| AC_GCP_0224 | Ensure Remote Desktop (TCP:3389) is not exposed to public for Google Compute Firewall | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0241 | Ensure object versioning is enabled on Google Cloud Storage Buckets | GCP | Logging and Monitoring | LOW |
| AC_GCP_0243 | Ensure application-layer secrets are encrypted for Google Container Cluster | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0244 | Ensure HTTP load balancing is enabled for Google Container Cluster | GCP | Resilience | MEDIUM |
| AC_GCP_0245 | Ensure IAM roles do not impersonate or manage service accounts through Google Folder IAM Binding | GCP | Identity and Access Management | LOW |
| AC_GCP_0254 | Ensure that the 'log_lock_waits' database flag for Cloud SQL PostgreSQL instance is set to 'on' | GCP | Compliance Validation | LOW |
| AC_GCP_0266 | Ensure a retention policy is enabled for Google Cloud Storage Buckets | GCP | Security Best Practices | MEDIUM |
| AC_GCP_0267 | Ensure a retention period of at least 90 days is set for Google Cloud Storage Buckets | GCP | Security Best Practices | LOW |
| AC_GCP_0269 | Ensure that 'always allow' evaluation mode is restricted for Google Binary Authorization Policy | GCP | Security Best Practices | MEDIUM |
| AC_GCP_0292 | Ensure that SSH access is restricted from the internet | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0293 | Ensure that SSH access is restricted from the internet | GCP | Infrastructure Security | LOW |
| AC_GCP_0303 | Ensure that retention policies on log buckets are configured using Bucket Lock | GCP | Logging and Monitoring | LOW |
| AC_GCP_0004 | Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account | GCP | Identity and Access Management | LOW |
| AC_GCP_0005 | Ensure That Service Account Has No Admin Privileges - google_project_iam_member | GCP | Identity and Access Management | HIGH |
| AC_GCP_0011 | Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days | GCP | Security Best Practices | LOW |
| AC_GCP_0013 | Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on' | GCP | Compliance Validation | LOW |
| AC_GCP_0017 | Ensure Node Auto-Upgrade is enabled for GKE nodes | GCP | Security Best Practices | LOW |
| AC_GCP_0028 | Ensure Legacy Authorization (ABAC) is Disabled | GCP | Identity and Access Management | HIGH |
| AC_GCP_0040 | Ensure That Instances Are Not Configured To Use the Default Service Account | GCP | Identity and Access Management | HIGH |
| AC_GCP_0229 | Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK) | GCP | Data Protection | MEDIUM |
| AC_GCP_0230 | Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible | GCP | Identity and Access Management | HIGH |
| AC_GCP_0252 | Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On' | GCP | Compliance Validation | LOW |
| AC_GCP_0258 | Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off' | GCP | Compliance Validation | LOW |
| AC_GCP_0268 | Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer | GCP | Identity and Access Management | LOW |
| AC_GCP_0270 | Ensure the GKE Metadata Server is Enabled | GCP | Security Best Practices | LOW |
| AC_GCP_0276 | Ensure use of Binary Authorization | GCP | Infrastructure Security | LOW |
| AC_GCP_0278 | Ensure Oslogin Is Enabled for a Project - google_compute_instance | GCP | Security Best Practices | LOW |
| AC_GCP_0297 | Ensure legacy Compute Engine instance metadata APIs are Disabled | GCP | Infrastructure Security | LOW |
| AC_GCP_0312 | Ensure That Cloud DNS Logging Is Enabled for All VPC Networks | GCP | Logging and Monitoring | MEDIUM |
| AC_GCP_0323 | Ensure Compute Instances Are Launched With Shielded VM Enabled | GCP | Infrastructure Security | LOW |
| AC_GCP_0327 | Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key | GCP | Infrastructure Security | LOW |
| AC_GCP_0330 | Ensure Essential Contacts is Configured for Organization | GCP | Logging and Monitoring | LOW |
| AC_GCP_0370 | Ensure Instance IP assignment is set to private | GCP | Compliance Validation | LOW |
| AC_GCP_0012 | Ensure a key rotation mechanism within a 365 day period is implemented for Google KMS Crypto Key | GCP | Security Best Practices | LOW |
| AC_GCP_0026 | Ensure network policy is enabled on Google Container Cluster | GCP | Infrastructure Security | HIGH |
| AC_GCP_0029 | Ensure stackdriver monitoring is enabled on Google Container Cluster | GCP | Logging and Monitoring | HIGH |
| AC_GCP_0031 | Ensure private google access is enabled for Google Compute Subnetwork | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0042 | Ensure Cassandra OpsCenter agent (TCP:61621) is not exposed to more than 32 private hosts for Google Compute Firewall | GCP | Infrastructure Security | LOW |
| AC_GCP_0049 | Ensure Puppet Master (TCP:8140) is not exposed to public for Google Compute Firewall | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0054 | Ensure MSSQL Browser Service (UDP:1434) is not exposed to more than 32 private hosts for Google Compute Firewall | GCP | Infrastructure Security | LOW |
| AC_GCP_0058 | Ensure MSSQL Admin (TCP:1434) is not exposed to public for Google Compute Firewall | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0063 | Ensure VNC Listener (TCP:5500) is not exposed to more than 32 private hosts for Google Compute Firewall | GCP | Infrastructure Security | LOW |
| AC_GCP_0066 | Ensure Known internal web port (TCP:8080) is not exposed to more than 32 private hosts for Google Compute Firewall | GCP | Infrastructure Security | LOW |
| AC_GCP_0070 | Ensure Known internal web port (TCP:8000) is not exposed to public for Google Compute Firewall | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0087 | Ensure SNMP (UDP:161) is not exposed to more than 32 private hosts for Google Compute Firewall | GCP | Infrastructure Security | LOW |
| AC_GCP_0098 | Ensure NetBios Datagram Service (TCP:138) is not exposed to entire internet for Google Compute Firewall | GCP | Infrastructure Security | HIGH |
| AC_GCP_0102 | Ensure NetBIOS Name Service (UDP:137) is not exposed to more than 32 private hosts for Google Compute Firewall | GCP | Infrastructure Security | LOW |
| AC_GCP_0103 | Ensure NetBIOS Name Service (UDP:137) is not exposed to public for Google Compute Firewall | GCP | Infrastructure Security | MEDIUM |
| AC_GCP_0113 | Ensure SMTP (TCP:25) is not exposed to entire internet for Google Compute Firewall | GCP | Infrastructure Security | HIGH |
| AC_GCP_0116 | Ensure Microsoft-DS (TCP:445) is not exposed to entire internet for Google Compute Firewall | GCP | Infrastructure Security | HIGH |
