Standards · Google Cloud

CIS Google Cloud Platform Foundation Benchmark.
v5.0.0 · 93 controls.

93 controls across 8 sections, from Identity and Access Management to Dataproc, all assessed in one read-only Google Cloud scan.

Start free trial ConfigCobra for Google Cloud →

Controls: 93
Sections: 8
Level 1: 54
Level 2: 39

8 sections. 93 controls.

One Google Cloud scan covers every section of the Foundation Benchmark v5.0.0.

What is the CIS Google Cloud Platform Foundation Benchmark?

The Center for Internet Security (CIS) is a non-profit organisation whose CIS Benchmarks are prescriptive configuration recommendations for hardening operating systems, cloud platforms and SaaS applications.

For Google Cloud, the Foundation Benchmark is the baseline. Version v5.0.0 contains 93 controls — 54 Level 1 and 39 Level 2.

Sections and controls.

CIS Google Cloud Platform Foundation Benchmarkv5.0.0

93controls

54Level 1

39Level 2

1Identity and Access Management21controls
2Logging and Monitoring17controls
3Networking12controls
4Virtual Machines12controls
5Storage2controls
6Cloud SQL (MySQL, PostgreSQL, SQL Server)24controls
7BigQuery4controls
8Dataproc1controls

Level 1 or Level 2.

Level 1
54 controls
Safe, minimal impact. Baseline recommendations intended to be applied broadly with minimal impact on day-to-day use.
Level 2
39 controls
Stricter, security-focused. For environments with higher security requirements. Some may affect functionality and warrant testing first.

How ConfigCobra assesses it.

ConfigCobra for Google Cloud is available.

Scan

All 8 sections in one scan.

Scan every project in the organization, or a selected list, against all 93 controls.

Controls page: 499 controls by status, severity and section, with the list of controls below. Sample tenant.

Evidence

Every finding comes with evidence.

See the setting, what the benchmark expects and what the scan found, with a severity estimate per control to prioritise the fixes.

Cloud Security Posture Management →

Evidence for a failing control: each checked setting, the expected and the found value, and the resources. Sample tenant.

Read-only

A read-only service account. Never writes.

Viewer-level roles only, for the whole organization — every project — or a selected list of projects.

ConfigCobra for Google Cloud →

ConnectorsConnect a cloud

Microsoft 365CIS v7.0.0 · 160 controls · read-only Microsoft GraphConnect
Microsoft Azure4 CIS Azure benchmarks · 339 controls · read-onlyConnect
Google CloudCIS Google Cloud Foundation v5.0.0 · 93 controlsConnected
AWS4 CIS AWS benchmarks · 306 controls · read-onlyConnect
Google WorkspaceComing soon · register your interestComing soon

Connect Google Cloud

ConfigCobra asks for read-only access:

✓Read-only service account (viewer-level roles)
✓Never writes to your cloud

CancelGrant read-only access

Healthy

Google Cloud · connected

QueuedFirst scan

FAQ

Frequently asked questions

How many controls are in the CIS Google Cloud Platform Foundation Benchmark v5.0.0?

93 controls — 54 Level 1 and 39 Level 2 — across 8 sections.

What are the sections of the benchmark?

1 Identity and Access Management (21 controls), 2 Logging and Monitoring (17), 3 Networking (12), 4 Virtual Machines (12), 5 Storage (2), 6 Cloud SQL (MySQL, PostgreSQL, SQL Server) (24), 7 BigQuery (4) and 8 Dataproc (1).

Can ConfigCobra scan Google Cloud today?

Yes. ConfigCobra for Google Cloud is available. Start a free trial or ask us for a quote.

ConfigCobra for Google Cloud →

What access does the Google Cloud assessment need?

A read-only service account with viewer-level roles, covering the whole organization — every project — or a selected list of projects. It never writes to your Google Cloud.

See it on your own tenant

Read-only access — ConfigCobra never changes your tenant.