Policies

GCP > CIS v1 > 3 Networking > 3.03 Ensure that DNSSEC is enabled for Cloud DNS (Not Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v1 > 3 Networking > 3.04 Ensure that RSASHA1 is not used for key-signing key in Cloud DNS DNSSEC (Not Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v1 > 3 Networking > 3.05 Ensure that RSASHA1 is not used for zone-signing key in Cloud DNS DNSSEC (Not Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v1 > 3 Networking > 3.06 Ensure that SSH access is restricted from the internet (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v1 > 3 Networking > 3.07 Ensure that RDP access is restricted from the internet (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

GCP > CIS v1 > 3 Networking > 3.08 Ensure Private Google Access is enabled for all subnetwork in VPC Network (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

GCP > CIS v1 > 3 Networking > 3.09 Ensure VPC Flow logs is enabled for every subnet in VPC Network (Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

GCP > CIS v1 > 4 Virtual Machines > 4.01 Ensure that instances are not configured to use the default service account with full access to all Cloud APIs (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

GCP > CIS v1 > 4 Virtual Machines > 4.02 Ensure "Block Project-wide SSH keys" enabled for VM instances (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 4 Virtual Machines > 4.03 Ensure oslogin is enabled for a Project (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 4 Virtual Machines > 4.04 Ensure 'Enable connecting to serial ports' is not enabled for VM Instance (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 4 Virtual Machines > 4.05 Ensure that IP forwarding is not enabled on Instances (Not Scored)

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

GCP > CIS v1 > 4 Virtual Machines > 4.06 Ensure VM disks for critical VMs are encrypted with Customer- Supplied Encryption Keys (CSEK) (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v1 > 5 Storage > 5.01 Ensure that Cloud Storage bucket is not anonymously or publicly accessible (Scored)

CIS > Controls v7 > 13 Data Protection

GCP > CIS v1 > 5 Storage > 5.02 Ensure that there are no publicly accessible objects in storage buckets (Not Scored)

CIS > Controls v7 > 12 Boundary Defense > 12.04 Deny Communication over Unauthorized Ports

GCP > CIS v1 > 5 Storage > 5.03 Ensure that logging is enabled for Cloud storage buckets (Scored)

CIS > Controls v7 > 12 Boundary Defense > 12.04 Deny Communication over Unauthorized Ports

GCP > CIS v1 > 6 Cloud SQL Database Services > 6.01 Ensure that Cloud SQL database instance requires all incoming connections to use SSL (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

GCP > CIS v1 > 6 Cloud SQL Database Services > 6.02 Ensure that Cloud SQL database Instances are not open to the world (Scored)

CIS > Controls v7 > 13 Data Protection

GCP > CIS v1 > 6 Cloud SQL Database Services > 6.03 Ensure that MySql database instance does not allow anyone to connect with administrative privileges. (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v1 > 6 Cloud SQL Database Services > 6.03 Ensure that MySql database instance does not allow anyone to connect with administrative privileges. (Scored) > Attestation

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.02 Change Default Passwords

GCP > CIS v1 > 6 Cloud SQL Database Services > 6.04 Ensure that MySQL Database Instance does not allows root login from any Host (Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.02 Change Default Passwords

GCP > CIS v1 > 7 Kubernetes Engine > 7.01 Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters (Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v1 > 7 Kubernetes Engine > 7.02 Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

GCP > CIS v1 > 7 Kubernetes Engine > 7.03 Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters (Scored)

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

GCP > CIS v1 > 7 Kubernetes Engine > 7.04 Ensure Master authorized networks is set to Enabled on Kubernetes Engine Clusters (Not Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 7 Kubernetes Engine > 7.05 Ensure Kubernetes Clusters are configured with Labels (Not Scored)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v1 > 7 Kubernetes Engine > 7.06 Ensure Kubernetes web UI / Dashboard is disabled (Scored)

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

GCP > CIS v1 > 7 Kubernetes Engine > 7.07 Ensure `Automatic node repair` is enabled for Kubernetes Clusters (Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

GCP > CIS v1 > 7 Kubernetes Engine > 7.08 Ensure Automatic node upgrades is enabled on Kubernetes Engine Clusters nodes (Scored)

CIS > Controls v7 > 01 Inventory and Control of Hardware Assets

GCP > CIS v1 > 7 Kubernetes Engine > 7.09 Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image (Not Scored)

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

GCP > CIS v1 > 7 Kubernetes Engine > 7.10 Ensure Basic Authentication is disabled on Kubernetes Engine Clusters (Scored)

CIS > Controls v7 > 03 Continuous Vulnerability Management > 3.04 Deploy Automated Operating System Patch Management Tools

GCP > CIS v1 > 7 Kubernetes Engine > 7.11 Ensure Network policy is enabled on Kubernetes Engine Clusters (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 7 Kubernetes Engine > 7.12 Ensure Kubernetes Cluster is created with Client Certificate enabled (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches

GCP > CIS v1 > 7 Kubernetes Engine > 7.13 Ensure Kubernetes Cluster is created with Alias IP ranges enabled (Scored)

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 7 Kubernetes Engine > 7.14 Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches

GCP > CIS v1 > 7 Kubernetes Engine > 7.15 Ensure Kubernetes Cluster is created with Private cluster enabled (Scored)

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

GCP > CIS v1 > 7 Kubernetes Engine > 7.17 Ensure default Service account is not used for Project access in Kubernetes Clusters (Scored)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches

GCP > CIS v1 > 7 Kubernetes Engine > 7.18 Ensure Kubernetes Clusters created with limited service account Access scopes for Project access (Scored)

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges

GCP > CIS v1 > 7 Kubernetes Engine > 7.18 Ensure Kubernetes Clusters created with limited service account Access scopes for Project access (Scored) > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 1 Identity and Access Management

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v1 > 2 Logging and Monitoring

CIS

GCP > CIS v1 > 3 Networking

CIS

GCP > CIS v1 > 4 Virtual Machines

CIS

CIS

GCP > CIS v1 > 5 Storage

GCP > CIS v1 > 6 Cloud SQL Database Services

CIS

GCP > CIS v1 > 7 Kubernetes Engine

CIS

GCP > CIS v2.0 > Maximum Attestation Duration

CIS

CIS

GCP > CIS v2.0

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.01 - Ensure that Corporate Login Credentials are Used

CIS

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.01 - Ensure that Corporate Login Credentials are Used > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.02 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.02 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.03 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.03 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.04 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account

CIS > Controls v7 > 16 Account Monitoring and Control > 16.03 Require Multi-factor Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.05 - Ensure That Service Account Has No Admin Privileges

CIS > Controls v7 > 16 Account Monitoring and Control

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.06 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.03 Ensure the Use of Dedicated Administrative Accounts

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.07 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.08 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.09 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.10 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.11 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.12 - Ensure API Keys Only Exist for Active Services

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps

CIS > Controls v7 > 16 Account Monitoring and Control > 16.08 Disable Any Unassociated Accounts

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access

Other

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Rotated Every 90 Days

Other

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.16 - Ensure Essential Contacts is Configured for Organization

Other

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.16 - Ensure Essential Contacts is Configured for Organization > Attestation

CIS > Controls v7 > 19 Incident Response and Management > 19.05 Maintain Contact Information For Reporting Security Incidents

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.17 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key

CIS > Controls v7 > 19 Incident Response and Management > 19.05 Maintain Contact Information For Reporting Security Incidents

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

GCP > CIS v2.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager > Attestation

CIS > Controls v7 > 16 Account Monitoring and Control > 16.04 Encrypt or Hash all Authentication Credentials

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.01 - Ensure That Cloud Audit Logging Is Configured Properly

CIS > Controls v7 > 16 Account Monitoring and Control > 16.04 Encrypt or Hash all Authentication Credentials

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.02 - Ensure That Sinks Are Configured for All Log Entries

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.07 Regularly Review Logs

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.04 Ensure Adequate Storage for Logs

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.04 - Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.05 - Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.06 - Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.07 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.08 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.09 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.10 - Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.11 - Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.12 - Ensure That Cloud DNS Logging Is Enabled for All VPC Networks

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.13 - Ensure Cloud Asset Inventory Is Enabled

CIS > Controls v7 > 08 Malware Defenses > 8.07 Enable DNS Query Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.14 - Ensure 'Access Transparency' is 'Enabled'

CIS > Controls v7 > 16 Account Monitoring and Control > 16.01 Maintain an Inventory of Authentication Systems

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.14 - Ensure 'Access Transparency' is 'Enabled' > Attestation

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Approval' is 'Enabled'

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 2 - Logging and Monitoring > 2.16 - Ensure Logging is enabled for HTTP(S) Load Balancer

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 3 - Networking > 3.01 - Ensure That the Default Network Does Not Exist in a Project

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.02 Activate Audit Logging

GCP > CIS v2.0 > 3 - Networking > 3.02 - Ensure Legacy Networks Do Not Exist for Older Projects

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v2.0 > 3 - Networking > 3.03 - Ensure That DNSSEC Is Enabled for Cloud DNS

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v2.0 > 3 - Networking > 3.04 - Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v2.0 > 3 - Networking > 3.05 - Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v2.0 > 3 - Networking > 3.06 - Ensure That SSH Access Is Restricted From the Internet

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v2.0 > 3 - Networking > 3.07 - Ensure That RDP Access Is Restricted From the Internet

CIS > Controls v7 > 12 Boundary Defense > 12.04 Deny Communication over Unauthorized Ports

GCP > CIS v2.0 > 3 - Networking > 3.08 - Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network

CIS > Controls v7 > 12 Boundary Defense > 12.04 Deny Communication over Unauthorized Ports

GCP > CIS v2.0 > 3 - Networking > 3.09 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites

CIS > Controls v7 > 12 Boundary Defense > 12.08 Deploy NetFlow Collection on Networking Boundary Devices

GCP > CIS v2.0 > 3 - Networking > 3.10 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.04 Encrypt All Sensitive Information in Transit

GCP > CIS v2.0 > 4 - Virtual Machines > 4.01 - Ensure That Instances Are Not Configured To Use the Default Service Account

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

GCP > CIS v2.0 > 4 - Virtual Machines > 4.02 - Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.07 Limit Access to Scripting Tools

GCP > CIS v2.0 > 4 - Virtual Machines > 4.03 - Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.07 Limit Access to Scripting Tools

GCP > CIS v2.0 > 4 - Virtual Machines > 4.04 - Ensure Oslogin Is Enabled for a Project

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.04 Use Unique Passwords

GCP > CIS v2.0 > 4 - Virtual Machines > 4.05 - Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance

CIS > Controls v7 > 16 Account Monitoring and Control > 16.02 Configure Centralized Point of Authentication

GCP > CIS v2.0 > 4 - Virtual Machines > 4.06 - Ensure That IP Forwarding Is Not Enabled on Instances

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

GCP > CIS v2.0 > 4 - Virtual Machines > 4.07 - Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)

CIS > Controls v7 > 11 Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches > 11.01 Maintain Standard Security Configurations for Network Devices

GCP > CIS v2.0 > 4 - Virtual Machines > 4.08 - Ensure Compute Instances Are Launched With Shielded VM Enabled

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

GCP > CIS v2.0 > 4 - Virtual Machines > 4.09 - Ensure That Compute Instances Do Not Have Public IP Addresses

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.02 Maintain Secure Images

GCP > CIS v2.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections > Attestation

CIS > Controls v7 > 18 Application Software Security > 18.05 Only Standardized and Extensively Reviewed Encryption Algorithms

GCP > CIS v2.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled

CIS > Controls v7 > 18 Application Software Security > 18.05 Only Standardized and Extensively Reviewed Encryption Algorithms

GCP > CIS v2.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

GCP > CIS v2.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects > Attestation

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

GCP > CIS v2.0 > 5 - Storage > 5.01 - Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.02 Ensure Software is Supported by Vendor

GCP > CIS v2.0 > 5 - Storage > 5.02 - Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled

CIS > Controls v7 > 12 Boundary Defense > 12.04 Deny Communication over Unauthorized Ports

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Database Instance Does Not Allow Anyone To Connect With Administrative Privileges

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Database Instance Does Not Allow Anyone To Connect With Administrative Privileges > Attestation

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.02 Change Default Passwords

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.02 - Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'

CIS > Controls v7 > 04 Controlled Use of Administrative Privileges > 4.02 Change Default Passwords

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.03 - Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.01 - Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.02 - Ensure 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.03 - Ensure 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.05 - Ensure 'Log_min_messages' Database Flag for Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.06 - Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.07 - Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1'

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.08 - Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.03 Enable Detailed Logging

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.09 - Ensure Instance IP assignment is set to private

CIS > Controls v7 > 06 Maintenance, Monitoring, and Analysis of Audit Logs > 6.05 Central Log Management

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.01 - Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.05 Implement Application Firewalls

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.02 - Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'

CIS > Controls v7 > 02 Inventory and Control of Software Assets > 2.09 Implement Application Whitelisting of Scripts

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.03 - Ensure 'user Connections' Database Flag for Cloud Sql Sql Server Instance Is Set to a Non-limiting Value

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.04 - Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.05 - Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.06 - Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'

CIS > Controls v7 > 09 Limitation and Control of Network Ports, Protocols, and Services > 9.02 Ensure Only Approved Ports, Protocols and Services Are Running

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.07 - Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'

CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.04 - Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.05 - Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses

CIS > Controls v7 > 16 Account Monitoring and Control > 16.05 Encrypt Transmittal of Username and Authentication Credentials

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.06 - Ensure That Cloud SQL Database Instances Do Not Have Public IPs

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.07 - Ensure That Cloud SQL Database Instances Are Configured With Automated Backups

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 7 - BigQuery > 7.01 - Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible

CIS > Controls v7 > 10 Data Recovery Capabilities > 10.01 Ensure Regular Automated Back Ups

GCP > CIS v2.0 > 7 - BigQuery > 7.02 - Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.06 Protect Information through Access Control Lists

GCP > CIS v2.0 > 7 - BigQuery > 7.03 - Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

GCP > CIS v2.0 > 1 - Identity and Access Management

CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.08 Encrypt Sensitive Information at Rest

GCP > CIS v2.0 > 1 - Identity and Access Management > Maximum Attestation Duration

CIS

GCP > CIS v2.0 > 2 - Logging and Monitoring

CIS

GCP > CIS v2.0 > 2 - Logging and Monitoring > Maximum Attestation Duration

CIS

GCP > CIS v2.0 > 3 - Networking

CIS

GCP > CIS v2.0 > 4 - Virtual Machines

CIS

GCP > CIS v2.0 > 4 - Virtual Machines > Maximum Attestation Duration

CIS

GCP > CIS v2.0 > 5 - Storage

CIS

GCP > CIS v2.0 > 6 - Cloud SQL Database Services

CIS

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database

CIS

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database

CIS

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server

CIS

GCP > CIS v2.0 > 6 - Cloud SQL Database Services > Maximum Attestation Duration

CIS

GCP > CIS v2.0 > 7 - BigQuery

CIS

GCP > Composer > API Enabled

CIS

GCP > Composer > Approved Regions [Default]

Resource > API Enabled

Resource > Approved

GCP > Composer > CMDB

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-composer

CMDB

Resource > Configured

GCP > Composer > Enabled

GCP > Composer > Labels Template [Default]

IAM > Permissions

GCP > Composer > Permissions

Resource > Tags

GCP > Composer > Permissions > Levels

IAM > Permissions

GCP > Composer > Permissions > Levels > Modifiers

IAM > Permissions

IAM > Permissions

GCP > Composer > Regions

GCP > Composer > Environment > Active

Cloud > Location

GCP > Composer > Environment > Active > Age

Resource > Active

GCP > Composer > Environment > Active > Last Modified

Resource > Active

GCP > Composer > Environment > Approved

Resource > Active

GCP > Composer > Environment > Approved > Custom

Resource > Approved

GCP > Composer > Environment > Approved > Regions

Resource > Approved

GCP > Composer > Environment > Approved > Usage

Resource > Approved

GCP > Composer > Environment > CMDB

Resource > Approved

GCP > Composer > Environment > Labels

CMDB

GCP > Composer > Environment > Labels > Template

Resource > Tags

GCP > Composer > Environment > Regions

Resource > Tags

GCP > Composer > Environment > Usage

Cloud > Location

GCP > Composer > Environment > Usage > Limit

Resource > Usage

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-composer

Resource > Usage

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-composer

IAM > Permissions

GCP > Compute Engine > API Enabled

IAM > Permissions

GCP > Compute Engine > Approved Regions [Default]

Resource > API Enabled

GCP > Compute Engine > CMDB

Resource > Approved

GCP > Compute Engine > Enabled

CMDB

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-computeengine

IAM > Permissions

GCP > Compute Engine > Labels Template [Default]

Resource > Configured

GCP > Compute Engine > Permissions

Resource > Tags

GCP > Compute Engine > Permissions > Levels

IAM > Permissions

GCP > Compute Engine > Permissions > Levels > Autoscaler Administration

IAM > Permissions

GCP > Compute Engine > Permissions > Levels > Image Administration

IAM > Permissions

GCP > Compute Engine > Permissions > Levels > Modifiers

IAM > Permissions

GCP > Compute Engine > Regions

IAM > Permissions

GCP > Compute Engine > Trusted Domains [Default]

Cloud > Location

GCP > Compute Engine > Trusted Groups [Default]

Security > Trusted Access

GCP > Compute Engine > Trusted Service Accounts [Default]

Security > Trusted Access

GCP > Compute Engine > Trusted Users [Default]

Security > Trusted Access

GCP > Compute Engine > Project > CMDB

Security > Trusted Access

GCP > Compute Engine > Disk > Active

CMDB

GCP > Compute Engine > Disk > Active > Age

Resource > Active

GCP > Compute Engine > Disk > Active > Attached

Resource > Active

GCP > Compute Engine > Disk > Active > Last Modified

Resource > Active

GCP > Compute Engine > Disk > Approved

Resource > Active

GCP > Compute Engine > Disk > Approved > Custom

Resource > Approved

GCP > Compute Engine > Disk > Approved > Encryption at Rest

Resource > Approved

GCP > Compute Engine > Disk > Approved > Encryption at Rest > Customer Managed Key

Resource > Approved

GCP > Compute Engine > Disk > Approved > Regions

Resource > Approved

GCP > Compute Engine > Disk > Approved > Usage

Resource > Approved

GCP > Compute Engine > Disk > CMDB

Resource > Approved

GCP > Compute Engine > Disk > Data Protection

CMDB

GCP > Compute Engine > Disk > Data Protection > Managed Snapshots > Location

Resource > Data Protection

GCP > Compute Engine > Disk > Data Protection > Managed Snapshots

Resource > Data Protection

GCP > Compute Engine > Disk > Data Protection > Managed Snapshots > Minimum Schedule

Resource > Data Protection

GCP > Compute Engine > Disk > Data Protection > Managed Snapshots > Name Prefix

Resource > Data Protection