g., specific regions, specific domains)

 - Example for resource locations: Select Custom, choose Allow, add in:us-locations and in:eu-locations

 - Click Set policy
 - Verify the policy shows as "Enforced" in the Organization Policies list

 -

Configure Organization Policies at Folder Level (if using folder structure)
If your organization uses folders for environment separation (e.g., Production, Non-Production):

 - Navigate to the specific folder by selecting it in the organization hierarchy
 - Go to IAM & Admin -> Organization Policies for that folder
 - Configure folder-specific policies if different constraints are needed per environment

 - Example: Stricter policies for production folders (deny all external IPs)
 - Example: Relaxed policies for development folders (allow specific regions)

 - Ensure folder-level policies do not weaken organization-level security controls unless explicitly approved

Impact:

Enforcing baseline Organization Policies can initially block some existing resource configurations, such as use of unapproved regions, creation of resources with public IPs, or external domain sharing. Teams may need to adjust deployment pipelines, Terraform configurations, and exception processes so legitimate use cases remain possible within the new guardrails. This can introduce short-term operational overhead and require careful testing, especially when applying new policies at the organization or root folder level. Organizations should test policies in non-production folders before applying them broadly.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), 800-53|AC-3

Plugin: GCP

Control ID: 082d9d2ca87e8ad5be31d711388e0449fe08f62adc6584fefd1c293807478472