Skip to content

Google Cloud configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Google Cloud, Black Cat runs 45 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Google Cloud connector needs.

Checks (45)

severity: critical Public Firewall Rule fix difficulty: medium #

Restrict GCP firewall rules to specific IP ranges instead of allowing 0.0.0.0/0 ingress

  1. Navigate to GCP Console > VPC Network > Firewall
  2. Identify firewall rules allowing 0.0.0.0/0 ingress
  3. Restrict source ranges to specific IP addresses or CIDR blocks
  4. Test network connectivity after tightening the rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-13.4 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical Firewall Rule Exposes Dangerous Port fix difficulty: medium #

Restrict source ranges for firewall rules exposing SSH, RDP, or database ports to 0.0.0.0/0

  1. Navigate to GCP Console > VPC Network > Firewall
  2. Identify the flagged rule that exposes dangerous ports (22, 3389, 3306, 5432, 1433, 27017, 6379, 9200)
  3. Change source ranges to specific corporate IPs, a VPN range, or use IAP TCP forwarding for SSH
  4. Consider replacing direct access with Cloud IAP for administrative services
  5. Click Save and verify the rule is now restricted

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Firewall Rule Egress Open to World fix difficulty: medium #

Restrict egress firewall destinations to prevent data exfiltration

  1. Navigate to GCP Console > VPC Network > Firewall
  2. Identify the flagged egress rule with destination 0.0.0.0/0
  3. Determine which destinations the workload actually needs
  4. Update the destination ranges to specific CIDR blocks, VPC endpoints, or Google service ranges
  5. Save and verify workloads still reach their required services

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Bucket Versioning Disabled fix difficulty: easy #

Enable object versioning on GCP Storage buckets to protect against accidental deletion

  1. Navigate to GCP Console > Cloud Storage > Buckets
  2. Select the bucket without versioning
  3. Click Edit bucket and enable Object Versioning
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Security Contact Missing fix difficulty: easy #

Add a security notification contact to GCP Essential Contacts for the project

  1. Navigate to GCP Console > Essential Contacts
  2. Click Add Essential Contact
  3. Add a security notification category contact with a monitored email address
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC2.1 CIS Controls v8 CIS-04.6 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Essential Contacts Coverage Incomplete fix difficulty: easy #

Add essential contacts for TECHNICAL_INCIDENTS, LEGAL, and BILLING notifications

  1. Navigate to GCP Console > Essential Contacts
  2. Click "Add essential contact"
  3. Add contacts for each missing notification category (Technical Incidents, Legal, Billing)
  4. Use monitored distribution lists rather than individual accounts where possible
  5. Save each contact and verify the category subscriptions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Instance Serial Port Enabled fix difficulty: easy #

Disable serial port access on Compute Engine instances to prevent unauthorized interactive access (CIS GCP 4.5)

  1. Navigate to GCP Console > Compute Engine > VM Instances
  2. Select the flagged instance and click Edit
  3. Under Remote access, uncheck Enable connecting to serial ports
  4. Save changes
  5. Alternatively enforce via GCP Org Policy constraints/compute.disableSerialPortAccess

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Shielded VM Disabled fix difficulty: easy #

Enable Shielded VM (vTPM and integrity monitoring) on Compute Engine instances to protect against boot-level threats

  1. Navigate to GCP Console > Compute Engine > VM Instances
  2. Select the flagged instance and stop it
  3. Click Edit and expand the Shielded VM section
  4. Enable Turn on vTPM and Turn on Integrity Monitoring
  5. Save changes and start the instance

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Default VPC In Use fix difficulty: hard #

Replace the default VPC network with a custom VPC to enforce explicit network segmentation (CIS GCP 3.1)

  1. Navigate to GCP Console > VPC Network > VPC Networks
  2. Create a new custom-mode VPC network with subnets sized for your workloads
  3. Migrate existing resources (Compute Engine instances, GKE clusters) to the new VPC
  4. Delete the default VPC network once all resources have been migrated

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Cloud SQL Instance Has Public IP fix difficulty: medium #

Configure Cloud SQL instances to use private IP only to avoid direct internet exposure (CIS GCP 6.6)

  1. Navigate to GCP Console > SQL > Instances and select the flagged instance
  2. Click Edit, then open the Connections section
  3. Under Instance IP assignment, uncheck Public IP
  4. Ensure a Private IP with a valid VPC network is configured
  5. Save changes and restart the instance if required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Cloud SQL SSL Not Required fix difficulty: easy #

Require SSL/TLS for all connections to Cloud SQL instances to protect data in transit (CIS GCP 6.4)

  1. Navigate to GCP Console > SQL > Instances and select the flagged instance
  2. Click Edit, then open the Connections section
  3. Under Security, enable Require SSL
  4. Download and distribute the server CA certificate to all clients
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium MySQL skip_show_database Not Enabled fix difficulty: easy #

Set the skip_show_database database flag to on to restrict SHOW DATABASES to privileged users (CIS GCP 6.1.2)

  1. Navigate to GCP Console > SQL > Instances and select the MySQL instance
  2. Click Edit, then open the Flags section
  3. Add or update the skip_show_database flag to on
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.1 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium MySQL local_infile Enabled fix difficulty: easy #

Set the local_infile database flag to off to prevent loading local files (CIS GCP 6.1.3)

  1. Navigate to GCP Console > SQL > Instances and select the MySQL instance
  2. Click Edit, then open the Flags section
  3. Add or update the local_infile flag to off
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.1 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Cloud SQL Backup Not Enabled fix difficulty: easy #

Enable automated backups on Cloud SQL instances to ensure data recovery capability (CIS GCP 6.7)

  1. Navigate to GCP Console > SQL > Instances and select the flagged instance
  2. Click Edit, then open the Backups section
  3. Enable Automated backups and set an appropriate backup window
  4. Optionally enable Point-in-time recovery for finer-grained restore
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Cloud KMS Key Rotation Period Exceeds 90 Days fix difficulty: easy #

Configure Cloud KMS key rotation to occur at least every 90 days — CIS GCP 1.10

  1. Navigate to GCP Console > Security > Key Management
  2. Select the flagged crypto key
  3. Click Edit and update the rotation period to 90 days or fewer
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC7.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Cloud KMS Encryption Key Has No Rotation Schedule fix difficulty: easy #

Enable automatic key rotation on Cloud KMS ENCRYPT_DECRYPT keys — CIS GCP 1.10

  1. Navigate to GCP Console > Security > Key Management
  2. Select the flagged crypto key
  3. Click Edit and set a rotation period of 90 days or fewer
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC7.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Cloud KMS Key Primary Version Not Active fix difficulty: medium #

Ensure Cloud KMS crypto keys have an active primary key version to prevent encryption failures

  1. Navigate to GCP Console > Security > Key Management
  2. Select the flagged crypto key and review the primary key version status
  3. If DISABLED, re-enable the primary version
  4. If DESTROYED or DESTROY_SCHEDULED, create a new key version and set it as primary
  5. Update all applications to use the new primary key version

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC7.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Cloud KMS Key Uses Software Protection Level fix difficulty: hard #

Migrate Cloud KMS keys to HSM protection level for hardware-backed key security

  1. Navigate to GCP Console > Security > Key Management
  2. Create a new key ring or key with HSM protection level
  3. Re-encrypt data with the new HSM-backed key
  4. Update application references to use the new key
  5. Disable and schedule destruction of the old SOFTWARE-protection key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC7.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Secret Manager Secret Has No Rotation fix difficulty: medium #

Enable automatic rotation for Secret Manager secrets to reduce the risk of long-lived credentials

  1. Navigate to GCP Console > Security > Secret Manager
  2. Select the flagged secret and click Edit
  3. Enable automatic rotation and configure a rotation schedule
  4. Ensure a rotation function (Cloud Functions or Cloud Run) is set up to handle rotation events
  5. Save changes and verify the first rotation completes successfully

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC7.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Secret Manager Secret Has No Versioning fix difficulty: easy #

Ensure Secret Manager secrets have at least 2 versions to confirm rotation is occurring

  1. Navigate to GCP Console > Security > Secret Manager
  2. Select the flagged secret
  3. Add a new secret version with the rotated credential value
  4. Update dependent applications to use the latest version
  5. Disable the old version once the new version is confirmed working

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC7.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high GKE Network Policy Disabled fix difficulty: medium #

Enable network policy enforcement on GKE clusters to control pod-to-pod traffic (CIS GKE 6.6.7)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Networking, enable Network policy
  4. Save changes — this may restart nodes in a rolling update
  5. Deploy Kubernetes NetworkPolicy resources to define allowed traffic between pods

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high GKE Private Cluster Disabled fix difficulty: hard #

Create a new private GKE cluster with private nodes to prevent direct internet exposure (CIS GKE 6.6.2)

  1. Note that enabling private nodes requires cluster recreation — it cannot be changed on an existing cluster
  2. Create a new GKE cluster with Enable private nodes selected under Networking
  3. Configure a private endpoint or master authorized networks to allow cluster management access
  4. Migrate workloads to the new private cluster
  5. Delete the old non-private cluster

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium GKE Shielded Nodes Disabled fix difficulty: easy #

Enable Shielded Nodes on the GKE cluster to protect node integrity against boot-level attacks (CIS GKE 6.5.5)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Security, enable Shielded nodes
  4. Save changes — nodes will be recreated in a rolling update

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium GKE Release Channel Not Set fix difficulty: easy #

Enroll the GKE cluster in the REGULAR or STABLE release channel to receive automatic Kubernetes security updates (CIS GKE 6.5.3)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Release channel, select REGULAR or STABLE
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium GKE Binary Authorization Disabled fix difficulty: medium #

Enable Binary Authorization on the GKE cluster to enforce image provenance policies (CIS GKE 6.10.2)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Security, enable Binary Authorization
  4. Save changes
  5. Configure a Binary Authorization policy in Security > Binary Authorization to define which images are allowed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium GKE Database Encryption Disabled fix difficulty: medium #

Enable application-layer secrets encryption on the GKE cluster using a Cloud KMS key (CIS GKE 6.3.1)

  1. Navigate to GCP Console > Security > Key Management and create or select an existing KMS key
  2. Grant the GKE service account the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key
  3. Navigate to GCP Console > Kubernetes Engine > Clusters
  4. Select the flagged cluster and click Edit
  5. Under Security, enable Application-layer secrets encryption and select the KMS key
  6. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low GKE Intranode Visibility Disabled fix difficulty: easy #

Enable intranode visibility on the GKE cluster to expose pod-to-pod traffic to VPC flow logs

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Networking, enable Intranode visibility
  4. Save changes — nodes will be recreated in a rolling update
  5. Ensure VPC flow logs are enabled on the cluster subnetwork to capture the traffic

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC7.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high GKE Logging Disabled fix difficulty: easy #

Enable Cloud Logging on the GKE cluster to capture audit and system logs (CIS GKE 6.7.1)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Features, set Cloud Logging to System and workloads
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high GKE Node Pool Auto-Upgrade Disabled fix difficulty: easy #

Enable automatic node upgrades on GKE node pools to ensure nodes receive security patches (CIS GKE 6.5.1)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the cluster containing the flagged node pool
  3. Click the node pool name, then click Edit
  4. Under Management, enable Automatic node upgrades
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC8.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Cloud Logging Sink Missing fix difficulty: medium #

Create an enabled Cloud Logging sink with an empty filter to export all log entries (CIS 2.2)

  1. Navigate to GCP Console > Logging > Log Router
  2. Click Create Sink
  3. Name the sink and select a destination (Cloud Storage, BigQuery, or Pub/Sub)
  4. Leave the inclusion filter empty to capture all logs
  5. Ensure the sink is enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Log Metric for Project Ownership Missing fix difficulty: medium #

Create a log-based metric to track project ownership assignment changes (CIS 2.4)

  1. Navigate to GCP Console > Logging > Log-based Metrics
  2. Click Create Metric
  3. Set the metric name to project-ownership-assignments
  4. Set the filter to track protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND ProjectOwnership changes
  5. Save the metric

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Log Metric for Audit Config Changes Missing fix difficulty: medium #

Create a log-based metric to track audit configuration changes (CIS 2.5)

  1. Navigate to GCP Console > Logging > Log-based Metrics
  2. Click Create Metric
  3. Set the metric name to audit-config-changes
  4. Set the filter to track protoPayload.methodName="SetIamPolicy" with audit config changes
  5. Save the metric

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Log Metric for Custom Role Changes Missing fix difficulty: medium #

Create a log-based metric to track custom IAM role changes (CIS 2.6)

  1. Navigate to GCP Console > Logging > Log-based Metrics
  2. Click Create Metric
  3. Set the metric name to custom-role-changes
  4. Set the filter to track protoPayload.serviceName="iam.googleapis.com" AND custom role mutations
  5. Save the metric

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Alert Policy Disabled fix difficulty: easy #

Enable the disabled alert policy to ensure monitoring coverage

  1. Navigate to GCP Console > Monitoring > Alerting
  2. Locate the flagged alert policy
  3. Click Edit and toggle the Enabled switch on
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.AE NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Alert Policy Has No Notification Channels fix difficulty: easy #

Add notification channels to the alert policy so incidents are delivered to responders

  1. Navigate to GCP Console > Monitoring > Alerting
  2. Click Edit on the flagged alert policy
  3. Under Notifications, add at least one notification channel (email, Slack, PagerDuty, etc.)
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.AE NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Log Metric Project Ownership Alert Missing fix difficulty: medium #

Create an alert policy for the project-ownership-assignments log metric with notification channels (CIS 2.4)

  1. Navigate to GCP Console > Monitoring > Alerting
  2. Click Create Policy
  3. Add a condition using the log-based metric logging/user/project-ownership-assignments
  4. Set a threshold of > 0 with a 1-minute window
  5. Add at least one notification channel
  6. Save the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.AE NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Log Metric Audit Config Alert Missing fix difficulty: medium #

Create an alert policy for the audit-config-changes log metric with notification channels (CIS 2.5)

  1. Navigate to GCP Console > Monitoring > Alerting
  2. Click Create Policy
  3. Add a condition using the log-based metric logging/user/audit-config-changes
  4. Set a threshold of > 0 with a 1-minute window
  5. Add at least one notification channel
  6. Save the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.AE NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Log Metric Custom Role Alert Missing fix difficulty: medium #

Create an alert policy for the custom-role-changes log metric with notification channels (CIS 2.6)

  1. Navigate to GCP Console > Monitoring > Alerting
  2. Click Create Policy
  3. Add a condition using the log-based metric logging/user/custom-role-changes
  4. Set a threshold of > 0 with a 1-minute window
  5. Add at least one notification channel
  6. Save the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.AE NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high DNS DNSSEC Disabled fix difficulty: medium #

Enable DNSSEC on the public DNS managed zone to protect against DNS spoofing (CIS 3.3)

  1. Navigate to GCP Console > Network Services > Cloud DNS
  2. Select the flagged managed zone
  3. Click DNSSEC and set the state to On
  4. Save changes and update DS records at your domain registrar

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.6 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium DNS DNSSEC RSASHA1 Key-Signing Key fix difficulty: hard #

Replace the RSASHA1 key-signing algorithm with a stronger algorithm such as RSASHA256 or ECDSAP256SHA256 (CIS 3.4)

  1. Navigate to GCP Console > Network Services > Cloud DNS
  2. Select the flagged managed zone
  3. Disable DNSSEC temporarily, then re-enable with a stronger key-signing algorithm
  4. Update DS records at your domain registrar with the new key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.6 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium DNS DNSSEC RSASHA1 Zone-Signing Key fix difficulty: hard #

Replace the RSASHA1 zone-signing algorithm with a stronger algorithm such as RSASHA256 or ECDSAP256SHA256 (CIS 3.5)

  1. Navigate to GCP Console > Network Services > Cloud DNS
  2. Select the flagged managed zone
  3. Disable DNSSEC temporarily, then re-enable with a stronger zone-signing algorithm
  4. Update DS records at your domain registrar with the new key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.6 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium DNS Logging Disabled fix difficulty: easy #

Enable DNS query logging on the managed zone for audit and security monitoring (CIS 2.12)

  1. Navigate to GCP Console > Network Services > Cloud DNS
  2. Select the flagged managed zone
  3. Click Edit, then enable Cloud Logging
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No IAM Deny Policy Configured fix difficulty: medium #

Configure an IAM deny policy to establish a baseline block on sensitive permissions

  1. Navigate to GCP Console > IAM & Admin > Deny Policies
  2. Create a deny policy at the project, folder, or organization level
  3. Add rules denying sensitive permissions such as service account key creation
  4. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium IAM Deny Policy Does Not Cover Service Account Key Creation fix difficulty: medium #

Add or adjust an IAM deny rule to unconditionally block service account key creation

  1. Navigate to GCP Console > IAM & Admin > Deny Policies
  2. Open an existing deny policy or create a new one
  3. Add a rule denying iam.googleapis.com/serviceAccountKeys.create for all principals, with no exceptions or conditions
  4. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium IAM Deny Policy Has Overly Broad Exception Principals fix difficulty: medium #

Narrow the exception principals on an IAM deny rule so they do not nullify the denial

  1. Navigate to GCP Console > IAM & Admin > Deny Policies
  2. Open the flagged deny policy and locate the rule with broad exception principals
  3. Replace the broad exception (public:all or a customer-wide identity) with specific, justified principals
  4. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Google Cloud checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial