Policy: GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

From Google Cloud console

1. Document the organization's baseline guardrail requirements, for example constraints/gcp.resourceLocations, constraints/compute.requireOsLogin, constraints/compute.vmExternalIpAccess, constraints/storage.uniformBucketLevelAccess and constraints/iam.allowedPolicyMemberDomains. 2. Select the organization and go to IAM & Admin > Organization Policies. Verify each baseline constraint is configured and enforced, and review its exceptions and values. 3. Repeat for each folder and for critical projects, and verify that baseline policies are not overridden or weakened (look for policies marked Customized).

From Google Cloud CLI

gcloud org-policies list --organization=<ORGANIZATION_ID> gcloud org-policies list --folder=<FOLDER_ID>

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > Maximum Attestation Duration, which by default follows GCP > CIS v5.0 > 1 - Identity and Access Management > Maximum Attestation Duration and then GCP > CIS v5.0 > Maximum Attestation Duration. Set to a blank value to clear the attestation.