How do you continuously monitor Google Cloud for SOC 2, ISO 27001, and HIPAA?

IAM Audit Logs Enabled

Without audit logging there is little visibility into who accessed data or changed configuration, which hinders detection and forensics. An auditor verifies Cloud Audit Logs capture admin and data-access events.

Service Accounts Have No Admin Privileges

Over-privileged service accounts let a single compromise read, alter, or delete broad resources. An auditor checks that service accounts do not hold Owner, Editor, or admin roles at the project level.

No User-Managed Service Account Keys

User-managed keys are downloadable and long-lived, so a leaked key lets an attacker impersonate the service account. An auditor verifies service accounts have no user-managed keys.

Cloud SQL No Public Access

Authorizing 0.0.0.0/0 makes the database reachable from the internet for brute force and unauthorized queries. An auditor confirms Cloud SQL instances are not publicly accessible.

Cloud SQL SSL Required

Without enforced TLS, database traffic can be intercepted or altered on untrusted networks. An auditor verifies Cloud SQL requires SSL connections.

Cloud SQL Automated Backups

Without automated backups, deletes, corruption, or ransomware can become irreversible with no point-in-time recovery. An auditor checks that automated backups are enabled.

Firewall SSH/RDP from Internet

A firewall rule opening SSH or RDP to 0.0.0.0/0 exposes admin ports to internet-wide brute force. An auditor verifies these ports are not open to the internet.

Compute Instances Without Public IP

An external IP puts a VM directly on the internet where it can be scanned and attacked. An auditor confirms compute instances do not carry public IP addresses.

Storage Bucket Public Access

A public bucket lets anyone list or download objects, and write access allows tampering. An auditor verifies buckets do not grant access to allUsers or allAuthenticatedUsers.

KMS Key Rotation Enabled

Without rotation, a compromised key can decrypt data and backups for longer and widen the blast radius. An auditor checks that KMS crypto keys have rotation configured.

Log Sinks Created

Without a log sink, audit evidence can expire or be altered in-project, which hinders detection and forensics. An auditor verifies at least one sink exports logs to durable storage.

BigQuery datasets use customer-managed encryption keys

With Google-managed keys you lose control of key rotation and revocation for data at rest. An auditor confirms BigQuery datasets use customer-managed encryption keys.

Cloud Storage bucket retention policy is locked

Without a locked retention policy, exported logs can be deleted early or shortened to hide activity. An auditor verifies log buckets have a retention period with Bucket Lock applied.

Cloud Storage uniform bucket-level access enabled

Without uniform access, object ACLs can bypass bucket IAM and grant unintended public reads. An auditor checks that uniform bucket-level access is enabled.

Compute instances have confidential computing enabled

Without confidential computing, data in memory can be exposed through host or hypervisor compromise. An auditor verifies Confidential VM is enabled on instances.

Compute instance disks use Customer-Supplied Encryption Keys

With provider-managed keys you cannot control the key lifecycle or revoke access quickly. An auditor confirms instance disks use customer-supplied encryption keys.

Subnetworks have VPC Flow Logs enabled

Without flow logs, network activity lacks visibility, which enables covert exfiltration and undetected lateral movement. An auditor verifies flow logs are enabled at the subnet scope.

DNS managed zones have DNSSEC enabled

Without DNSSEC, DNS responses can be spoofed to redirect users to attacker hosts. An auditor checks that managed zones have DNSSEC enabled.

Container vulnerability scanning enabled

Without image scanning, vulnerable packages can reach production and enable remote code execution or supply chain compromise. An auditor verifies container vulnerability scanning is enabled.

Cloud SQL Deletion Protection

Without deletion protection, a single mistake or errant script can permanently destroy a production database and its recovery window. An auditor confirms deletion protection is enabled on each instance.

Security Command Center enabled

Without a central detection surface, misconfigurations and active threats across projects can persist undetected. An auditor verifies Security Command Center is enabled for the organization.

Cloud Storage Bucket Object Versioning Enabled

Without versioning or retention, a single overwrite or delete permanently destroys the prior object with no recovery path. An auditor checks that buckets enable object versioning or a retention policy.