Policy: GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

From Google Cloud CLI

For each Google Cloud Platform project, list the accounts that have been granted access to that project. Also list the accounts added on each folder, and the organization's IAM policy:

gcloud projects get-iam-policy PROJECT_ID gcloud resource-manager folders get-iam-policy FOLDER_ID gcloud organizations get-iam-policy ORGANIZATION_ID

No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v5.0 > 1 - Identity and Access Management > Maximum Attestation Duration, which by default follows GCP > CIS v5.0 > Maximum Attestation Duration. Set to a blank value to clear the attestation.