Control: GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration

Configures auditing against a CIS Benchmark item.

Level: 1

It is recommended that super admin accounts are not granted any IAM roles in Google Cloud Platform and are used exclusively for identity management in Google Workspace or Cloud Identity. Google Cloud administration should be performed using separate regular user accounts that are granted appropriate GCP IAM roles.

The Super Admin role exists in Google Workspace/Cloud Identity to manage identities (users, groups, domains). Google Cloud resource management (VMs, networks, databases, IAM policies) should be handled by separate regular user accounts in Workspace/Cloud Identity that are granted GCP-specific IAM roles such as Organization Administrator. These are two separate privilege domains that should not be combined in a single account.