CIS Google Cloud Platform Foundations Benchmark and connectors
Which connectors provide evidence for CIS Google Cloud Platform Foundations Benchmark, for which controls, and how to connect them.
Safeguard's automated tests map to 61 recommendations of CIS Google Cloud Platform Foundations Benchmark v3.0.0. 49 tests apply: 49 read a connected system, and 0 read Safeguard's own records (policies, people, training and devices), so they need no connector. A passing result is evidence toward a control, not proof that the control is met on its own.
A CIS benchmark is a catalogue mapping: results show on the tests, filters and evidence with their recommendation numbers, and the benchmark is not a framework in your library.
How to connect for this framework
- Connect the systems you run from the table below. Each connector links to its setup steps.
- Open Compliance › Tests and filter by the benchmark to see its results.
- Tests run on their schedule, or straight away with Run now on Compliance › Tests. A passing test counts toward its controls once its preview period has ended.
Automated tests are switched on per workspace by the Safeguard team.
Connectors with automated evidence (1)
| Connector | Controls it provides evidence for | Tests |
|---|---|---|
| Google Cloud Platform | 1.1, 1.11, 1.13, 1.14, 1.15, 1.16, 1.4, 1.5, 1.6, 1.8, 1.9, 2.10, 2.11, 2.12, 2.13, 2.15, 2.16, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.1, 3.2, 3.3, 3.4, 3.5, 3.9, 4.1, 4.11, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 6.1.2, 6.1.3, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4, 7.1, 7.3 | 49 |
Recommendations (61)
| Recommendation | Title | Automated tests | Connectors |
|---|---|---|---|
1.1 | Only corporate accounts are granted access | 1 | 1 |
1.4 | Service accounts use only Google-managed keys | 1 | 1 |
1.5 | Service accounts hold no admin roles | 1 | 1 |
1.6 | Service account impersonation is not granted project-wide | 1 | 1 |
1.8 | Service account duties are separated | 1 | 1 |
1.9 | KMS keys are not public | 1 | 1 |
1.11 | KMS duties are separated | 1 | 1 |
1.13 | API keys are limited to named hosts and apps | 1 | 1 |
1.14 | API keys are limited to the APIs they need | 1 | 1 |
1.15 | API keys are replaced every 90 days | 1 | 1 |
1.16 | Essential contacts are configured | 1 | 1 |
2.2 | A sink exports every log entry | 1 | 1 |
2.3 | Log buckets have locked retention | 1 | 1 |
2.4 | Project ownership changes are alerted on | 1 | 1 |
2.5 | Audit configuration changes are alerted on | 1 | 1 |
2.6 | Custom role changes are alerted on | 1 | 1 |
2.7 | Firewall rule changes are alerted on | 1 | 1 |
2.8 | Route changes are alerted on | 1 | 1 |
2.9 | VPC network changes are alerted on | 1 | 1 |
2.10 | Storage IAM changes are alerted on | 1 | 1 |
2.11 | Cloud SQL configuration changes are alerted on | 1 | 1 |
2.12 | Cloud DNS logging covers every VPC | 1 | 1 |
2.13 | Cloud Asset Inventory is on | 1 | 1 |
2.15 | Access Approval is enrolled | 1 | 1 |
2.16 | HTTP(S) load balancers log requests | 1 | 1 |
3.1 | No default network | 1 | 1 |
3.2 | No legacy networks | 1 | 1 |
3.3 | DNSSEC is on for Cloud DNS | 1 | 1 |
3.4 | DNSSEC key-signing keys avoid RSASHA1 | 1 | 1 |
3.5 | DNSSEC zone-signing keys avoid RSASHA1 | 1 | 1 |
3.9 | TLS policies exclude weak ciphers | 1 | 1 |
4.1 | VMs avoid the default service account | 1 | 1 |
4.2 | VMs avoid the default account with full API access | 1 | 1 |
4.3 | VMs block project-wide SSH keys | 1 | 1 |
4.4 | OS Login is on | 1 | 1 |
4.5 | Serial port access is off | 1 | 1 |
4.6 | IP forwarding is off | 1 | 1 |
4.7 | Critical VM disks use customer-controlled keys | 1 | 1 |
4.8 | Shielded VM is on | 1 | 1 |
4.9 | VMs have no public IP | 1 | 1 |
4.11 | VMs use Confidential Computing | 1 | 1 |
6.1.2 | MySQL hides other databases | 1 | 1 |
6.1.3 | MySQL local_infile is off | 1 | 1 |
6.2.1 | PostgreSQL error verbosity is DEFAULT or stricter | 1 | 1 |
6.2.2 | PostgreSQL logs connections | 1 | 1 |
6.2.3 | PostgreSQL logs disconnections | 1 | 1 |
6.2.4 | PostgreSQL logs statements appropriately | 1 | 1 |
6.2.5 | PostgreSQL logs messages at WARNING or above | 1 | 1 |
6.2.6 | PostgreSQL logs failing statements | 1 | 1 |
6.2.7 | PostgreSQL does not log statements by duration | 1 | 1 |
6.2.8 | PostgreSQL audit logging is on | 1 | 1 |
6.3.1 | SQL Server external scripts are off | 1 | 1 |
6.3.2 | SQL Server ownership chaining is off | 1 | 1 |
6.3.3 | SQL Server user connections are not capped | 1 | 1 |
6.3.4 | SQL Server user options are not set | 1 | 1 |
6.3.5 | SQL Server remote access is off | 1 | 1 |
6.3.6 | SQL Server trace flag 3625 is on | 1 | 1 |
6.3.7 | SQL Server contained database authentication is off | 1 | 1 |
6.4 | Cloud SQL requires TLS | 1 | 1 |
7.1 | BigQuery datasets are not public | 1 | 1 |
7.3 | BigQuery datasets default to a customer-managed key | 1 | 1 |
CIS Microsoft Azure Foundations Benchmark and connectors
Which connectors provide evidence for CIS Microsoft Azure Foundations Benchmark, for which controls, and how to connect them.
CIS Kubernetes Benchmark and connectors
Which connectors provide evidence for CIS Kubernetes Benchmark, for which controls, and how to connect them.