Check library
Google Cloud security checks
93 checks. 2 have an explained page so far (linked below); the rest follow.
CIS Google Cloud Platform Foundation v5.0.0
93 controls
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 1.2 | Use corporate-managed login credentials instead of consumer accounts | Identity and Access Management | Level 1 |
| 1.3 | Enforce multi-factor authentication for all non-service accounts | Identity and Access Management | Level 1 |
| 1.4 | Enforce security-key two-factor authentication for all admin accounts | Identity and Access Management | Level 2 |
| 1.5 | Use only GCP-managed keys for each service account (no user-managed keys) | Identity and Access Management | Level 1 |
| 1.6 | Ensure service accounts hold no admin (owner/editor) privileges | Identity and Access Management | Level 1 |
| 1.7 | Ensure users are not granted Service Account User or Token Creator at project level | Identity and Access Management | Level 1 |
| 1.8 | Rotate user-managed/external service-account keys every 90 days or fewer | Identity and Access Management | Level 1 |
| 1.9 | Enforce separation of duties when assigning service-account roles to users | Identity and Access Management | Level 2 |
| 1.10 | Ensure Cloud KMS crypto keys are not anonymously or publicly accessible | Identity and Access Management | Level 1 |
| 1.11 | Rotate Cloud KMS encryption keys within a period of 90 days | Identity and Access Management | Level 1 |
| 1.12 | Enforce separation of duties when assigning KMS-related roles to users | Identity and Access Management | Level 2 |
| 1.13 | Ensure API keys exist only for actively used services | Identity and Access Management | Level 2 |
| 1.14 | Restrict API keys to use by only specified hosts and applications | Identity and Access Management | Level 2 |
| 1.15 | Restrict API keys to only the APIs the application needs | Identity and Access Management | Level 2 |
| 1.16 | Rotate API keys every 90 days | Identity and Access Management | Level 2 |
| 1.17 | Configure Essential Contacts for the organization | Identity and Access Management | Level 1 |
| 1.18 | Store secrets in Secret Manager rather than Cloud Functions environment variables | Identity and Access Management | Level 1 |
| 1.1.1 | Ensure the super-admin email address is not tied to a single individual | Identity and Access Management | Level 1 |
| 1.1.2 | Avoid using the super-admin account for routine Google Cloud administration | Identity and Access Management | Level 1 |
| 1.1.3 | Structure folders by environment and data sensitivity | Identity and Access Management | Level 2 |
| 1.1.4 | Configure organization policies for centralized constraints | Identity and Access Management | Level 2 |
| 2.1 | Configure Cloud Audit Logging across all services and users | Logging and Monitoring | Level 1 |
| 2.2 | Enable Workspace/Cloud Identity data sharing for admin audit logging | Logging and Monitoring | Level 1 |
| 2.3 | Configure sinks to export copies of all log entries | Logging and Monitoring | Level 1 |
| 2.4 | Apply Bucket Lock retention policies to log-export storage buckets | Logging and Monitoring | Level 2 |
| 2.5 | Alert on project-ownership assignments/changes via log metric filter | Logging and Monitoring | Level 1 |
| 2.6 | Alert on audit-configuration changes via log metric filter | Logging and Monitoring | Level 1 |
| 2.7 | Alert on custom-role changes via log metric filter | Logging and Monitoring | Level 1 |
| 2.8 | Alert on VPC firewall-rule changes via log metric filter | Logging and Monitoring | Level 2 |
| 2.9 | Alert on VPC network-route changes via log metric filter | Logging and Monitoring | Level 2 |
| 2.10 | Alert on VPC network changes via log metric filter | Logging and Monitoring | Level 2 |
| 2.11 | Alert on Cloud Storage IAM permission changes via log metric filter | Logging and Monitoring | Level 2 |
| 2.12 | Alert on Cloud SQL instance configuration changes via log metric filter | Logging and Monitoring | Level 2 |
| 2.13 | Enable Cloud DNS logging for all VPC networks | Logging and Monitoring | Level 1 |
| 2.14 | Enable Cloud Asset Inventory | Logging and Monitoring | Level 1 |
| 2.15 | Enable Access Transparency | Logging and Monitoring | Level 2 |
| 2.16 | Enable Access Approval | Logging and Monitoring | Level 2 |
| 2.17 | Enable logging for HTTP(S) load balancers | Logging and Monitoring | Level 2 |
| 3.1 | Ensure the default network does not exist in a project | Networking | Level 2 |
| 3.2 | Ensure legacy networks do not exist for older projects | Networking | Level 1 |
| 3.3 | Enable DNSSEC for Cloud DNS | Networking | Level 1 |
| 3.4 | Avoid RSASHA1 for the key-signing key in Cloud DNS DNSSEC | Networking | Level 1 |
| 3.5 | Avoid RSASHA1 for the zone-signing key in Cloud DNS DNSSEC | Networking | Level 1 |
| 3.6 | Restrict SSH access from the internet (tcp/22 not open to 0.0.0.0/0) | Networking | Level 2 |
| 3.7 | Restrict RDP access from the internet (tcp/3389 not open to 0.0.0.0/0) | Networking | Level 2 |
| 3.8 | Enable VPC Service Controls for supported Google Cloud services | Networking | Level 2 |
| 3.9 | Use Private Service Connect for access to Google APIs | Networking | Level 2 |
| 3.10 | Enable VPC Flow Logs for every subnet in a VPC network | Networking | Level 2 |
| 3.11 | Ensure HTTPS/SSL proxy load balancers disallow weak cipher suites | Networking | Level 1 |
| 3.12 | Use Identity-Aware Proxy to allow only Google-sourced traffic | Networking | Level 2 |
| 4.1 | Ensure instances are not configured to use the default service account | Virtual Machines | Level 1 |
| 4.2 | Ensure instances do not use the default service account with full API access | Virtual Machines | Level 1 |
| 4.3 | Enable "Block Project-wide SSH keys" for VM instances | Virtual Machines | Level 1 |
| 4.4 | Enable OS Login for the project | Virtual Machines | Level 1 |
| 4.5 | Disable serial-port connection on VM instances | Virtual Machines | Level 1 |
| 4.6 | Ensure IP forwarding is not enabled on instances | Virtual Machines | Level 1 |
| 4.7 | Encrypt critical VM disks with customer-supplied encryption keys (CSEK) | Virtual Machines | Level 2 |
| 4.8 | Launch compute instances with Shielded VM enabled | Virtual Machines | Level 2 |
| 4.9 | Ensure compute instances do not have public IP addresses | Virtual Machines | Level 2 |
| 4.10 | Enforce HTTPS connections for App Engine applications | Virtual Machines | Level 2 |
| 4.11 | Enable Confidential Computing on supported compute instances | Virtual Machines | Level 2 |
| 4.12 | Keep VM operating systems patched with the latest updates | Virtual Machines | Level 2 |
| 5.1 | Ensure Cloud Storage buckets are not anonymously or publicly accessible | Storage | Level 1 |
| 5.2 | Enable uniform bucket-level access on Cloud Storage buckets | Storage | Level 2 |
| 6.4 | Require SSL for all incoming Cloud SQL connections | Cloud SQL | Level 1 |
| 6.5 | Ensure Cloud SQL instances do not whitelist all public IP addresses (0.0.0.0/0) | Cloud SQL | Level 1 |
| 6.6 | Enable IAM database authentication on Cloud SQL instances | Cloud SQL | Level 1 |
| 6.7 | Ensure Cloud SQL instances do not have public IP addresses | Cloud SQL | Level 2 |
| 6.8 | Configure automated backups for Cloud SQL instances | Cloud SQL | Level 1 |
| 6.9 | Enable deletion protection on Cloud SQL instances | Cloud SQL | Level 1 |
| 6.1.1 | Ensure a MySQL instance does not allow anyone to connect with admin privileges | Cloud SQL | Level 1 |
| 6.1.2 | Set the MySQL 'skip_show_database' flag to on | Cloud SQL | Level 1 |
| 6.1.3 | Set the MySQL 'local_infile' flag to off | Cloud SQL | Level 1 |
| 6.2.1 | Set PostgreSQL 'log_error_verbosity' to DEFAULT or stricter | Cloud SQL | Level 2 |
| 6.2.2 | Set PostgreSQL 'log_connections' to on | Cloud SQL | Level 1 |
| 6.2.3 | Set PostgreSQL 'log_disconnections' to on | Cloud SQL | Level 1 |
| 6.2.4 | Set PostgreSQL 'log_statement' appropriately | Cloud SQL | Level 2 |
| 6.2.5 | Set PostgreSQL 'log_min_messages' to at least Warning | Cloud SQL | Level 1 |
| 6.2.6 | Set PostgreSQL 'log_min_error_statement' to Error or stricter | Cloud SQL | Level 1 |
| 6.2.7 | Set PostgreSQL 'log_min_duration_statement' to -1 (disabled) | Cloud SQL | Level 1 |
| 6.2.8 | Set PostgreSQL 'cloudsql.enable_pgaudit' to on for centralized logging | Cloud SQL | Level 1 |
| 6.3.1 | Set SQL Server 'external scripts enabled' to off | Cloud SQL | Level 1 |
| 6.3.2 | Set SQL Server 'cross db ownership chaining' to off | Cloud SQL | Level 1 |
| 6.3.3 | Set SQL Server 'user connections' to a non-limiting value | Cloud SQL | Level 1 |
| 6.3.4 | Ensure SQL Server 'user options' flag is not configured | Cloud SQL | Level 1 |
| 6.3.5 | Set SQL Server 'remote access' to off | Cloud SQL | Level 1 |
| 6.3.6 | Set SQL Server '3625 (trace flag)' to on | Cloud SQL | Level 1 |
| 6.3.7 | Set SQL Server 'contained database authentication' to off | Cloud SQL | Level 1 |
| 7.1 | Ensure BigQuery datasets are not anonymously or publicly accessible | BigQuery | Level 1 |
| 7.2 | Encrypt all BigQuery tables with a customer-managed encryption key (CMEK) | BigQuery | Level 2 |
| 7.3 | Specify a default customer-managed encryption key (CMEK) for all BigQuery datasets | BigQuery | Level 2 |
| 7.4 | Ensure all data in BigQuery has been classified | BigQuery | Level 2 |
| 8.1 | Encrypt Dataproc clusters using a customer-managed encryption key | Dataproc | Level 2 |