Detections
Analytics

1.1.3 Ensure Folders Are Structured By Environment And Sensitivity

Information

Ensure that GCP Resource Manager folders are structured primarily by environment (for example, production, non-production, sandbox) and sensitivity (for example, security, logging, shared services, regulated workloads), rather than mirroring the corporate org chart. Folders should group projects that share similar security requirements and controls so that appropriate Organization Policies, IAM policies, and other guardrails can be applied consistently at the folder level.

A clear folder structure based on environment and sensitivity makes it easier to apply consistent guardrails and centralized security controls to projects that have similar risk profiles and compliance needs. Folders enable hierarchical policy inheritance where stricter controls can be applied to production folders while development folders can have more relaxed policies for experimentation. Poorly defined or ad-hoc folder structures complicate policy management, increase the chance of misapplied controls, and can lead to mixing workloads with different data sensitivities under the same set of controls. Without proper folder segregation, a compromised development project can be used to pivot into production resources, security policies cannot be enforced consistently, and compliance auditing becomes significantly more complex.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Google Cloud Admin Console

 - Work with security, platform, and application teams to agree on a small set of top-level OUs such as:

 - Security / Management
 - Shared Services / Infrastructure
 - Prod
 - Non-Prod (dev, test, staging)
 - You may also define dedicated OUs for highly regulated workloads.

 - Create Folder Structure in GCP

 - Navigate to Google Cloud Console at https://console.cloud.google.com
 - Select your organization from the organization dropdown
 - Go to IAM & Admin -> Manage resources
 - Click CREATE FOLDER at the top
 - For each top-level folder in your design:

 - Enter Folder name (e.g., "Production")
 - Select Organization as the parent
 - Click CREATE

 - For sub-folders (e.g., "Regulated" under "Production"):

 - Click CREATE FOLDER
 - Enter Folder name (e.g., "Regulated")
 - Select the parent folder (e.g., "Production")
 - Click CREATE

 - Repeat until the complete folder structure is created

 -

Export or list all existing projects and their current folders. Create a simple mapping from each project to its target folder based on environment and sensitivity.

 -

Move Projects to Environment/Sensitivity-Based Folders

 - Navigate to IAM & Admin -> Manage resources
 - Start with low-risk projects (sandbox and non-production):

 - Locate the project in the current hierarchy
 - Click the three-dot menu next to the project
 - Select Move
 - In the Select a destination dialog, choose the target folder from your folder structure
 - Click MOVE

 - Test that workloads continue to function after the move
 - After validating low-risk moves, proceed with production and high-sensitivity projects.

 - After projects have been moved, remove old folders that no longer reflect the target structure.

 - Ensure no active projects remain directly under the root unless explicitly justified and documented.
 - Update architecture docs, onboarding runbooks, and project request processes to require new projects to be created in the correct folder based on environment and sensitivity.

Impact:

Restructuring folders by environment and sensitivity can require moving projects, changing inherited Organization Policies and IAM policies, and updating automation that assumes existing folder paths. This may introduce short-term operational overhead, including policy revalidation, testing of workloads under new guardrails, and coordination with application and platform teams to avoid unintended service disruption. Projects may experience changes in inherited permissions and policy constraints when moved to new folders.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-4

Plugin: GCP

Control ID: 28605a12b69fcefe44b1a532b9e4a53718af13a5aaf3f0bd59e45bdceb7630a8